[Dagger2]

It's pretty simple with systemd-networkd:

  # On the upstream network.
  [Network]
  DHCP=yes
  [DHCPv6]
  PrefixDelegationHint=::/56

  # On each downstream network.
  [Network]
  IPv6SendRA=yes
  DHCPPrefixDelegation=yes

If you don't want systemd-networkd, look at https://wiki.debian.org/IPv6PrefixDelegation#Using_ifupdown_.... Firewalling is the same as v4, just without the NAT.

One frustrating part is that as far as I can tell nothing supports easy downstream DHCPv6-PD delegation, so machines on the downstream network that want their own prefix won't be able to get one automatically. OpenWRT's network config daemon supports it, but nothing on regular Linux does.

> however many /64s that is (at least 8);

256!