DS-Lite (ipipv6) on RouterOS v7 cannot activate IPv4 connected route (DIc), so IPv4 default route stays inactive and IPv4 never works

RouterOS
1

Even with minimal DS-Lite configuration, RouterOS v7 cannot activate IPv4 routing over ipipv6 tunnel.
IPv4 connected route stays DIc (inactive) and default route stays inactive with immediate-gw="".

====================================================================

[ENGLISH]

1) Environment

  • Router: MikroTik RB5009UG+S+IN (arm64)
  • WAN line: NTT FLET’S Hikari Cross 10G (Japan)
  • ISP: AsahiNet v6connect (DS-Lite)
  • AFTR: 2001:c28:5:301::11
  • WAN interface: sfp-sfpplus1 (ONU direct)
  • DS-Lite tunnel interface: dslite (type: ipipv6-tunnel)

2) RouterOS versions tested (same issue)

  • 7.20.6
  • 7.21.1 (stable)
  • 7.21rc6 (testing)

The result is identical on all versions.

3) IPv6 status (working OK)

IPv6 is working correctly:

  • DHCPv6-PD is bound
  • IPv6 default route ::/0 is ACTIVE
  • DS-Lite tunnel interface is RUNNING
  • AFTR is reachable via IPv6:

/ping 2001:c28:5:301::11 interface=sfp-sfpplus1 count=3

=> echo reply OK

4) Issue summary

Even with minimal configuration, RouterOS does NOT activate IPv4 routing over DS-Lite:

  • IPv4 connected route on the DS-Lite interface stays DIc (inactive)
  • IPv4 default route stays inactive with immediate-gw=""
  • IPv4 traffic fails completely with "no route to host"

5) Minimal reproduction steps (IPv4 over DS-Lite)

Step A) Assign B4 address on DS-Lite interface:

/ip address add address=192.0.0.2/29 interface=dslite comment="DS-Lite B4 /29"

Step B) Add IPv4 default route via DS-Lite explicit next-hop:

/ip route add dst-address=0.0.0.0/0 gateway=192.0.0.1%dslite distance=1 comment="IPv4 default via DS-Lite"

Step C) NAT (minimal):

/ip firewall nat add chain=srcnat out-interface=dslite action=masquerade comment="NAT LAN -> DS-Lite IPv4"

6) Actual result (problem)

IPv4 routing never becomes active.

Command outputs:

/ip route print detail where dst-address="0.0.0.0/0" || dst-address~"192.0.0."

Default route example:

Is dst-address=0.0.0.0/0 gateway=192.0.0.1%dslite immediate-gw=""

Connected route example:

DIc dst-address=192.0.0.0/29 gateway=dslite local-address=192.0.0.2%dslite

IPv4 ping test:

/ping 8.8.8.8 count=3

=> no route to host

7) What I already tried / confirmed

  • IPv6 connectivity to AFTR is OK (ping success)
  • Same issue on multiple RouterOS versions (7.20.6 / 7.21.1 / 7.21rc6)
  • Time and NTP are normalized (still same issue)
  • Tried B4 /29, B4 /32, PTP-style address (still DIc)
  • Tried default route with gateway=dslite (still immediate-gw="")

8) Questions

Could you please confirm:

  1. Is this a known bug or limitation in RouterOS v7 DS-Lite (ipipv6 tunnel)?
  2. Is there an official recommended RouterOS v7 DS-Lite configuration that results in ACTIVE IPv4 routing?
  3. If this is a bug, is there any workaround or planned fix version?

I can provide supout.rif and full export if needed.

Thank you.

====================================================================

[日本語 / JAPANESE]

1) 環境

  • ルーター: MikroTik RB5009UG+S+IN (arm64)
  • 回線: NTT フレッツ 光クロス 10G (日本)
  • ISP: AsahiNet v6connect (DS-Lite)
  • AFTR: 2001:c28:5:301::11
  • WAN インターフェース: sfp-sfpplus1 (ONU直結)
  • DS-Lite トンネル: dslite (ipipv6-tunnel)

2) 試した RouterOS バージョン (すべて同じ症状)

  • 7.20.6
  • 7.21.1 (stable)
  • 7.21rc6 (testing)

すべて同一の結果でした。

3) IPv6 は正常 (動作確認済み)

IPv6 は正常に通信できています。

  • DHCPv6-PD は bound
  • IPv6 デフォルトルート ::/0 は ACTIVE
  • DS-Lite トンネル interface は RUNNING
  • AFTR 宛の IPv6 ping は成功します

/ping 2001:c28:5:301::11 interface=sfp-sfpplus1 count=3

=> echo reply OK

4) 問題の概要

最小構成でも RouterOS が DS-Lite 上の IPv4 ルーティングを ACTIVE にできません。

  • DS-Lite インターフェース上の IPv4 connected route が DIc (inactive) のまま
  • IPv4 default route が immediate-gw="" のまま inactive
  • IPv4 通信は "no route to host" で完全に失敗します

