Trouble Setting up ipv6

dazzaling69 · Sat Apr 06, 2024 7:33 pm

I finally got an IPv6 prefix from Vodafone. While trying to set up the rest of the router I somehow messed it up and it no longer receives one. ipv6 is quite different and I'm struggling with it. Can anyone help me find out why it no longer receives the prefix and also how I should set up the rest of the router to run dual stack.

PS. I also run a pihole container with all DNS queries forwarded through it. This is probably also not helping me set it up correctly.

Config attached

D.

dazzaling69 · Sun Apr 07, 2024 4:15 pm

I confirmed that if I turn off the pihole it still doesn't work.

confg.rsc

Kentzo · Mon Apr 08, 2024 11:43 pm

Why do you have VodafoneIPv6 both as a dynamic IPv6 pool (via the DHCPv6 Client) and a manually added pool? That might confuse RouterOS.

Also, remember that RouterOS's DHCPv6 Server cannot hang out addresses as its DHCPv4 Server. It only works for prefix delegation to downstream Routers. Downstream Hosts will need SLAAC that is configured via `/ipv6/nd`.

dazzaling69 · Tue Apr 09, 2024 2:41 am

Thanks. I think I am too lost to be able to use your suggestions. Is there an example setup I can work from?

Can you see anything else in the config that might be getting in the way?

Kentzo · Tue Apr 09, 2024 3:31 am

I cannot point to a specific thread, but if you search this forum for "ipv6" you will find a few viable configs and useful discussions.

CGGXANNX · Tue Apr 09, 2024 1:34 pm

Thanks. I think I am too lost to be able to use your suggestions. Is there an example setup I can work from?

Can you see anything else in the config that might be getting in the way?

From your configuration, this DHCPv6 Server entry is unnecessary and should be removed.

/ipv6 dhcp-server
add address-pool=VodafoneIPv6 interface="Local Bridge" name=DHCPserverIPv6

MikroTik's implementation only supports prefix delegation, not giving out individual addresses. For that SLAAC is used instead and you have no need of the DHCPv6 Server instance.

This manually added pool must be removed. The pool will be added dynamically by the DHCPv6 Client instead:

/ipv6 pool
add name=VodafoneIPv6 prefix=::/0 prefix-length=56

The DHCPv6 Client configuration must be changed to:

/ipv6 dhcp-client
add interface=Vodafone pool-name=VodafoneIPv6 \
    pool-prefix-length=64 prefix-hint=::/56 request=prefix

There are no needs to add the default route. Also, pool prefix length should be 64 for SLAAC to work. To request a /56 prefix from the ISP, we use the prefix hint instead.

You'll then need to add an address entry for the bridge for SLAAC to work on that interface. Change 1234 with your desired 64-bit interface id (the suffix) of the router address. You can also use ::1 for example.

/ipv6 address
add address=::1234 from-pool=VodafoneIPv6 interface="Local Bridge"

It's also recommended to add an /ipv6 nd entry for the "Local Bridge" if you don't want to use the default entry (the one for all interfaces)

dazzaling69 · Tue Apr 09, 2024 5:56 pm

Thank you for helping.

I made the changes you suggested, which has improved things a bit. I now get an ipv6 address on my computer but I can't connect to sites on the internet. If I do a connectivity test at https://test-ipv6.com/ it tells me that no ipv6 address is detected. If I try to connect to CloudFlare's DoH DNS server the test there tells me it's not connected to their DNS server.

I suspect this could be a) Vodafone (who might not have officially completed implementation of ipv6 yet), b) my router config or c) to do with the way I use a pihole container to route ipv4 DNS traffic (which I force for ipv4 with NAT rules, but not for ipv6) where my router is the advertised DNS server.

Do you have an idea what I might try to fix this? The concept of a DNS server address and my router being the default seems not to be the same for ipv6. How can I manage the way DNS works to achieve a similar end?

PS. I wish there was a simple guide to how ipv6 on Mikrotik worked somewhere (that I can find). I'm pretty familiar with ipv4, but the paradigm is quite different.

CGGXANNX · Tue Apr 09, 2024 7:26 pm

Could you please check whether in the table IPv6 - Routes, there is an entry for Dst.Address ::/0 that use the PPPoE interface "Vodafone" as Gateway with Distance 1? If no such entry exists, you might need to turn on "Add default route" on the DHCPv6 Client entry.

