VyOS for performance but if you don’t use a network device CLI regularly and it’s for home use OPNsense.
OPNsense comes with a lot of pretty sane defaults for a gateway/firewall, VyOS you really do everything from scratch, as it’s more geared towards enterprise or service provider.
VyOS does do well as a gateway/firewall and there is a lot you can install to extend features for stuff like what OPNsense has to the point that I have had 0 things I couldn’t do when I migrated a few years ago.
Depending on how your ISP is doing IPv6, the typical way would just route the entire prefix to your router, and the ISP would not know how many addresses are used, in the sense that there is no table (no neighbor discovery is needed). If your ISP is keeping data of flows from your prefix then it could start counting unique addresses, but there isn’t really good a reason to and it wouldn’t be accurate. Some devices pull and use more than one address, and quiet devices might not get picked up by flows which are typically sampled at a ratio.
New York State’s civil service pension/retirement system is still like this. Including holidays.
Without prefix delegation turned on, you probably don’t get an IPv6 address on your lan devices. With it turned on, your router should assign a /64 to the LAN from a different subnet then what your WAN will have.
With PD on, what addresses do your clients get? For the laptop that doesn’t work, what does test-ipv6.com tell you?
With IPv6 you need to have your firewall rules setup correctly, as blocking certain ICMP messages will break IPv6.
Is the static IPv6 chosen for your server from the subnet your WAN is in? In this case, with PD off, if you cannot reach the internet you might need to enable a Neighbor Discovery Protocol proxy to allow the service provider’s router to learn where to find your server.
Personally, I would reenable PD then try to get the work laptop fixed. Maybe disable IPv6 on the work laptop. What I found at my job, is that when I am on VPN from a dual stack client, my company does not give a IPv6 address (or route) on the vpn, but replies with AAAA records causing the client to try to use the internet to reach things behind the corporate firewall.
No, you are likely looking at an ONT (optical network terminal), and it is not a router. Even with a port that accepts the fiber (sfp or sfp+ for 10g) on your equipment, the OLT (optical line terminal) likely will not provide you with service.
If you were to match the wavelengths the ISP is using you are likely to become a “rogue” on their PON that can knock out service for other customers that share the same passive network as you.
I make assumptions about you being on PON since you say AT&T, generally all I have ever seen from them are passive networks (one fiber with splitters for 1 port to many customers) unless you are paying extra for “dedicated” ($$$$$) internet.
If they are using a ONT with an “RG” (residential gateway) which is the typical “all in one” you can request the gateway service can be removed and replaced with a layer 2 bridge, where you’re router/firewall gets the “external” addressing and there is nothing being done by the ISP equipment other than sending you traffic and OAM (operations, administration, and maintenance; usually check or alert for light levels, software status, if a part of the ONT fails etc).
I have used keycloak for work and home for years and love it. A lot of flexibility, which comes with some additional complexity but there are lots of guides for it.