I need to build a router with some flexibility to limit and control our intranet, including port forwarding and network balance.The basic IPV4 configuration works fine with the required IPTABLES, NAT, SNAT and MASQUERADE ingredient.My problem is with IPV6.The ISP network (redacted) is 1:1:1:0A00/56; the Debian router (DR) have full access to IPV6 over the ISP: ping6, traceroute6, dns, ssh and http(s).   ProblemIPV6 communication between [D][E][F] works perfect, however traceroute6 or ping6 out of my intranet from a 'user' [E]  or [F] goes to * :).    #  2607:f8b0:4000:801::200e is google$ traceroute6 2607:f8b0:4000:801::200etraceroute to 2607:f8b0:4000:801::200e (2607:f8b0:4000:801::200e), 30 hops max, 80 byte packets 1  1:1:1:a01::7:10 (1:1:1:a01::7:10)  5.210 ms  4.939 ms  4.816 ms 2  * * * 3  * * * ....My configurationI'm using RADVD on interface [D] as follows:interface eth0{    AdvSendAdvert on;    AdvManagedFlag on;    AdvOtherConfigFlag on;    AdvReachableTime 0;    AdvRetransTimer 0;    AdvCurHopLimit 64;    AdvDefaultLifetime 600;    AdvHomeAgentFlag off;    AdvDefaultPreference medium;    AdvSourceLLAddress on;    MinRtrAdvInterval 5;    MaxRtrAdvInterval 15;    # redacted    prefix 1:1:1:0a01::/64    {            AdvValidLifetime 600;            AdvPreferredLifetime 600;            AdvOnLink on;            AdvAutonomous on;            AdvRouterAddr off;    }; # End of prefix definition}sysctlThe router is properly configured to forward IPV6 packages:    sysctl -w net.ipv6.conf.all.proxy_ndp=1    sysctl -w net.ipv6.conf.all.forwarding=1    sysctl -w net.ipv6.conf.eth0.accept_ra=2    sysctl -w net.ipv6.conf.eth0.accept_ra_defrtr=1    sysctl -w net.ipv6.conf.eth0.router_solicitations=1    sysctl -w net.ipv6.conf.eth1.accept_ra=2    sysctl -w net.ipv6.conf.eth1.accept_ra_defrtr=1    sysctl -w net.ipv6.conf.eth1.router_solicitations=1ip6tablesThe IP6TABLES as follows:$ ip6tables -nvLChain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination   30  9376 ACCEPT     all      lo     *       ::/0                 ::/0                    28  3184 ACCEPT     icmpv6    *      *       ::/0                 ::/0                    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp dpt:22    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp dpt:80    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp dpt:443     0     0 ACCEPT     all      *      *       ::/0                 ::/0                 ctstate RELATED,ESTABLISHED     0     0 ACCEPT     all      *      *       ::/0                 ::/0                 state RELATED,ESTABLISHED     0     0 ACCEPT     udp      eth0   *       ::/0                 ::/0                 udp dpt:520     0     0 ACCEPT     udp      eth1   *       ::/0                 ::/0                 udp dpt:520     0     0 LOG        all      *      *       ::/0                 ::/0                 LOG flags 0 level 4 prefix [ip6I]     0     0 ACCEPT     all      *      *       ::/0                 ::/0Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination    8   816 LOG        all      *      *       ::/0                 ::/0                 LOG flags 0 level 4 prefix [ip6F]     8   816 ACCEPT     all      *      *       ::/0                 ::/0Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination   77 14592 ACCEPT     all      *      *       ::/0                 ::/0routesThe routes are the follows:      $ ip -6 ro 1:1:1:a00::/64 dev eth1  proto kernel  metric 256  expires 345598sec 1:1:1:a01::/64 dev eth0  proto kernel  metric 256 fe80::/64 dev eth0  proto kernel  metric 256 fe80::/64 dev eth1  proto kernel  metric 256 default via fe80::68ee:96ff:fed7:c844 dev eth1 proto ra metric 1024  expires 178sec hoplimit 64
IPV6 routing Debian Comcast ISP
debian;routing;ipv6;router