You can also check if the router itself is able to use IPv6 by open an Terminal in WinBox and run the command

/ping 2606:4700:4700::1111

On the client devices, check with ipconfig / ifconfig / ip addr (depending on the OS) whether the client has a Default Gateway for IPv6. The IPv6 address of the default gateway that the client see should be the link local (fe80:xxxx) address of the router that you see with

/ipv6 address print

in WinBox associated with the interface "Local Bridge". If not you might need to add an entry under IPv6 - ND (Neighbor Discovery) with "Local Bridge" as interface and on this entry, make sure that "Other Configuration" is checked.

Also try on the clients to run ping 2606:4700:4700::1111. The command doesn't need a DNS resolver. Normally the clients with dual stack enabled don't really need an IPv6 address for the DNS server, they happily use the DNS Server from IPv4 if needed. But if you have RouterOS running as DNS server in your LAN, you can tell the clients to use it as DNS server with IPv6 to. In the ND entry that you created above for the "Local Bridge" interface, you can turn on "Advertise DNS" and as DNS Servers enter the fe80:xxx address of the router on the "Local Bridge" interface that you see under IPv6 - Addresses (or /ipv6 address print).

I've not checked your firewall rules, but for testing you might try to temporarily disable the IPv6 - RAW rules.

dazzaling69 · Tue Apr 09, 2024 9:32 pm

Thanks again for the suggestions. No joy. Specific answers:

There is a route created for ::/0, which has the gateway with an fe80 address with a %Vodafone at the end. I assume this is working.
I can ping the address from a Winbox terminal but NOT from windows - it just times out
The IPv6 Gateway on Windows does have the address of the router
ND looks set correctly
I set advertise address - no change
Tried disabling all the RAW rules. No effect.

Does that narrow it down?

D

dazzaling69 · Wed Apr 10, 2024 5:27 pm

I realised that my ipv6 firewall filter rules were all forwards with no inputs (face-palm). I fixed that (below) but still no joy - is there anything obviously wrong? Not being able to ping from my Windows PC (but works from ROS) makes me think it's either a firewall or some other routing issue. It could also be Vodafone not having implements this fully yet.

D.

# 2024-04-10 15:19:44 by RouterOS 7.14.2
# software id = 4SAD-K293
#
# model = RB5009UG+S+
# serial number = HE408Z9RT61
/ipv6 firewall filter
add action=accept chain=input comment="allow established and related" \
connection-state=established,related,untracked
add action=drop chain=input comment="Drop Invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \
src-address=fe80::/10
add action=accept chain=input comment="allow allowed addresses" \
src-address-list=allowed
add action=drop chain=input comment="Drop LL from Public" disabled=yes \
in-interface=Vodafone log=yes log-prefix=DropLL_from_public src-address=\
fe80::/10
add action=drop chain=input comment="Drop anything that got this far"
add action=accept chain=forward comment="defconf: accept established,related" \
connection-state=established,related,untracked
add action=drop chain=forward comment=invalid connection-state=invalid log=\
yes log-prefix=ipv6,invalid
add action=accept chain=forward comment="defconf: accept ICMPv6 after RAW" \
protocol=icmpv6
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
src-address-list=no_forward_ipv6
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
dst-address-list=no_forward_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches IPSec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!listBridge
add action=drop chain=forward log-prefix=IPV6

dazzaling69 · Wed Apr 10, 2024 6:48 pm

One more thing. On my PPPoE settings the ipv4 remote address is publicly routable but ipv6 is fe80:

24ff:fe88:2a3f. Isn't this a link-local address or does IPv6 do this differently as well? The IPv6 prefix is received and the DHCPv6Client is bound, but perhaps this is all negotiated over IPv4 and the IPv6 stack is not properly set up.

I'm clutching at some straws here.

