My ISP now give me IPv6. I have setup /ip dhcp client and do get an valid IPv6 addres.
From router I am able to ping other IPv6.
So then what is the next step to get the inside to work.
Routing(do I need NAT), IPv6 DHCP server, firewall.
Any one have a simple working setup or link to some?
I do find lot of IPv6->IPv4 tunnelling etc, but what I need is config for pure IPv6
You don’t want address, you want prefix:
/ipv6 dhcp-client
add interface=<WAN> request=prefix pool-name=from-dhcp add-default-route=yes
If you don’t get it, you have a problem. If you do, then it will create new pool, and you can assign subnet from it using:
/ipv6 address
add interface=<LAN> address=::1/64 from-pool=from-dhcp
This is basic working config. Forget DHCPv6 server, the one in RouterOS can’t yet provide addresses to clients. Firewall is basically the same as for IPv4, and I think RouterOS has sane default one.
Wow, that was simple. Seems to work. So now I have to study how stuff works.
Thanks.
Do not see ny filter rules in the ipv6 firewall filter rules.
Try this and scroll down to /ipv6 firewall:
/system default-configuration print
Default IPv6 firewall is only configured if the ipv6 package was active at the time of your last reset to defaults.
If you don’t want to reset, you have to create the firewall rules by yourself, Sob already explained how to access the rules that would have been configured.
Thanks again.
That did work.
For some reason I lost my Hairpin nat.
Edit, I do see when I try to ping a DNS name of an inside IP, it now reply on IPv6. Hairpin was configured for IPv4, so need some more investigation 
IPv4 and IPv6 are independent, so that can’t directly break anything. But things do work slightly differently. With IPv4, you typically have one public address and you forward ports from it to internal servers. IPv6 by default doesn’t use NAT, so internal servers have public addresses directly on them. When you have some hostname, AAAA record must point to these addresses on servers. There’s no need for hairpin NAT either, because communication is direct. If both client and server are in same subnet, router doesn’t see their communication at all. But if they are in different local subnets, you have to allow communications between them. Unlike with IPv4, where you could use half or hairpin NAT (connection from LAN to public address) and allow that automatically in firewall filter using connection-nat-state=dstnat.
Edit: And of course the service on server must listen on IPv6 address, it’s not always automatic.
That is just one of the problem. The other is that I use an ipv4 HAProxy server.
So will have to look at how to solve that.
Config stanza
bind :::80 v4v6
should do it. Similarly with different port for https.