5) 最小再現手順 (IPv4 over DS-Lite)

A) DS-Lite に B4 IPv4 を付与:

/ip address add address=192.0.0.2/29 interface=dslite comment="DS-Lite B4 /29"

B) IPv4 デフォルトルートを設定:

/ip route add dst-address=0.0.0.0/0 gateway=192.0.0.1%dslite distance=1 comment="IPv4 default via DS-Lite"

C) NAT (最小):

/ip firewall nat add chain=srcnat out-interface=dslite action=masquerade comment="NAT LAN -> DS-Lite IPv4"

6) 実際の結果 (不具合)

IPv4 のルーティングが ACTIVE になりません。

確認コマンド:

/ip route print detail where dst-address="0.0.0.0/0" || dst-address~"192.0.0."

default route:

Is dst-address=0.0.0.0/0 gateway=192.0.0.1%dslite immediate-gw=""

connected route:

DIc dst-address=192.0.0.0/29 gateway=dslite local-address=192.0.0.2%dslite

IPv4 ping:

/ping 8.8.8.8 count=3

=> no route to host

7) すでに試したこと

  • IPv6 で AFTR へ到達できることを確認済み
  • RouterOS 7.20.6 / 7.21.1 / 7.21rc6 で同じ症状
  • 時刻/NTP を正常化しても改善なし
  • B4 /29, /32, PTP風の設定も試したが DIc のまま
  • default route を gateway=dslite にしても immediate-gw="" のまま

8) 質問

以下について確認したいです。

  1. RouterOS v7 の DS-Lite (ipipv6 tunnel) の既知の不具合/制限でしょうか？
  2. RouterOS v7 で IPv4 over DS-Lite が ACTIVE になる公式推奨設定はありますか？
  3. 不具合であれば回避策や修正版の予定はありますか？

必要であれば supout.rif や full export も提供できます。
よろしくお願いします。

Evidence (route + ping)

Command:
/ip route print detail where dst-address="0.0.0.0/0" || dst-address~"192.0.0."
/ping 8.8.8.8 count=3

Result:
Default route stays inactive with immediate-gw=""
IPv4 ping: "no route to host"

supout.rif

I can upload "supout.rif" if needed.
Please tell me which minimal configuration you want before generating it.

Suspected behavior

This looks like RouterOS fails to treat ipipv6 DS-Lite tunnel as a valid L3 interface for IPv4 connected routing.
The connected route remains DIc (inactive) permanently.

2

RouterOS 7.21.3
Device: RB5009UG+S+
ISP: AsahiNet v6connect (DS-Lite / NTT FLET’S Hikari Cross 10G)

Facts:

  • ipipv6 interface "dslite" shows RUNNING
  • IPv6 connectivity to AFTR (2001:c28:5:301::11) works
  • IPv4 connected route (192.0.0.0/29) stays DIc
  • IPv4 default route (0.0.0.0/0) stays inactive (immediate-gw="")

Test:

/ping 8.8.8.8 interface=dslite count=5

Result:
No IPv4-in-IPv6 (IP protocol 4) packets are generated.
Packet capture shows ZERO encapsulated IPv4 traffic.

IPv6 works correctly.
IPv4 encapsulation never starts.

Question:
Is DS-Lite (RFC6333) officially supported on ipipv6 tunnel interfaces in RouterOS v7?
If yes, why does RouterOS not generate protocol 4 packets even when the tunnel is RUNNING?

ーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーー

RouterOS 7.21.3
Device: RB5009UG+S+
ISP: AsahiNet v6connect (DS-Lite / NTT FLET’S Hikari Cross 10G)

Facts / 事実:

  • ipipv6 インターフェース "dslite" は RUNNING 表示
  • AFTR (2001:c28:5:301::11) への IPv6 接続は正常
  • IPv4 connected route (192.0.0.0/29) は DIc のまま
  • IPv4 default route (0.0.0.0/0) は inactive (immediate-gw="")

Test / テスト:

/ping 8.8.8.8 interface=dslite count=5

Result / 結果:

IPv4-in-IPv6 (IP protocol 4) パケットが一切生成されない。
パケットキャプチャでも encapsulated IPv4 トラフィックは 0。

IPv6 は正常動作。
IPv4 カプセル化が開始されない。

Question / 質問:

RouterOS v7 は ipipv6 トンネル上で DS-Lite (RFC6333) を正式サポートしていますか？
サポートしている場合、なぜトンネルが RUNNING 状態でもprotocol 4 パケットが生成されないのでしょうか？

3

What you are seeing points directly to the ipipv6 interface being down (not Running). I know this directly contradicts what you describe, but this is the only situation in which a c (directly connected) route should be I (inactive).

