IPv6 firewall features

RouterOS General
1

As you probably know IPv6 is slowly coming with all the new features and options. So it might be good time to look at things that are missing.

This time we would like to know what do you need in IPv6 firewall (filter,mangle) - What matchers? What actions? What IPv6 options?

2

Will IPv6 DHCP be available soon as well? :slight_smile:

  • address-lists are useful currently, would be nice to have IPv6 address lists supported.

Also interested on how well the hotspot will cope with IPv6, assuming there is some upgrades required to the inbuilt DNS server to make it work with IPv6

Perhaps a mikrotik rep would care to put up a guide as to how to run a dual-stacked hotspot when the time comes?

3

…and a dual stack operation how to.

  • ipv6 simple queues
  • NAT-PT ( for make backwards compatibility with ipv4 destinations in a ipv6only network)
4

http://arstechnica.com/articles/paedia/ipv6-firewall-mixed-blessing.ars - Article on IPv6 Firewalling (Interesting read)

5

Just mikrotik v3.x support IPV6?

6

yes

7

I’ll second the request for address lists.

Kind regards

Andrew

8

I’d like IPV6 DHCP and DNS.

9

IPv6 ND (Neighbor Discovery) can be used instead of IPv6 DHCP

10

With IPv6 DHCP is mostly used to distribute additional information, such as DNS server addresses, although there will be a way to do this through router advertisements as well soon which may remove the need for it in some more locations.

11

I keep on forgetting that ND does just the basic addressing and that DHCP is still used for a lot of the rest of the informantion.

12

IPv6 firewall features:

  • shortcut to match link local addresses easily
  • optionally match items within a 6to4 tunnel so those packets don’t bypass firewall rules.
  • add address-lists like the ipv4 firewall has.

Other IPv6 features:

  • 6to4 relay and Miredo/Teredo service
  • Enable IPv6 for every service in RouterOS: hotspot, winbox, Dude, Userman, etc.
  • PPPoE able to assign and route dynamic /64 blocks (out of a larger block) to PPPoE users.
13

+1 to the following:

  • Enable IPv6 for every service in RouterOS: hotspot, winbox, Dude, Userman, etc.
  • 6to4 relay and Miredo/Teredo service
14

I would like to join with:
radvd (router advertising) functionality, which can simplify workstations configuration strongly.

15

Address-list feature for IPv6 will be added in the next version.

As well there will be the following options,

*) hop-limit matcher;
*) hop-limit action;
*) icmpv6 matcher;
*) ipv6 extension header matcher.