How to block IPV6 from ISP

[jvanhambelgium]

IPv6/Settings => IPv6 "forwarding" is not ticked , so I assume no IPv6 packets could get through my RB3011 (not from the outside>in, not from the inside>out)

The IPv6 forward simply enable or disable the automatic forwarding of packet between internal lan/ vlan, etc.
Can be used to separate internal networks without the use of firewall rules.
BUT it still permit the IPv6 traffic from WAN to the LANs

Really ? I'm learning new things on RouterOS every day still
Thanks for pointing that out.
Now I have an extensive IPv6 FW-policy anyway on input and forward chains so I'm never too concerned.
(eg. I drop any IPv6 in ingress not originated from the LAN/Bridge side)

[Kamaz]

@IntLDaniel

/ipv6 firewall filter
add chain=forward action=drop

I have a question, but not completely sure is this correct topic.
How can I disable ipv6 on MT with ROS 7.3 ? I want to block it totally (in, out, forwarding packets).

[rextended]

You have simply used the forum search function?

/ipv6 settings set disable-ipv6=yes

[Chipburn]

Every advice here is missleading and gives the impression to the reader that by disabling ipv6 in mikrotik or by dropping the packets in firewall you are blocking the ipv6 = WRONG.

If there is a connected router in then network OTHER than mikrotik and this rogue router has enabled RA advertising all the capaple ipv6 devices will “get” a public ipv6 from this router and go to internet by this rogue router.

This is a terrible security threat and it has been handled by Cisco with the “ipv6 RA guard” blocking RA traffic in Layer 2 level per interface port.

In windows and linux you mostly have ipv6 disabled that why you dont face this problem but every mobile device has ipv6 enabled by default and of cource there is no easy way to closed it. Even if you could you can’t inform every possible client to block ipv6 “because im running on mikrotik” and i can’t secure you.

A good read: https://www.rfc-editor.org/rfc/rfc6105

[jvanhambelgium]

Every advice here is missleading and gives the impression to the reader that by disabling ipv6 in mikrotik or by dropping the packets in firewall you are blocking the ipv6 = WRONG.
If there is a connected router in then network OTHER than mikrotik and this rogue router has enabled RA advertising all the capaple ipv6 devices will “get” a public ipv6 from this router and go to internet by this rogue router.
This is a terrible security threat and it has been handled by Cisco with the “ipv6 RA guard” blocking RA traffic in Layer 2 level per interface port.
A good read: https://www.rfc-editor.org/rfc/rfc6105

Euh … if you introduce ROUGE routers on your network with their own Internet connectivty offcourse there is a huge issue! Nothing to do with Mikrotik itself.
However, IF your Mikrotik is the only device with ISP-connectivity AND you disable “IPv6 forwarding” & configuration I would be very , very surprised if some public IPv6 could creep into your network.
THAT would be a big Mikrotik security issue.

[pe1chl]

It can always be that any device on your network sets up a IPv6-over-IPv4 tunnel and uses it to access IPv6. It can even forward IPv6 traffic for others.

[jvanhambelgium]

It can always be that any device on your network sets up a IPv6-over-IPv4 tunnel and uses it to access IPv6. It can even forward IPv6 traffic for others.

Sure, dozens of possibilities to still slip/sneek through since no Mikrotik has no true UTM/IDP-capabilities that could detect & block various tunneling/evasive tooling/protocols (eg. Teredo or other 6-in-4)
But I think it is important to state that IF you disable IPv6 on your Mikrotik (forwarding,package) no native IPv6 will sneek through! and no single endpoint on your network will ever be able to access (or be accessed!) using native IPv6.

[pe1chl]

That is only true when you run the router in a routing configuration. When it is bridging, it will happily pass IPv6 without IPv6 support installed or -enabled.

[StubArea51]

@doneware

my cell phone when connected to the WiFi gets an IPV6 address from the ISP. Is there a way to block the phone from receiving one ?

Why do you want to disable IPv6?

[Jotne]

Why do you want to disable IPv6?

A better question, what can i do with IPv6 that are so good that I need to enable it?
I have an ISP with IPv6, but does not use it. From how I do see it:
No faster internet.
More complex firewall setup.

[huntermic]

You will be able to use ipv6 only services….

[Jotne]

That gives me what? (as a normal user)
Faster internet?
More websites?

[pe1chl]

You can solve some problems that occur due to NAT.
The firewall is not more complicated, the default settings are about the same (allow established/related, allow new traffic going outside).