Connection error when trying to access Mikrotik’s websites over IPv6

[CGGXANNX]

Great! In that case you can try these two alternatives to the mangle rule, see this thread for an example:

One Website not accessible - RB5009

Because your WAN connection is using PPPoE which is point-to-point, the gateway is always the other peer, and you should neither accept router advertisements (keep the setting at “yes if forwarding disabled”), nor set “add default route” to “yes” for DHCPv6 Client. Set it to “no” and you’ll only have one default route with pppoe-WAN as gateway left. Your issue that only happens with one website might be MTU related. Because you are using PPPoE for your WAN and I don’t see max-mru=1500 max-mtu=1…

Ideal would be to be able to use MTU = 1500 with RFC 4638 from the ISP, by trying to set Max MRU = Max MTU = 1500 on the PPPoE client VIVO-PPP. Only if that’s not possible, try to announce the MTU value of 1492 with router advertisement instead.

Please note that if you currently only have one IPv6 → ND entry with the interface all then you can set the value directly there like in the linked post. Or you can create separate copies of the ND entry, one for each of your LAN/VLAN interface and set the value on them (then you can disable the default entry for the all interface).

If one of those alternatives can be applied, then you don’t need the mangle rule anymore (the mangle rule only helps TCP connections).

@publio

What raised my doubts and what I’d like your help to understand is why only the Mikrotik domain was affected and why my ping tests, even when changing the packet size, didn’t show any problems.

Did you specify the ping size up to the limit of the MTU 1500 packet? Under Windows the size parameter would be 1452 for example:

ping -l 1452 2001:4860:4860::884

As for the reason why it only happens with some sites:

Most of the websites with IPv6 support only send packets much smaller than the 1500-byte limit. You can read this old Cloudflare article describing the reason for that Fixing an old hack - why we are bumping the IPv6 MTU.

And normally, if Path MTU Discovery was fully working on the path between you and the remote host, then it wouldn’t be a problem neither. But for PMTUD to work, all the hops between you and the remote host must allow ICMPv6 forwarding.

So, the problem you experienced is probably a combination of the MikroTik server sending full size (1500 bytes) response packet and something on the way between you and that server blocking ICMPv6.