Sure, if your IPv6 connection gives you a prefix that is large enough for all the devices in the LAN (i.e. a prefix number smaller than /128, ideally /64 or less).
First, enable IPv6 forwarding by adding this line to
Then either run
sudo sysctl -p or reboot to make it take effect.
This will disable IPv6 autoconfiguration as a side effect, so you may need to re-enable it on your VPN interface, by arranging for these commands to run after your VPN interface has come up:
sysctl -w net.ipv6.conf.<your_VPN_interface_here>.accept_ra=2
sysctl -w net.ipv6.conf.<your_VPN_interface_here>.autoconf=1
If you are getting a /128 prefix (= single host only) on the VPN interface, you'll need to contact your VPN provider and find out how you can get a wider prefix. It might require different VPN settings, or it might require setting up a DHCPv6 client to make a Prefix Request on the VPN-side.
If you can get a wider-than-/64 prefix (= smaller number) on your VPN interface, it will allow you to use SLAAC on your LAN, which is probably the easiest way to configure IPv6.
You'll also want to think about IPv6 firewalling here: set some IPv6 firewall rules in advance to block any incoming connections from the VPN-side you don't specifically need. Think twice before blocking any ICMPv6 types or IPv6 multicasts; both are essential parts of the IPv6 protocol and you can't just completely block them.
Your system is now ready to become an IPv6 router. You should now think about how you split the IPv6 address space allowed to you by the prefix on the VPN interface, and assign sub-prefix(es) of it to your LAN-side interface(s). Since all the IPv6 addresses within your prefix are now yours to use as you see fit, you can just manually assign the IPv6 address for your LAN-side interface(s).
Then install and configure
radvd to make your system announce to the LAN that it's an IPv6 router. Modern versions of
radvd will also be able to announce the IPv6 DNS servers and the domain suffix the clients should use.
radvd configuration will also include a few settings that tell the clients if they're allowed to just pick an IPv6 address on their own by using stateless address autoconfiguration (SLAAC), or if they're supposed to use DHCPv6. Also, even if you choose to allow SLAAC, you may still make a DHCPv6 server available to provide some extra configuration information to your clients.
Once you've set those bits appropriately and started up
radvd to announce the presence of an IPv6 router to your LAN, if your LAN-side sub-prefixes are /64 or wider and you have allowed SLAAC, your clients should now be receiving the
radvd announcements and automatically getting themselves a basic IPv6 configuration.
If you ended up with a tighter-than-/64 prefix (=higher number) on your LAN-side, or if you chose to not use SLAAC, you'll now need to set up a DHCPv6 server for your clients.
Then it's time to start testing. If your clients are only showing a link-local IPv6 address that starts with
fe80::, you should first verify that they are seeing the router announcements of
radvd. That's a fundamental part of IPv6 autoconfiguration; without those announcements, nothing else will happen.