It's a legal requirement in Europe for privacy. A long term static address is a personal identifier.

opnsense can use the delegated prefix for DHCPv6, it then automatically becomes the “LAN net” firewall alias and you can refer to it in a firewall rule I believe. I assume it’s the same for pfsense and I suspect they are not the only ones.

> v6 NPT is your friend

So NAT is the one true solution after all.. /s

> unless when you say 'public IP', you mean the IPv6 address being used on the pfsense facing the clients?

Well, that's kinda the thing, pfSense seems to assume global means it's also the IP facing the local clients. I couldn't get pfSense to advertise its ULA as the DNS server for example. But if you have a static prefix, that's not a bad assumption. And a static prefix is what the IPv6 designers envisioned.

> I'm assuming it's using DHCPv6 prefix delegation, and the delegation is being changed?

ISP indeed uses DHCPv6 prefix delegation. The prefix I get can change "randomly". It always changes when my router or modem reboots, but other times too (perhaps when their equipment reboots).

I should note that after getting very frustrated with pfSense, I threw it away a few years ago and switched to OpenWRT which has worked much, much better when it comes to IPv6.