I am currently experiencing an issue with my hAP ax3 router running firmware version 7.15.2. The problem lies with the DDNS (IP/Cloud) service, which fails to register the AAAA record (IPv6 address) of my router. On the other hand, the IPv4 A record is registered without any issues.
In the past, I have not encountered any problems with IPv6 and Mikrotik’s DDNS service. I haven’t made any changes to the IPv6 settings on my router that I am aware of.
Additionally, IPv6 is functioning correctly within my network.
If needed, I can provide my configuration for further analysis.
Could anyone provide assistance or guidance on how to resolve this issue?
how am I supposed to add an IPv6 address to router itself? I see one under IPv6/dhcp client/status and on the wan interface (ether1) under IPv6/addresses.
and it fails, then you have a problem with resolving DNS on the router. If it otherwise works, then try to ping & trace route to the IPv6 address of dns.google:
On this forum it has been advised by many people that with IPv6 DHCP client you should not turn on “add-default-route” because it has always been a MikroTik hack. DHCPv6 does not have route information. An example of such posts:
So, you should turn it off, and rely on accept-router-advertisements=yes under IPv6 settings (you already have this setting turned on). Otherwise, there might be a bogus default route in your route table if you keep “add-default-route=yes”.
What does
/ipv6 route print
list as default route (dst-address ::/0) if you keep the current setting?
AFAIK It should not be necessary to assign an address to the WAN interface: RouterOS should be able to use a global IPv6 address assigned to any of its LAN interfaces.
I don’t immediately see any problems with the firewall. However, it would be interesting to enable logging for all drop rules and see whether any of them end up handling /tool/fetch url="https://ifconfig.me/ip" address=[:resolve type=ipv6 ifconfig.me] output=user which is failing for you.
Like @Kentzo wrote, it’s not necessary to have a GUA address on ether1. Can you do a
/ipv6 address print
and check what global addresses are currently associated with ether1? In your DHCPv6 client setting you are requesting address & prefix. So normally DHCPv6 would also assign an IPv6 address from the ISP to ether1. Could it be that this address is not correctly routed by your ISP? Without additional configuration, the router will use that address (on ether1) to go to the internet and it didn’t work. When you manually assign 2aXX:XXXX:XXXX:400::1/128 to ether1, ether1 now has two addresses and the router uses the later one, and the prefix is correctly routed by your ISP, so it now works (it also worked for LAN devices because they have addresses in the allocated prefix range).
So, the solution might be to change the DHCPv6 client entry and only request prefix, no addresses. The router will then use one of its addresses from bridge or wireguard1 to go online and it should work.
The manual from my ISP included both address and prefix request to setup DHCPv6 client. This is how the address 2aXX:XXXX:XXXX::400 (which fails ping and to resolve ifconfig.me) is assigned to the wan interface but my prefix is 2aXX:XXXX:XXXX:400::/56.
Yeah, it’s unimportant whether the router pick the prefix of the wireguard interface or the bridge interface to go on the Internet. It will work normally if it picks the one of wireguard1. FYI on all of my routers that’s also the case, when I have multiple vlan and wireguard interfaces, the router seems to prefer the prefix of one of the WG interfaces (always the same 1st WG interface so it’s predictable).
So, I guess for your problem, only requesting prefix from DHCPv6, not the address, is the way to go?
Yes, it solved the problem with the IP/Cloud not registering the AAAA record and the router’s IPv6 is pingable from the WAN. However, I’m pretty sure that IP/Cloud AAAA record registration worked in the past with the previous configuration when I first setup IPv6 on the Mikrotik. Maybe something changed with the firmware update. I’m not an IPv6 expert, but I don’t really understand why the router got the IPv6 address 2aXX:XXXX::400 and not for example 2aXX:XXXX:XXXX:400::1 when I have the prefix 2aXX:XXXX:XXXX:400::/56 assigned.
I think the problem is caused by your ISP, because they give your router an address (when being requested with DHCPv6) but don’t have the correct route to that address, so that the address can be reachable from the internet. The router is not to be blamed.
The practice of giving out one single address along with a separate prefix (not overlapping!) when being requested with DHCPv6 is pretty common. The single address is usually for the case when you plug your PC directly to the ISP’s modem, because that’s all that PC needs, and the DHCPv6 client running on the PC normally only request an address. But if you have a router in front of many LAN devices, then a single address is not enough, and the router normally requests a prefix range. Because the router can do whatever it wants with the full range, the single address assigned by DHCPv6 will not be within this prefix range, to avoid conflict. There is also no need for the router to also request the single address.
It’s the duty of the ISP to properly route traffic to both the single address, as well as to the assigned prefix range, to your router. In this case it looks like your ISP failed to do the 1st half.