How to block IPv6 router solicitations and advertisement in bridge?

RouterOS General
1

I have LANs of multiple gateway routers bridged together. The idea is that it’s one LAN with multiple gateways so wifi clients can roam but everything gets the most optimal routing on whichever it connects to. So I need to block the autoconfiguration protocols on the bridges between them; for IPv4 DHCP the Mikrotik bridge filter can block this just fine, but for IPv6 it can not do anything but block all ipv6.

Is there any other way to block only IPv6 SLAAC in a bridge or is this just not possible with Mikrotik?

2

This does not seem like a valid network layout. When you have multiple gateways why still bridge the networks?
Anyway, you could block IPv6 packets that are multicast. That should block the router announcements and requests.

3

Might try blocking “src-address6= dst-address6=ff02::1/128”, “src-address6=fe80::/10 dst-address6=ff02::2/128”. However something else can break.

Would be better to disable SLAAC on the nodes themselves.

4

His problem is that once you select the IPv6 protocol, you cannot add addresses (as you can with the IPv4 protocol) in bridge filters.
But, you can still add address types (like “multicast”) and it is also possible to filter specific MAC addresses, which would also work for this case, as the SLAAC multicasts go to MAC address 33:33:00:00:00:01.

5

@pe1chl I was talking about


> /interface/bridge/filter add chain=forward action=passthrough mac-protocol=ipv6 src-address6=fe80::/10 dst-address6=ff02::2/128 ip-protocol=icmpv6
> /interface/bridge/filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0   chain=forward action=passthrough mac-protocol=ipv6 src-address6=fe80::/10 dst-address6=ff02::2/128 ip-protocol=icmpv6
6

Interesting that you can force that in via commandline. When this is done, it shows up incorrectly in winbox and cannot be modified.
Unsure if that will work…

7

because if i’m on one router and my server is on other i don’t want my packets going all the way to the internet and back, but I also don’t want my packets going all the way to the other router and back when it can go directly to the internet (it saves 4ms).

blocking multicast is useless, without NDP none of the addresses on the other segment can be accessed… unless I want to manually put static neighbors… which mikrotik can’t do…

maybe instead of bridging I could have used proxy-arp and… ndp proxy which mikrotik doesn’t have either…

it’s looking like there is just no way to do what i want with mikrotik due to ipv6 lacking feature parity with ipv4…

8

TBH I could not fully decipher your problem statement. Have you tried utilizing IP firewall via use-ip-firewall=yes?

9

So you should have multiple IPv6 LANs with routing between them (via some local infrastructure) properly set-up.