Accept established not working for DHCPv6

[yuripg1]

That’s because the protocol use multicast. The ff02::1:2 address that you see in your screenshot is a multicast address.

https://datatracker.ietf.org/doc/html/rfc8415#section-5

A DHCP client sends most messages using a reserved, link-scoped
multicast destination address so that the client need not be
configured with the address or addresses of DHCP servers.

When the server responds, it will of course not be able to use ff02::1:2 as source address for its packets, but a fe80::/10 address, which means the packets will not be tracked as part of the previous outgoing connection.

BTW, the rule for DHCPv6 client in the MikroTik defconf firewall is:

/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10

And includes the restriction for src-address. You should use that too, to restrict the incoming packets to the local link layer.

Whenever possible, yes, restricting the source address to link-local is the way to go.

However, that’s not always the case, like with this ISP from the USA: Xfinity (Comcast) DHCPv6 configuration change!

So it is better to restrict it, but be prepared to loosen it in case it is needed.