[7.23.1] Invalid IPv6 prefixes after update from 7.22.3

[CGGXANNX]

@m4c

So if I understand you correctly, with 7.23 RA messages will be send, if there is a valid entry in /ipv6 ND, but only with e.g., DNS, Mac address and MTU, and not with a prefix when there is no entry in /ipv6 ND prefix

This is correct, and unfortunately, that was the change in 7.23:

@EdPa

• ipv6,ra - fixed sending only DNS or MTU when prefix is set to "none";

That is causing a lot of problem in the past weeks since 7.23 was released. Because by default there is an /ipv6 nd entry enabled with the interface set to all (in your config that was changed to bridge1). Previously the device did not send RA if the interface has no /ipv6 nd prefix entry. But with 7.23, suddenly the router sends RA on all interfaces (due to the default interface=all entry), even for WAN interfaces or for the case where the device should only act as a switch and should not announce itself as a router. As a result people had these problems since 7.23:

• Switches and access points that suddenly advertise themselves as gateway, causing IPv6 to break in networks due to the presence of multiple gateways.

• People's internet connections are broken because the MikroTik router sends RA on the WAN interface towards the ISP devices, and many ISPs shutdown the connection when they receive rogue RA.

@m4c

and there will be only entries there, if the advertise flag is set to yes for entries in /ipv6 address

This, however is not true. Enabling the advertise flag does create a dynamic ipv6 nd prefix automatically, but that is not the only way to have such entries.

• You could always manually add /ipv6 nd prefix entries with interfaces and prefixes, without the need for adding /ipv6 address entries.

• Since 7.21 you can manually add /ipv6 nd prefix entries with prefix=none already:

  @EdPa

  • ipv6 - added "none" option for IPv6/ND/Prefix when advertising just options, not prefix;

  And with that 7.21 change, the use case you mentioned of only advertising gateway, DNS, MTU, MAC address was already possible, without needing the problematic change in 7.23. This worked already I had that configured on my test installation with only DHCPv6 and no SLAAC since 7.21.

So with many recently reported problems, my guess is that MikroTik will undo the change (but not the bug fix for the interface=bridge1 issue) and will only send RA when there is also a matching /ipv6 nd prefix entry (that can have prefix=none if needed).