CGGXANNX · Wed Apr 10, 2024 6:50 pm

I don't think that this line should be in your firewall filter list. It should be disabled, otherwise the router will not forward traffic from "listBridge" to "WAN"

add action=drop chain=forward log-prefix=IPV6

Maybe you can try to use the firewall rules that comes with the default configuration (defconf) of your RB5009 router, instead of the ones from MikroTik's documentation. My firewall rules are also based on it (defconf) and IPv6 has always been working without problems. If you run the command

/system/default-configuration/print without-paging

And scroll down to the section beginning with

/interface list member add list=LAN interface=bridge comment="defconf"
/interface list member add list=WAN interface=ether1 comment="defconf"

you'll find the IPv4 and IPv6 default firewall configuration:

/interface list member add list=LAN interface=bridge comment="defconf"
/interface list member add list=WAN interface=ether1 comment="defconf"
/ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade"
/ip firewall {
  filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
  filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
  filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
  filter add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)"
  filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
  filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
  filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
  filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
  filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
  filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
  filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"
}
/ipv6 firewall {
  address-list add list=bad_ipv6 address=::/128 comment="defconf: unspecified address"
  address-list add list=bad_ipv6 address=::1 comment="defconf: lo"
  address-list add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local"
  address-list add list=bad_ipv6 address=::ffff:0:0/96 comment="defconf: ipv4-mapped"
  address-list add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat"
  address-list add list=bad_ipv6 address=100::/64 comment="defconf: discard only "
  address-list add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation"
  address-list add list=bad_ipv6 address=2001:10::/28 comment="defconf: ORCHID"
  address-list add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone"
  filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
  filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
  filter add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
  filter add chain=input action=accept protocol=udp dst-port=33434-33534 comment="defconf: accept UDP traceroute"
  filter add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="defconf: accept DHCPv6-Client prefix delegation."
  filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
  filter add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
  filter add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
  filter add chain=input action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
  filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
  filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
  filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
  filter add chain=forward action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6"
  filter add chain=forward action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6"
  filter add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1"
  filter add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
  filter add chain=forward action=accept protocol=139 comment="defconf: accept HIP"
  filter add chain=forward action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
  filter add chain=forward action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
  filter add chain=forward action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
  filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
  filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
}

If you use them, first you should delete all your existing rules in all tables (filter/raw/masquerade) and of course rename all instances of the interface list "LAN" in the rules to your "listBridge".

Otherwise you can keep your existing rules but you should remove the last drop line I mentioned above!

dazzaling69 · Wed Apr 10, 2024 9:00 pm

Thanks. I will try that. It feels like the firewall rules are fairly basic though. I'm puzzled why fairly vanilla input and forwarding rules (processed in order from top to bottom) wouldn't allow me to at least ping an IPv6 address from my Windows box.

Is there some troubleshooting I can do to see where the packets are getting discarded? That might help narrow the problem down. Or do you think it must be firewall related?

CGGXANNX · Wed Apr 10, 2024 11:04 pm

It's the last rule in your filter list that I mentioned in my previous post. Here is that line once again:

add action=drop chain=forward log-prefix=IPV6

That rule blocks all forwarding. When your devices go to the internet with IPv6, your router must FORWARD the packets for them (different to IPv4 is that there is no extra NAT/masquerade step needed in IPv6). The last rule of your filter list effectively blocks those packets. That's why I suggested that you DISABLE that rule in my previous post.That rule is not present in the defconf firewall and also not present on https://help.mikrotik.com/docs/display/ ... d+Firewall (which I assume was the source of your firewall rules?).

If you want to keep that line, then you must add one additional rule ABOVE IT with action=accept, to allow forwarding from "listBridge" to "WAN"

/ipv6 firewall filter
add action=accept chain=forward comment="allow listBridge to internet" in-interface-list=listBridge out-interface-list=WAN

However if you look closely, you'll see that the two lines will now become fully redundant, because right above them there is this line:

add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !listBridge

Which effectively already did exactly that, namely blocks forwarding for everything except for packets from listBridge. That's why you should REMOVE/DISABLE the drop line that you added that was part of neither the default configuration (defconf) nor the example configuration from the website!

dazzaling69 · Thu Apr 11, 2024 2:07 pm

Thanks again for your reply.

I did what you originally suggested and nuked all the Filter, NAT, RAW and Address List entries and added the default ipv6 rules. I still don't have any PING from my Windows box, nor ipv6 web access.

My complete ipv6 rules are attached. If it isn't this then I guess the problem is somewhere else?

CGGXANNX · Thu Apr 11, 2024 3:01 pm

Thank you for the updated config. In this first command:

/ipv6 address
add advertise=no from-pool=IPv6_Pool interface="Local Bridge"

You must turn on advertise. Otherwise, the router will not advertise the prefix for SLAAC to work.

Once "Advertise" is turned on for the entry, then this line at the bottom of your file:

/ipv6 nd prefix
add interface="Local Bridge"

Is no longer needed, because there will be a dynamic (with letter "D" in the IPv6 - ND - Prefixes table) automatically added instead. Which means you should remove this line (by removing the entry in the table without the letter "D").

