For the life of me I can't figure out how to configure a firewall to correctly use IPv6.
First, let me explain my setup. I have created a small test environment in order to play around with IPv6 and get a feel for it, before configuring my non-test enviroment to work in dual-stack mode. I have an Asus DSL-AC68U as my router, and I get a native /56 IPv6 subnet from my ISP. The router is configured to to allow stateless autoconfiguration of the clients and send out router advertisements. Clients connected directly to that router get an address and are able to ping google.com using IPv6 and score 19/20 on http://ipv6-test.com/.
I then tried putting a firewall between my router and clients. The WAN network card on it gets an IPv6 address assigned to it, as well as an IPv4 address and using the firewall's interface I am able to at least ping google.com using both IPv4 and IPv6. The LAN card does not get an address, and I assign it a static /24 IPv4 subnet, configure a DHCPv4 server, a static IPv6 address and configure a router advertisement for a /64 subnet (the same subnet that static IPv6 address is in). My clients behind the firewall get both an IPv4 and IPv6 address, in the correct subnets, but they are unable to contact anything outside of the firewall using IPv6 and anything outside the firewall is unable to contact addresses behind it. IPv4 connectivity works as one would expect. The firewall is wide open with a single rule explicitly allowing everything through in either direction. Traceroutes from outside my network attempting to contact IPv6 addresses behind the firewall stop at my ISP's gateway (i.e. not on my network). I've also attempted to manually configure routing through the firewall's interfaces, as well as playing around with a separate pfsense (CE version 2.4.3_1) instance instead of my HW firewall appliance, but I haven't managed to get any further that this.
What am I missing? Or alternatively what am I doing wrong?
I'd be grateful for any pointers. If you need any logs, config dumps,... I'd be happy to provide a redacted version.
EDIT: so, as requested, here's my firewall (Watchguard M200 running OS version 12.2 Build 568630) configuration: on the WAN side, IPv4 is configured via DHCP. IPv6 is enabled, address is autoconfigured and I get a /64 subnet from my router. DHCPv6 client is enabled with rapid commit, DHCPv6 client prefix delegation is enabled with rapid commit. IPv6 is 2001:X:X:5000:X:X:X:X.
On the LAN side, IPv4 is static (10.0.1.1) with a DHCP server running. IPv6 is also static (2001:X:X:5001::1) with a prefix advertisement for the subnet 2001:X:X:5001::1/64. Autonomous and onlink boxes are checked. Router advertisement is being sent with both M and O flags. DHCP is disabled.
Clients behind the firewall get an IPv6 address like 2001:X:X:5001:X:X:X:X via autoconfiguration. There are currently only two clients, since this is a test environment and as such I can guarantee the addresses are unique on the network.
Firewall itself has its first policy set to allow any kind of package on any port from and to anywhere. It does not differentiate between IPv4 and IPv6 traffic, or at least I find no control to toggle between the two.
Firewall has otherwise not been configured. It has been reset multiple times between tests and there are no NAT rules, black or white lists,... I have deleted all explicit routes configured by me on both clients and firewall.
Full config file for the firewall can be found at http://pasted.co/76465fb7