IPv6 subnet routing to instance

I don't have second ENI because I already have second internal interface created by OpenVPN server. But the main problem that IPv6 subnet routing just don't work: packets send to an address within the routed prefix simply doesn't come to ENI interface. I checked that with tcpdump. Moreover, my EC2 instance stops receiving router advertisments when I remove IPv6 address from ENI. But assigning IPv6 address from another prefix to the ENI does not solves the problem with the routed subnets. However, assigned IPv6 address is work for the instance: I can use it to connect via SSH and ping - and it works nice, but not the addresses from routed prefix. Inb4: IPv6 forwarding is turned on.

If you are not using the OpenVPN server to dynamically assign the IP to the VPN clients, then you may need to tweak the configuration.

With a VPN-instance, you'll need an ENI mapped to the external interface (first /64 prefix) and a second ENI mapped to the internal interface (second /64 prefix). The route table for the first /64 prefix (external subnet) should have a default (or preferred static) route pointing to the VPC IGW, while the route table for the second /64 prefix (internal subnet) should have a default (or preferred static) route pointing to the internal ENI on the VPN-instance.

The VPN clients (getting their IP from the internal subnet) will route their external traffic to the internal ENI on the VPN server and it will go through the VPN

Your answer didn't help me. On the step of attaching a 2nd ENI - I cannot see my 2nd ENI if ENI is in an another availability zone. When I created ENI in the same availability zone then is it available for attaching. And I attach it but there is didn't appear a new network interface in the VM. And routed IPv6 prefixes to the 2nd ENI still don't have access to the internet.