AS for the ND entry:

/ipv6 nd
add dns=fe80::4aa9:8aff:fe57:4601 interface="Local Bridge"

If your clients Windows then you should turn on managed-address-configuration=yes other-configuration=yes for this entry too. It previously did not work for my Windows clients when I didn't have "other-configuration=yes".

The filter rules look ok to me, that is if you have put "Local Bridge" in the interface list "LAN". If your interface list that contains "Local Bridge" is not named LAN (it was "listBridge" in the previous config) then you have to adjust the rules accordingly.

dazzaling69 · Thu Apr 11, 2024 3:44 pm

Aha. Partial successs!

I can now ping an ipv6 DNS server from my windows box! However, running test-ipv6 I get the below:

Your Internet Service Provider (ISP) appears to be Vodafone

No IPv6 address detected [more info]

Our tests show that you will have a broken or misconfigured IPv6 setup, and this will cause problems as web sites enable IPv6.

We have suggestions to help you fix your system. [more info]

Does this make any sense to you?

Thanks for getting me this far.

D.

dazzaling69 · Thu Apr 11, 2024 4:25 pm

Update - for some reason, this test site shows a fail, but ipv6test.google.com shows a pass. Quite a lot of other ipv6 test sites fail to load, e.g., https://whatismyv6.com/, https://ipv6-test.com/, ipchecktool.com.

So I'm unclear whether my ipv6 connectivity is sort of working or completely working (and those sites are broken). The result that a lot of ipv6 checker sites fail to load, but everything else does, seems suspicious. These sites all open when I connect my browser via a VPN, so I suspect some misconfiguring or a Vodafone problem.

Is there a definitive test I can run? Is it a dual stack problem?

CGGXANNX · Thu Apr 11, 2024 5:58 pm

If you can ping IPv6 IP addresses, and some tests succeed but others fail. Maybe there is a problem with the DNS setting in the ND entry. Currently you have the link local address of, I assume the router. Can you verify if that address is correct (match the link local address of "Local Bridge"), als verify that under IP -> DNS, the setting "Allow Remote Request" is on.

Alternatively, you might try to remove (clear) that DNS setting in the ND entry. Or replace the value with some 3rd party DNS server like Google's 2001:4860:4860::8888 or 2001:4860:4860::8844?

Another possibility is some MTU related problems. Can you go to speedguide.net/analyzer.php and see the reported MTU value? then put that value in the MTU field of the IPv6 -> ND entry for "Local Bridge"?

dazzaling69 · Thu Apr 11, 2024 7:27 pm

TBH, I was sceptical about the MTU suggestion but that seemed to do the trick. I also removed the DNS server entry.

Thank you very much for your help. This is not remotely straightforward to configure!

Is there anything else you recommend doing/testing? There are some advanced firewall and raw rules, but not sure what benefit they are.

D.

CGGXANNX · Thu Apr 11, 2024 8:21 pm

If you are not yet using IPsec with IPv6, you can, for now, disable all those rules in the filter list with IPsec in the comment, that includes the IKE, AH, ESP rules, and the HIP too. The fewer rules enabled the better, because unlike with IPv4, fasttrack is not supported with IPv6 so we would want to reduce CPU resource spent on firewall processing (more rules more CPU load) if possible.

Also, I don't know if it applies to Vodafone. But many ISPs now support RFC 4638, which means an MTU of 1500 is supported for a PPPoE connection, which means no more headache and workaround for MTU problems like you experienced. My internet connection is over PPPoE too and it works with MTU=1500 without any issue.

You can try to see if it's supported by first editing the MTU of the underlying ethernet Port (for instance ether1) to 1508. Then in the setting of your pppoe-out1 interface (which you named Vodafone) set both Max MTU and Max MRU to 1500. If you redial and see Actual MTU has a value of 1500, then RFC 4638 is supported by Vodafone and you can remove the previous fix with the MTU field in ND.

You can then go to the same speedguide.net/analyzer.php page to check whether MTU is now really 1500.

dazzaling69 · Thu Apr 11, 2024 10:25 pm

Thanks. It seemed to take a few seconds to sort itself out but that seems to work like a charm with 1500 MTU.

Trouble Setting up ipv6

Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Re: Trouble Setting up ipv6

Who is online