IPV6 and vlans

polymorphic · February 26, 2026, 9:16am

I have an RB5009 and im trying to configure IPV6 along with IPV4 with VLANs
VLANS are tagged on my APs depending on which WiFi client is connected to.

I would like to have IPV6 set up as well, but im stuck.

Problem is that Network Discovery does not work with my current config, and im not even able to reach the router from a machine configured with a static IPV6.

This is my current config:

2026-02-26 09:21:59 by RouterOS 7.21.3
# model = RB5009UPr+S+
/interface bridge
add admin-mac=xx arp=proxy-arp auto-mac=no comment=defconf 
name=bridge
/interface ethernet
set \[ find default-name=ether1 \] l2mtu=1514
set \[ find default-name=ether2 \] l2mtu=1514
set \[ find default-name=ether3 \] l2mtu=1514
set \[ find default-name=ether4 \] l2mtu=1514
set \[ find default-name=ether5 \] l2mtu=1514
set \[ find default-name=ether6 \] l2mtu=1514
set \[ find default-name=ether7 \] l2mtu=1514
set \[ find default-name=ether8 \] l2mtu=1514
set \[ find default-name=sfp-sfpplus1 \] l2mtu=1514
/interface vlan
add comment="Guest VLAN" interface=bridge name=guestvlan vlan-id=30
add comment="Party VLAN" interface=bridge name=party-vlan vlan-id=60
add arp=proxy-arp comment="Private VLAN" interface=bridge name=privatevlan 
vlan-id=10
add comment="WAN VLAN" interface=sfp-sfpplus1 name=vlan101 vlan-id=101
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip pool
add name=private_pool ranges=192.168.1.10-192.168.1.99
add name=guest_pool ranges=192.168.30.2-192.168.30.100
add name=OVPN-pool ranges=192.168.8.100-192.168.8.200
add name=party_pool ranges=192.168.60.2-192.168.60.254
/ip dhcp-server
add address-pool=private_pool interface=bridge lease-time=1h name=defconf
add address-pool=guest_pool interface=guestvlan lease-time=1h name=guestdhcp
add address-pool=party_pool interface=party-vlan name=partydhcp
/ppp profile
set *FFFFFFFE bridge=bridge change-tcp-mss=default dns-server=192.168.1.250 
interface-list=LAN local-address=192.168.8.1 remote-address=OVPN-pool 
use-ipv6=default
/system logging action
set 3 remote=192.168.1.250
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf disabled=yes interface=sfp-sfpplus1
add bridge=bridge interface=ether1
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=vlan101 list=WAN
add disabled=yes interface=sfp-sfpplus1 list=WAN
/interface ovpn-server server
add certificate=server-cert cipher=
aes128-cbc,aes192-cbc,aes256-cbc,aes128-gcm,aes192-gcm,aes256-gcm 
default-profile=default-encryption disabled=no mac-address=
FE:BF:68:5C:0E:25 name=ovpn-server1 port=1199 redirect-gateway=def1 
require-client-certificate=yes
/interface wireguard peers
add allowed-address=192.168.10.2/32 interface=16 name=peer1 public-key=
"*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*"
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=
192.168.1.0
add address=192.168.30.1/24 interface=guestvlan network=192.168.30.0
add address=89.150.130.82 interface=vlan101 network=89.150.130.82
add address=192.168.60.1/24 interface=party-vlan network=192.168.60.0
/ip dhcp-client
add comment=defconf dhcp-options=clientid_duid,clientid_duid interface=
vlan101

/ipv6 address
add address=::1:0:0:0:1 from-pool=isp-ipv6 interface=privatevlan
add address=::3:0:0:0:1 from-pool=isp-ipv6 interface=guestvlan
add address=::6:0:0:0:1 from-pool=isp-ipv6 interface=party-vlan
/ipv6 dhcp-client
add add-default-route=yes interface=vlan101 pool-name=isp-ipv6 request=prefix
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=
33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" disabled=yes 
in-interface-list=!LAN
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" 
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" 
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" disabled=yes 
in-interface-list=!LAN
/ipv6 nd
set \[ find default=yes \] disabled=yes
add advertise-dns=yes interface=privatevlan other-configuration=yes
add advertise-dns=yes interface=guestvlan other-configuration=yes
add advertise-dns=yes interface=party-vlan other-configuration=yes

CGGXANNX · February 26, 2026, 9:39am

Your VLANs don't seem to be configured correctly. I don't see vlan-filtering=yes on the bridge, and there is no PVID and/or /interface bridge vlan assignments? Please sort that out first!

Also, currently on the IPv4 side your private_pool is assigned via DHCP to the bridge interface, while it appears that for the IPv6 side you wanted to use the privatevlan interface, which is VLAN 10. privatevlan has no IPv4 configuration???

Once all that's corrected, please note that in the defconf IPv6 firewall of the RB5009 (which you appear to rely on) only allows forwarding and access to the input chain if the interfaces are in the LAN interface list (unlike the IPv4 defconf firewall that allows forwarding for interfaces not part of the LAN list too).

You should add the VLAN interfaces (except vlan101, of course) to the LAN list and they you can re-enable these rules that you've disabled:

/ipv6 firewall filter
# ...
add action=drop chain=input comment= \
    "defconf: drop everything else not coming from LAN" disabled=yes \
    in-interface-list=!LAN
# ...
add action=drop chain=forward comment= \
    "defconf: drop everything else not coming from LAN" disabled=yes \
    in-interface-list=!LAN
# ...

polymorphic · February 26, 2026, 2:16pm

Well as soon as i enable vlan filtering, all connectivity on my network is lost! Even to the router.

Thank god for safe mode

CGGXANNX · February 26, 2026, 2:31pm

That's because your configuration still miss this:

If you are not yet familiar with the VLAN configuration, follow the examples in the docs starting from

polymorphic · February 26, 2026, 6:12pm

Got you!
I was pretty sure i got it, as it has been working with IPV4 for a long time.
But you pointed me in the right direction by pointing out that my IPV6 privatevlan was not on the bridge, as it was with IPV4.
Changing this got it working.
I agree that my VLAN config needs some work.

Thank you for your assistance.