diff --git a/modules/clan/gw-router/crowdsec.nix b/modules/clan/gw-router/crowdsec.nix
index 95fc8bb..424071a 100644
--- a/modules/clan/gw-router/crowdsec.nix
+++ b/modules/clan/gw-router/crowdsec.nix
@@ -1,5 +1,5 @@
 {
-  roles.default.perInstance = { settings, ... }: {
+  roles.default.perInstance = { ... }: {
     nixosModule =
       {
         config,
diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index c16c929..583a429 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -302,6 +302,7 @@
   };
 
   imports = [
+    ./ipv6.nix
     ./pppoe.nix
     ./crowdsec.nix
   ];
diff --git a/modules/clan/gw-router/ipv6.nix b/modules/clan/gw-router/ipv6.nix
new file mode 100644
index 0000000..824294d
--- /dev/null
+++ b/modules/clan/gw-router/ipv6.nix
@@ -0,0 +1,29 @@
+{
+  roles.default.perInstance = { ... }: {
+    nixosModule =
+      {
+        lib,
+        ...
+      }:
+      {
+
+        systemd.network.networks."45-ppp0" = {
+          matchConfig.Name = "ppp0";
+          networkConfig = {
+            DHCP = "ipv6";
+            # pppd owns the v4 address/route on this link; don't let networkd
+            # tear them down.
+            KeepConfiguration = "static";
+            # Default v6 route comes from the ISP's RA when they send one.
+            IPv6AcceptRA = true;
+          };
+          # Many PPPoE ISPs never send an RA with the M flag; solicit regardless.
+          dhcpV6Config.WithoutRA = "solicit";
+          linkConfig.RequiredForOnline = "no";
+        };
+
+        boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
+
+      };
+  };
+}