DHCPv6 Client: How to disable or change distance of the default blackhole route for delegated prefix?

RouterOS General
1

/ipv6/dhcp-client adds a dynamic blackhole route for the delegated prefix. I want to preemt this route with my own route and firewall rules that use ICMPv6 errors.

Previously you could disable it, but starting with 7.20 it’s no longer possible: failure: cannot modify dynamic route created by a different owner

I reached out to support and they recommended looking at /routing/settings/dynamic-in-chain. It’s barely documented and I’m not sure how to use it.

Could someone give an example of either disabling the default blackhole route or changing its distance?

2

You can add two routes with longer (+1) prefixes and they'll be picked before the blackhole route.

For instance, your ISP gives you 2001:db8:85a3:8a00::/56. You can then add two routes with destinations 2001:db8:85a3:8a00::/57 and 2001:db8:85a3:8a80::/57.

4

FWIW solved it with SubnetIP6Prefix:

:global SubnetIP6Prefix

:if ($"pd-valid" = 1) do={
    # Redirect unused prefix allocations to trap
    :global argManagedID "8c401480-2d77-11ee-9320-ca00dc5bab96"
    /ipv6/route {
        remove [find comment~"$argManagedID\$"]
        :foreach subnet in=[$SubnetIP6Prefix $"pd-prefix" 1] do={
            add dst-address=$subnet gateway=trap comment="Managed: DHCPv6 / $argManagedID"
        }
    }
}
5

I only look at the top of the linked page, but there is a bug in MakeIP6PrefixMask. You use 0. 1, 3, 7, f but the correct sequence should be 0, 8, c, e, f instead for 0000, 1000, 1100, 1110, 1111.

For example :put [$MakeIP6PrefixMask 18] produces ffff:3000:: but it should be ffff:c000::.

Also the checks at the beginning of StructureIP6AddressCommon will need to be adjusted starting from 7.21. Because in 7.21 the conversion from ip6-prefix with :toip6 will succeed and the result is no longer of type nil.

6

You use 0. 1, 3, 7, f but the correct sequence should be 0, 8, c, e, f instead for 0000, 1000, 1100, 1110, 1111.

Great catch! Looks like I never had to deal with a mask that was not divisible by 4.