I am running a CRS125-24G-1S-RM with RouterOS version 6.24. I am seeing a rather strange issue where I’m seeing IPv6 router advertisements leaking across VLANs. Unsure if this a bad configuration somewhere on my part or a bug.
Example:
My desktop PC on VLAN 10, whenever I turn on something in VLAN 20, I see the router solicitation and the corresponding router advertisements which confuses the host in VLAN 10.
I have exactly the same issue.
I have a MT at my home office with:
hAP AC2:
bridge (is default vlan1) without vlan filtering enabled
vlans configured on switch chip
On my macbook connected via WLAN i have a windows VM running which gets IPv6 addresses from a few, sometimes all vlan interfaces with advertising turned on.
This happens on every reboot. If I disable IPv6 on the Windows NIC and re-enable it, I “only” get the IPv6 address as expected.
After a reboot I have at least two IPv6 addresses from at least two different vlans and this is also random on every reboot.
The virtual NIC of the VM is bridged on macOS via the Hypervisor Parallels…
Hm. How is it possible that this is going over WiFi?
IIRC WLAN tags aren’t sent over WiFi, right? But my Win-VM running on the mac (connected via WiFI) inside Parallels Hypervisor receives RAs so there must be some leak…
You ressurected 8 years old topic started for 6.24 ROS version. Is your configuration really the same as that old one? There was a big change @6.41 version są maybe you should send your configuration? Do you still use 6.24? Think not as hAP is IMHO not ready for 6.24.
OK, so go ahead and post the export of the actual configuration, not just random screenshosts. If no misconfiguration can be found in the export, the next step is to sniff on the bridge interface, to see what is really going on there when the Windows boot.
Switch chips with a VLAN table support (QCA8337, > Atheros8327> , Atheros8316, Atheros8227 and Atheros7240) can override the port isolation configuration when enabling a VLAN lookup on the switch port (the vlan-mode is set to fallback, check or secure). If additional port isolation is needed between ports on the same VLAN, a switch rule with a new-dst-ports property can be implemented. Other devices without switch rule support cannot overcome this limitation.
Thanks @BartoszP for the suggestion.
I’m not sure if this can help - especially because the issue happens on WiFi.
It’s also possible that I just don’t understand - can you explain please?
Thanks a lot!
I’m experiencing the same issue on a CCR2004-1G-12S+2XS on 7.2. Upgrading it to the latest non RC when everyone leaves for the day. Hopefully it fixes the issue. I’ll be back with a config if it doesn’t. Nothing crazy with my config, just basic intervlan routing.
Issue still persist. Only on wired connections though. Wireless only gets their appropriate RA, but wired connections get ALL of them. I stripped out all the public addresses, but left the v4 internal as they are NAT’d anyway. New revelation today with this export is it looks like the 2 vlan interfaces (Data100 and Data102) on sfp-sfpplus2 are triggering a Duplicate Address Detected. Perhaps someone was nice enough to loop a cable back into another port in the wall crossing vlans? I know it’s an old thread that has been revived but thought more exploration may help someone aside from me.
I’m still seeing this issue in various deployments.
Searching the net shows lots of people have similar issues only related to IPv6 RAs and it looks like only WindowscClients are affected…
It looks like Windows just strips off the vlan tags and then gets the RAs which are in VLAN tagged packets.
PriorityVLANTag (standard Window keyword for NICs) documentation states (https://docs.microsoft.com/en-us/windows-hardware/drivers/network/enumeration-keywords):
“The miniport driver should remove the 802.1Q header from all receive packets regardless of the *PriorityVLANTag setting.
If the 802.1Q header is left in a packet, other drivers might not be able to parse the packet correctly.
If the Rx flag is enabled on the receive path, the miniport driver should copy the removed 802.1Q header into OOB.
Otherwise, if the Rx flag is disabled, the miniport driver should not copy the removed 802.1Q header into OOB.”
http://forum.mikrotik.com/t/windows-10-router-advertisement-leaking/162655/1
“This has nothing to do with Mikrotik specifically, the same would be seen using a router from any other network vendor.
It is well known that most Microsoft network drivers strip VLAN tags on ingress,
so any tagged broadcast/multicast packets will also be delivered to the network stack rather than being discarded.”
Regarding IPv4 DHCP Broadcasts:
“IPv4 is not targeted most of the time because DHCPv4 answers are normally unicast, except if the broadcast flag is set in the request”
That makes perfect sense. Yes the broadcast can also leak but the answer is unicast and would never reach the server.
In my case a Windows Client is connected to a port with PVID 1 which also has some tagged vlans on it.
The Windows Client is running inside a VM. It’s not possible to remove the VLAN tags off of the port because they’re required for other VMs on the VM-Switch.
My hypervisor is Proxmox and I’m using virtio vNIC (https://bugzilla.redhat.com/show_bug.cgi?id=1854416).
There seem two workarounds:
Option #1:
Set “Priority and VLAN tagging” in the driver to disabled
Option #2:
Set VLAN ID to the untagged PVID of the port the machine is connected to.
In my case PVID is 1 so I set the NIC driver to vlan 1 (is set to zero by default):
IMO it’s a gross misconfiguration (of network admin mostly) to set port as hybrid or trunk when machibe, connecting to that port is a Windows machine. Only when machine administrator adjusts adapter/network stack settings to deal with tagged frames properly, then it’s time for network admin to allow tagged frames towards such machine.
If windows machine is running virtualized, then VM platform admin has to make appropriate configuration adjustments.
The whole thing is (almost) never due to bugs in switches/bridges, so it’s not clear why are we still discussing it in this forum?
I wish it was only related to Windows, but I have experienced in Linux and ChromeOS(Linux) as well, ironically not on Android(Another Linux), but only with the CCR2004-1G-12S+2XS as the source of the RA’s
