My setup:
WAN Mikrotik: 2a02:123:5:1/64
Default gateway: Gateway colo
LAN: Mikrotik: 2a02:123:5:ff::1/64
Client on LAN: 2a02:123:5:ff::2/64
Client has as default gateway: 2a02:123:5:ff:1
The problem:
Client can ping LAN IP address from Mikrotik but not the WAN IP or gateway. Firewall logs doesn’t show any pings attemps from client. I presume there is a routing problem or I’m missing something?
Do you have ipv6 default route like ::0? With IPv6 RA, ipv6 host could get default route from IPv6 router, but seems you assign address statically, so your PC in LAN have no any ipv6 route. Create it
On router itself, create route to 2000::/3 to Colo gateway, it means all global unicast prefixes.
P.S.: Do not forget about good IPv6 firewall. In order to get it, you can install ipv6 package for first time and then reset your router. In firewall filter appears ipv6 rules. Then you can grab them in text editor, modify them as you want, upload your config file, install it with router rebooting and then just paste your custom rules in ipv6 firewall filter.
In IPv6 routing is done slightly different. So for routing purposes, router does not need WAN address from allocated address space, the link-local addresses will be used. Router will need IPv6 address if connectivity to router over IPv6 is needed.
My example: I have PPPoE connection towards ISP and they are giving me a /56 prefix. RB is using only link-local addresses on every interface:
/ipv6 address> print
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local
# ADDRESS FROM-... INTERFACE ADV
0 G 2a00:X:Y:Z::W/64 vlan-42 yes
1 DL fe80::ba69:f4ff:fe20:a549/64 vlan-42 no
2 DL fe80::ba69:f4ff:fe20:a549/64 vlan-2 no
3 DL fe80::ba69:f4ff:fe20:a549/64 vlan-41 no
4 DL fe80::ba69:f4ff:fe20:a549/64 vlan-40 no
5 DL fe80::ba69:f4ff:fe20:a549/64 bridge no
6 DL fe80::f/64 pppoe-out1 no
The only routable address is assigned to one of LAN interfaces where I want to have IPv6 connectivity to RB itself.
Likewise routes:
/ipv6 route> print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable
# DST-ADDRESS GATEWAY DISTANCE
0 ADS ::/0 pppoe-out1 1
1 DS ::/0 fe80::230:88ff:fe04:9... 1
2 ADSU 2a00:X:Y::/56 1
3 ADC 2a00:X:Y:Z::/64 vlan-42 0
/ipv6 route> print detail
1 DS dst-address=::/0 gateway=fe80::230:88ff:fe04:98c5%pppoe-out1
gateway-status=fe80::230:88ff:fe04:98c5%pppoe-out1 reachable
distance=1 scope=30 target-scope=10
I’m not sure where route number 2 (to the /56 subnet) comes from, I guess it gets added at the moment RB receives the /56 prefix, but is not used anyway. The route number 3 gets added at the moment I assign corresponding address to given interface.
Because IPv6 SLAAC routing works on LL addresses. When you connect to your ISP via PPPoE, they delegate you a prefix, first of all. Like/56. You can use smaller ones from it: like /64, /80, /126 and so one. LL address always appears in order to negotiate RA in prospective. But if you have to route traffic from given GU addresses, there is no need to use LL ones. Static routing will work. In PPPoE concept, there is no need to choose how to route traffic to ::/0, because you’re alone on this tunnel, and ISP choose LL addresses base no their MACs.
But from description it doesn’t look like the router gets whole prefix. It might be assigned to customer as administrative thing, but I understand it that 2a02:123:5::1 is on colo’s router, i.e. one /64 from /48 is on router’s WAN.
I had a similar issue with my ISP on your setup. They gave me an /56 and the ::1 of the first /64 was their gateway address and ::2 was the one for my router.
The problem with this approach is that they are using part of the /48 in this case to route the WAN side. The /48 is for your LAN segments, and they should use a different IPv6 block to route your LAN block to the Internet.
The solution in my case was to tell the ISP to do the following:
Use local-addresses in my Mikrotik and their router to route all the /56 (in my case, yours is /48) as WAN segment to route and then I assign on the required VLANs any of the /64 contained as part of the larger /56 block (/48 in your case).
That solved my routing problem and looks to me you have the same problem I had.
There is no local address or subnet possible for routing it. Is there no alternate solution like proxy macaddress or something?
If I give a server on the WAN side with IP address 2a02:123:ff::1/64 and gateway 2a02:123:5::1 it just works. The same I want it at the LAN side. Or something like bridging IPv6 instead of routing?
Bridging is a really silly “solution” because then you can only use one /64 from your /48, and then the security downsides (firewalling, etc.) - it is really not a good solution. It would be like you replaced MikroTik with an unmanaged switch and connected all of your unprotected servers directly to the Internet.
There are three possibilities here:
Your colo provider has possibly told you what address you need to assign to your MikroTik WAN interface but you have ignored the colo provider and used a different address; then, the routing for the rest of your /48 would not work, and only the MikroTik itself could get online.
If your colo provider did not give you a specific address for your MikroTik WAN interface, they possibly expect you to use DHCPv6-PD (prefix delegation), and if you set up DHCPv6 client and request a prefix, then they will route that through your router’s address, whatever it happens to be.
If the colo provider did not give you a specific address for your MikroTik WAN (as in #1 above) and they do not have DHCPv6-PD (as in #2 above), then they have really just given you a /64 and sold it as a /48, when it is impossible to use the rest. Either this was done to scam you or it was because the colo provider does not understand IPv6.
If the provider expects you to use DHCPv6-PD as in #2 above, they have also not set things up quite right, as others have pointed out. When you get the prefix, the first subnet that the router may try to use on the LAN side will be the first /64 in the /48, which is the same subnet already used on the WAN side, and that will not work (the router assumes that the /48 it receives is for use only on the LAN ports). This would force you to assign prefixes manually on your router instead of using the automatic assignment from the pool. Typically the provider would give a /48 plus a /64 that was not included in that /48, in which case the automatic prefix assignment works correctly in the router.
1/64