Check that you haven't accidentally left the tunnel's keepalive parameters set. Keepalive is a feature that only works between Mikrotik routers. Again, it's not sufficient to have it set to empty or zero, it has to be removed, i.e. not present. (You can do this by "collapsing" the field in winbox, or using /interface/... set ... !keepalive.

A tunnel where the keepalive fails will temporarily show up as running, until the keepalive timer elapses.

1 Like
4

Thanks @Lurker888 for pointing out the ipip vs ipipv6 difference.

Update (crucial proof, not DS-Lite-specific):

I created a plain /interface ipipv6 tunnel (not my DS-Lite interface), then assigned an IPv4 address to it.

Commands:
/interface ipipv6 add name=test-ipipv6 local-address=2405:6587:9860:4d00::1 remote-address=2001:c28:5:301::11
/ip address add address=192.0.2.2/30 interface=test-ipipv6
/ip route print detail where dst-address~"192.0.2."

Result:
DIc dst-address=192.0.2.0/30 gateway=test-ipipv6 local-address=192.0.2.2%test-ipipv6

Even with a generic ipipv6-tunnel, the IPv4 connected route remains DIc.
This behavior is therefore not DS-Lite-specific.

It appears RouterOS v7 does not activate IPv4 L3 next-hop resolution over ipipv6-tunnel at all.

Can MikroTik confirm:

  1. Is IPv4 over ipipv6-tunnel supported in RouterOS v7?
  2. If not, what interface type is officially recommended for this use case?

─────────────────────────────────────────────────────────────────

/interface ipipv6 で通常のトンネル（DS-Liteではない）を作成し、
そこに IPv4 アドレスを付与しても、connected route は常に DIc のままで、
IPv4 の next-hop 解決が有効化されません。

コマンド:
/interface ipipv6 add name=test-ipipv6 local-address=2405:6587:9860:4d00::1 remote-address=2001:c28:5:301::11
/ip address add address=192.0.2.2/30 interface=test-ipipv6
/ip route print detail where dst-address~"192.0.2."

結果:
DIc dst-address=192.0.2.0/30 gateway=test-ipipv6 local-address=192.0.2.2%test-ipipv6

つまり、ipipv6-tunnel 自体が IPv4 の L3 next-hop として有効化されていない挙動に見えます。

質問:

  1. RouterOS v7 では IPv4 over ipipv6-tunnel は正式サポートされていますか？
  2. もし未対応の場合、推奨されるインターフェース種別は何でしょうか？
5

I did not point out a difference between ipip and ipipv6.

I said that you have keepalive enabled, that's why it doesn't work.

Again. Disable keepalive.

The correct command:

/interface ipipv6 add name=test-ipipv6 local-address=2405:6587:9860:4d00::1 remote-address=2001:c28:5:301::11 !keepalive

With the "!keepalive".

6

Thanks for the clarification.

However, RouterOS allows assigning an IPv4 address to /interface ipipv6,
and automatically creates an IPv4 connected route for it.

The route is created but always remains DIc and never becomes ACTIVE.
So the question is:

If IPv4 over ipipv6 is NOT supported by design,
why is IPv4 address assignment allowed and why is a connected route created?

Is this behavior expected, or is it a limitation/bug in RouterOS v7?

Additional context:

This is not a generic lab setup.
This is AsahiNet (Japan) “v6 Plus” / DS-Lite service over NTT FLET'S.

In this service:

  • IPv4 connectivity is provided only via DS-Lite (RFC6333).
  • Native IPv4 is not available.
  • CPE must establish an IPv4-in-IPv6 tunnel toward AFTR.

So IPv4 over IPv6 tunneling is not optional in this environment.
It is the only way to obtain IPv4 connectivity.

If RouterOS v7 does not support IPv4 L3 over ipipv6-tunnel,
then DS-Lite CPE operation becomes impossible.

ーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーーー

ご説明ありがとうございます。

RouterOS では /interface ipipv6 に IPv4 アドレスを設定でき、
IPv4 connected route も自動生成されます。

しかしその route は常に DIc のままで ACTIVE になりません。

もし仕様として IPv4 over ipipv6 が未対応なのであれば、
なぜ IPv4 アドレス設定と connected route 作成が可能なのでしょうか？

これは仕様上の制限ですか、それとも v7 の不具合でしょうか？

補足です。

これは単なる検証環境ではなく、
日本の AsahiNet「v6プラス」（NTTフレッツ網）での DS-Lite 接続です。

この方式では：
・ネイティブIPv4は提供されません
・IPv4はDS-Lite（RFC6333）経由のみで提供されます
・CPEはAFTRへIPv4-in-IPv6トンネルを張る必要があります

つまりIPv4 over IPv6は必須条件です。
RouterOS v7 が ipipv6 上で IPv4 L3 を扱えないのであれば、
DS-Lite CPE として成立しないことになります。