VyOS for performance but if you don’t use a network device CLI regularly and it’s for home use OPNsense.

OPNsense comes with a lot of pretty sane defaults for a gateway/firewall, VyOS you really do everything from scratch, as it’s more geared towards enterprise or service provider.

VyOS does do well as a gateway/firewall and there is a lot you can install to extend features for stuff like what OPNsense has to the point that I have had 0 things I couldn’t do when I migrated a few years ago.

Depending on how your ISP is doing IPv6, the typical way would just route the entire prefix to your router, and the ISP would not know how many addresses are used, in the sense that there is no table (no neighbor discovery is needed). If your ISP is keeping data of flows from your prefix then it could start counting unique addresses, but there isn’t really good a reason to and it wouldn’t be accurate. Some devices pull and use more than one address, and quiet devices might not get picked up by flows which are typically sampled at a ratio.

New York State’s civil service pension/retirement system is still like this. Including holidays.

Without prefix delegation turned on, you probably don’t get an IPv6 address on your lan devices. With it turned on, your router should assign a /64 to the LAN from a different subnet then what your WAN will have.

With PD on, what addresses do your clients get? For the laptop that doesn’t work, what does test-ipv6.com tell you?

With IPv6 you need to have your firewall rules setup correctly, as blocking certain ICMP messages will break IPv6.

Is the static IPv6 chosen for your server from the subnet your WAN is in? In this case, with PD off, if you cannot reach the internet you might need to enable a Neighbor Discovery Protocol proxy to allow the service provider’s router to learn where to find your server.

Personally, I would reenable PD then try to get the work laptop fixed. Maybe disable IPv6 on the work laptop. What I found at my job, is that when I am on VPN from a dual stack client, my company does not give a IPv6 address (or route) on the vpn, but replies with AAAA records causing the client to try to use the internet to reach things behind the corporate firewall.