+1.
As a simple user, the idea of my ISP being able to allow me to stay within my IPV4 bubble whilst they handle the IPV6 for as long as possible is damned attractive (although I have no clue if that’s a viable interim path). In other words, no need yet on my MT router. At what point will I slowly convert? Will it first be my IP address given to me by the ISP is an IPV6 address and my LAN is IPV4?
After that??? As stated I dont want my fridge IPV6 address to be accessible outside my router, unless talking to the fridge company cloud I suppose. It quickly gets murky in terms of allowed traffic directions firewall rules etc. Call me timid and unlike most here not IT trained !!!
Conceptually IPv6 is similar to IPv4. With later one can get (wrong?) impression that NAT provides some extra level of control and/or security. But if you think of it, with MT’s highly customizable firewall there’s nothing which can be done with NAT that couldn’t be done with firewall. Even with IPv4 NAT you can’t really block fridge from connecting food store if you don’t play with segmenting the LAN etc (no, static DHCP leases and blocking according gadget’s IP address is not fail-safe). And most techniques apply to IPv6 as well. Provided that ISP offers prefixes shorter than 64 bit that is. Surely MT lacks some stuff (such as stateful DHCPv6 server) but that’s not a problem with IPv6 itself.
I am a ipv6 purist … not at all interested in NAT64 … D day is 2025 when US Gov completes its conversion THEN everyone falls in line.
@ZeroByte. you make a good argument … Good Luck … 
With IPv6 , there is no need for NAT. Normally an upstream provider will hand off something like a /64 or a /60/ or possibly a whopping large /56
Now with the shortage of IPv4 ( as in no more new IPv4 blocks are available ) and upstream provider could do something like this:
((( Dual Stack )))
Upstream provider - hands you a NATted ( CGN ) IPv4 ( you then NAT the natted IPv4 address given to you so that you can run multiple computers.
Upstream provider - hands you a live IPv6 ( /64 ), then you pass out 18,446,744,073,709,551,616 IPv6 addresses live IP-V6 address to your multiple computers.
FYI , normally , a dual-stack ( IPv4 & IPv6 ) computer/networking-device will always try IPv6 connections first , if can’t connect using IPv6 then retry using IPv4.
North Idaho Tom Jones
Question re: D day is 2025
I was not aware there was a a government D day to drop IPv4 - or is this a government D day to have all government agencies running IPv6 ?
North Idaho Tom Jones
There is no need for many-to-one translation as is usual with IPv4 and having only a single external address for your entire network, but even with IPv6 you still require network prefix translation in these cases:
- ISP changes IPv6 address willy-nilly and you want the addresses on your LAN to remain static
- ISP gives only a /64 and you want to run multiple internal networks (e.g. for guest WiFi)
- You have multiple ISP connections and want to do load balancing/failover between them (and you don’t have portable address space and BGP)
Re: … ISP changes IPv6 address willy-nilly and you want the addresses on your LAN to remain static …
You have a very strong point about using IPv6 network prefix translation ( well done 
)
As an ISP/WISP , I have the bulk of my servers running dual-stack IPv4 & IPv6.
I am getting ready to roll out IPv6 to a thousand+ Mikrotik wireless DHCP-Client CPEs.
Thinking about the prior post from pe1chl and his reasoning to use IPv6 network prefix translation because DHCP to clients has got me to thinking …
Questions:
Is the stock out-of-the-box Mikrotik default-configuration ( with IPv6 enabled ) already pre-configured for IPv6 with network prefix translation for the LAN interfaces ?
( I’ve never looked at the default configuration , mostly because we just blow-away the default Mikrotik config and use an IPv4-only config I created. )
Anybody know where there is a fully operational Mikrotik wireless-client config with WAN-(DHCP-Client wireless) LAN-(DHCP-Server IPv4-NAT & IPv6 network translation) ?
I need to update the IP-v4 only config we use because I am really close to rolling out IPv6 on-top of my existing IPv4 networks.
North Idaho Tom Jones
No, MikroTik routers do not come with preconfigured network prefix translation, as they do not support it at all. (at least in v6)
The main supported configuration for MikroTik routers with IPv6 is:
- use DHCPv6 client to request IPv6 prefix pool from ISP and store it in a local pool
- configure local interfaces with automatic address from that pool, and announce it on the network (SLAAC)
- when needed, configure DHCPv6 server for prefix delegation to routers further down the line (so they can request new network prefixes and route them)
DHCPv6 server for individual addresses (for systems, rather than routers) is not supported. However, the DHCPv6 server can deliver other info, like a DNS server address, to those.
It is “easy” to support IPv6 for multiple wireless clients as long as you have sufficient prefixes available to hand out.
That should be no problem, however. As an ISP you can easily get a /32 network. Many ISPs give /48 to their clients, which would even be sufficient for a small wireless ISP to send to their clients. (65536 networks)
Re: As an ISP you can easily get a /32 …
Yup - I’ve got two IPv6 /32’s
What about mobile operators that will now only give IPv6 /64 out by SLAAC? How can that be consumed by an established IPv4 Mikrotik network?
Im facing an issue where I have enjoyed providing clients with LHG-LTEx on the roof with IPv4 WAN passed through to the router in the house (usually Mikrotik, CAPsMAN etc etc). Now a UK operator EE is only issuing sim cards with IPv6 and have stated they are turning off all IPv4 in 2023. I currently have no solution in Mikrotik ecosystem. But I would be laughing if I had NAT64 and its accoutrements.
Can you provide a link where it states that EE will no longer provide IPv4 connectivity in 2023?
Love the pic.
An agent told me this over the phone when I begged them to make my brand new sim card IPv4. What this actually means is probably that all new sim cards will be IPv6 only. Maybe existing sim cards that get IPv4 like PAYG will also be switched over.
So either way we need a way to make an IPv6 LTE connection consumable by established IPv4 LANs.
It cannot. A single /64 range given out by SLAAC can only be used by a single host, not by a network.
It cannot. A single /64 range given out by SLAAC can only be used by a single host, not by a network.
…Yet a humble mobile phone can tether several devices off that address but Mikrotik cant?
The single /64 prefix can run one subnet. Which is connected directly to the device giving it out. But if you stick a router in between and router is forced to use it on WAN interface, then no, it can’t be done.
It could be done if that /64 prefix was actually prefix (and not /64 address) … that would mean that router could use prefix on LAN interface and communicate with upstream device using link local addresses. But most often that’s not the case when single /64 is in the play.
Interesting.
If I look in Prefixes there is an entry of: “2a01:xxx:c2a:1668::/64”
Is this a usable prefix?
Yes, but for one network only. The network between your MikroTik and your provider.
You cannot take a part of that and route it to a local network on the other side of the MikroTik.
For that you need a larger range, e.g. a /60 or /56 or /48, and you can take a /64 out of that and route it to a LAN for example.
It is unfortunate that still so many ISPs don’t understand IPv6 and give only a single /64 to their customers, and use SLAAC for that.
This is not how it should be done. SLAAC is for use on a LAN, for your router to give addresses to your clients.
On the provider side, something like DHCPv6 PD should be used.