IPv6 Firewall, PPPoE, Radius, Customer Shutoffs

RouterOS General
1

I have been trying to figure out how to add a pppoe client interface to a filter rule dynamically in the IPv6 firewall.

Currently with IPv4 I use the Filter-id radius attribute to add certain clients to a firewall chain and it works perfectly.
What I want is for that to happen with the IPv6 firewall too.

https://wiki.mikrotik.com/wiki/Manual:RADIUS_Client#Definitions
I have read through the documented attributes here and I don’t see one that would work for adding anything to a firewall chain for ipv6.
If there was one for adding an interface to a list that would be even better but I don’t see that either.
I did try the address-list attribute, but again that only works for IPv4, that may be because IPv6 is getting handed a pool rather than an IP?

My only though at this point is making a script that looks for the existing attribute and create rules in the ipv6 firewall but I could use some help creating a script if anyone could help.

Any other Ideas on how I could make this work would be greatly appreciated!

2

Replying to my own post here because I believe I found a very good solution to this.
I found that the Mikrotik-Group radius attribute, when used with pppoe, specifies a profile to use for the connection.
So I set that to value pppoe-shutoff and created a pppoe profile named the same. From there I can set those connections onto a shutoff interface list that is much easier to handle in the firewall and can be done with the same static rules in both IPv4 and IPv6. Only difference is the Allowed address list.

I used jump chain rule in here because when using the Filter-id option I had to use jump rules. I kept them here because they seem to work good.
You could get away without them by just using the forward chain and specifying the in and out interface list.
Someone could let me know if one way is more efficient than the other.

/interface list
add name=shutoff
/ip firewall address-list
add address=10.0.0.0/8 list=Allowed
add address=192.168.0.0/16 list=Allowed
add address=100.64.0.0/10 list=Allowed
add address=8.8.8.8 list=Allowed
add address=1.1.1.1 list=Allowed
/ipv6 firewall address-list
add address=2001:4860:4860::8888/128 list=Allowed
add address=2001:4860:4860::8844/128 list=Allowed
add address=2606:4700:4700::1111/128 list=Allowed
add address=2606:4700:4700::1001/128 list=Allowed
/ip firewall filter
add action=jump chain=forward comment="jump shutoff traffic to shutoff chain" in-interface-list=shutoff jump-target=shutoff
add action=jump chain=forward comment="jump shutoff traffic to shutoff chain" jump-target=shutoff out-interface-list=shutoff
add action=drop chain=shutoff comment="drop shutoff traffic to internet" dst-address-list=!Allowed
add action=accept chain=shutoff comment="accept shutoff traffic to Allowed list" dst-address-list=Allowed
/ipv6 firewall filter
add action=jump chain=forward comment="jump shutoff traffic to shutoff chain" in-interface-list=shutoff jump-target=shutoff
add action=jump chain=forward comment="jump shutoff traffic to shutoff chain" jump-target=shutoff out-interface-list=shutoff
add action=drop chain=shutoff comment="drop shutoff traffic to internet" dst-address-list=!Allowed
add action=accept chain=shutoff comment="accept shutoff traffic to Allowed list" dst-address-list=Allowed
/ppp profile
add dhcpv6-pd-pool=IPv6-Customer-/60 dns-server=1.1.1.1,8.8.8.8 interface-list=shutoff local-address=192.168.88.1 name=pppoe-shutoff remote-address=PPPoE-Pool