Another suggestion (not important, to be added in case when and if possible).
Personally I would like a switch to turn (optionally) IPV6 off.
This is essentially three lines:
/ipv6/settings
set disable-ipv6=yes
/ipv6 firewall filter
add chain=input action=drop
add chain=forward action=drop
of course removing all the remaining IPV6 firewall filter rules.
So it's completely useless disable IPv6...
You're necessarily dealing with IPv6 in the new devices...
Disable it give the false sense that IPv6 is mysteriously disappeared, and that IPv6 isn't being passed across the network...
Nothing could be further from the truth...
So it's best to leave the default rules in place,
and IPv6 turned on and configured correctly.
There's no point fighting against it...
If this was directed at me, you have it backwards...
Here, it's a Dutch guy and their robots who's started the legalism. Not the guy who long published open-source RouterOS tools – and advocates for a real community effort through open source. To only get railed for pointing out you cannot copyright facts, like default-name in RouterOS.
That is exactly the reason why the two rules need to be in IPV6 firewall.
As it already happened an upgrade can re-enable a disabled IPV6, but I hope that it will never add (place before 0) two accept rules, one in input and one in forward chains.
Actually I didn't understand at whom this story is directed at.
Concur with Jaclaz, your angst Rextended should be aimed at MT, for allowing their router to make such changes spontaneously LOL.
Reread what I wrote...
There's still the false impression that disabling IPv6 on the router,
IPv6 will mysteriously disappear from all the devices on the network...
When in reality, if you're not careful, it can still pass through the router... reaching all devices...
If you really wanted to be sure, ignoring other switches and various APs that could still put the peripherals in direct contact:
# this block IPv6 regardless if disable-ipv6 is on or off, but only inside the bridges, not on other interfaces
/interface bridge filter
add action=drop chain=input mac-protocol=ipv6
add action=drop chain=forward mac-protocol=ipv6
add action=drop chain=output mac-protocol=ipv6
# obviously work only if disable-ipv6=no
/ipv6 firewall raw
add action=drop chain=prerouting
add action=drop chain=output
# obviously work only if disable-ipv6=no
/ipv6 firewall filter
add chain=input action=drop
add chain=forward action=drop
add chain=output action=drop
# obviously settings valid only if disable-ipv6=no
/ipv6 settings
set accept-redirects=no accept-router-advertisements=no disable-ipv6=no forward=no
# obviously setting valid only if disable-ipv6=no
/ipv6 nd
set [ find default=yes ] disabled=yes
For some devices with one or more switch chips that support the function (MUST be supported from the model used):
# FOR not-ACL type switches
# this block IPv6 regardless if disable-ipv6 is on or off
/interface ethernet switch port
:foreach item in=[find] do={
:local pt [get $item name ]
:local sw [get $item switch]
/interface ethernet switch rule add mac-protocol=ipv6 new-dst-ports="" ports=$pt switch=$sw
}
# FOR ACL type switches
# this block IPv6 regardless if disable-ipv6 is on or off
/interface ethernet switch acl
add action=drop mac-protocol=ipv6 table=ingress
add action=drop mac-protocol=ipv6 table=egress
new-dst-ports="" simply drop
Well, whatever Is better Is welcome.
And - if It counts - I am sorry, anav made me do It, officer. 
Oh, I forgot... And I'm sure I'm forgetting something else by now...
(moved on previous post)
Please add them (and something else if needed) to your previous post, so that It stays all together in a single post that can be easily referenced.
At this time of night I don't remember if I forgot anything, but I think that's all.
Done, also added instruction for devices with configurable switch chip
Don't take it personally, I simply reacted to "would you sue me ?".
Have I got it backwards? Looks like I did. What incentive is there to read through "he said" / "she said" in this thread? Suppose Dutchman becomes the main character of the joke. What does it change ? Nature still does not have an underwriter.
Is worrying about what might happen conducive to continue on the path of what one believes is right ?
There are many ways to go about licensing. Some chose to Get a life. Others decide to Do What the Fuck they Want. At the end of the day everyone decides what they want, incl. end users.
There are also mid-ways, JFYI :
http://jaclaz.altervista.org/Projects/careware.html
Nice, this should be promoted to 6 rules to live by in everyday life.
@Buckeye @rextended Three reports, one gap. All three are live.
The bridge's own untagged network now exists. You were right that there was no way to reach it: the tool put an address on the bridge and then made it unreachable, because every access port had to belong to a VLAN you had defined. A port's untagged VLAN can now be set to bridge (untagged, no VLAN), which emits:
/interface bridge port
add ... frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=1
/interface bridge vlan
add bridge=bridge comment="untagged network on the bridge itself" untagged=bridge,ether2 vlan-ids=1
The bridge itself is untagged in that entry, so the CPU receives the frames and the address is actually reachable. The port is removed from the other VLAN's untagged list at the same time, so nothing contradicts itself.
VLAN 1 is now refused rather than warned about. Your four-click recipe produced a vlan1 interface alongside the bridge's own pvid, and the tool shrugged and generated it. It now stops and points at the option above, which is what people were reaching for when they typed 1. @tadawson, this is not "VLAN 1 is bad", you are right that it works when used as the native untagged VLAN. It is that a VLAN interface on id 1 is a different thing from the bridge's untagged network, and the tool now has a way to say the second one properly.
@rextended, the lockout is your first item and it is done. Switching on VLAN filtering with no VLAN carrying an address and nothing untagged on the bridge is now an error, not a silent script. That was a device you had to walk to.
Your other two: the same IP on two interfaces was already caught, as an error, by an overlap check across every subnet. "VLAN filtering without a port that can reach the CPU" is the one above. If you can think of more of the ten, I will take them.
Also shipped since the last update:
) All 1,432 pages have Dutch titles and 1,331 of them have a full Dutch translation, alongside the English original. )max-limit less than limit on every paste, and mangle rules that were far too heavy for a MIPS box.@jaclaz, your offbridge port from earlier is now on the roadmap rather than lost in the scroll, and so is the IPv6 off switch. On the latter I am taking rextended's version at #212 rather than the three-line one, for the reason he gives: disabling IPv6 without the drop rules is a false sense of safety.
Sure 
, it is much better, and much safer.
I am also adding it to the GP&CSA point #33.
Visto che l'hai messo lì, è meglio scriverlo per bene, senza fare figuracce 
@jaclaz Update the rules... please
Now the rules are auto generated, instead to fail for wrong port/switch sequence...
Added also rule for switch tha do not support 1st syntax, but only ACL.
Not sure to understand what you mean. The old way was point #33 and it is now updated.
I mean, if you put it in that important topic, it must be a version worthy of importance, and rather than an example to be finished, I provided the complete script.
[Se aggiorni la #33 con lo script aggiornato sopra, è meglio!]
For some devices with one or more switch chips that support the function (MUST be supported from the model used):
# FOR not-ACL type switches
# this block IPv6 regardless if disable-ipv6 is on or off
/interface ethernet switch port
:foreach item in=[find] do={
:local pt [get $item name ]
:local sw [get $item switch]
/interface ethernet switch rule add mac-protocol=ipv6 new-dst-ports="" ports=$pt switch=$sw
}
# FOR ACL type switches
# this block IPv6 regardless if disable-ipv6 is on or off
/interface ethernet switch acl
add action=drop mac-protocol=ipv6 table=ingress
add action=drop mac-protocol=ipv6 table=egress