Ipv6 help - cant ping anything outside

livione · August 4, 2026, 11:21pm

Hi all

Until yesterday, my ipv6 setup was just great and suddenly it stopped working without me changing anything!

Any ping gives me timeout.

RouterOS 7.21.5

model = RB5009UG+S+

[bobdenaut@bobdenaut-router] /ipv6> address/ print detail
Flags: X - disabled, I - invalid; D - dynamic; G - global, L - link-local; S - slave; d - deprecated
0 G address=2a02:2f04:500e:bb00::1/64 from-pool=ipv6-pool interface=BRIDGE actual-interface=BRIDGE vrf=main eui-64=no advertise=yes no-dad=no auto-link-local=yes

1 G address=fd6c:7f32:8e91::1/64 from-pool="" interface=BRIDGE actual-interface=BRIDGE vrf=main eui-64=no advertise=yes no-dad=no auto-link-local=yes

2 G address=fd6c:7f32:8e91:1::1/64 from-pool="" interface=CONTAINERS actual-interface=CONTAINERS vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

3 DL address=fe80::4d50:375b:b51f:1d7a/64 from-pool="" interface=wg0 actual-interface=wg0 vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

4 D address=::1/128 from-pool="" interface=lo actual-interface=lo vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

5 DL address=fe80::d06d:edff:fefc:40db/64 from-pool="" interface=CONTAINERS actual-interface=CONTAINERS vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

6 DL address=fe80::6f4:1cff:fe5e:2e43/64 from-pool="" interface=BRIDGE actual-interface=BRIDGE vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

7 DL address=fe80::6f4:1cff:fe5e:2e42/64 from-pool="" interface=ether1 actual-interface=ether1 vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

8 DL address=fe80::c/64 from-pool="" interface=DIGI actual-interface=DIGI vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

9 DG address=2a02:2f04:50ff:ffff::50c:278d/128 from-pool="" interface=DIGI actual-interface=DIGI vrf=main eui-64=no advertise=no no-dad=no auto-link-local=yes

[bobdenaut@bobdenaut-router] /ipv6> dhcp-client/print detail
Flags: D - dynamic; X - disabled, I - invalid
0 interface=DIGI status=bound duid="0x0003000104f41c5e2e42" dhcp-server-v6=fe80::1 request=address,prefix accept-prefix-without-address=no add-default-route=yes
default-route-distance=2 default-route-tables=default check-gateway=ping use-peer-dns=no validate-server-duid=no allow-reconfigure=no dhcp-options=""
pool-name="ipv6-pool" pool-prefix-length=64 prefix-hint=::/56 prefix-address-lists="" dhcp-options="" prefix=2a02:2f04:500e:bb00::/56, never
address=2a02:2f04:50ff:ffff::50c:278d, never

[bobdenaut@bobdenaut-router] /ipv6> firewall/filter/print
Flags: X - disabled, I - invalid; D - dynamic
0 chain=input action=accept protocol=udp dst-port=546

1 D ;;; special dummy rule to show fasttrack6 counters
chain=forward action=passthrough

2 ;;; accept established,related,untracked (input)
chain=input action=accept connection-state=established,related,untracked log=no log-prefix=""

3 ;;; drop invalid (input)
chain=input action=drop connection-state=invalid log=no log-prefix=""

4 ;;; accept ICMPv6 (input)
chain=input action=accept protocol=icmpv6 log=no log-prefix=""

5 ;;; accept UDP traceroute (input)
chain=input action=accept protocol=udp dst-port=33434-33534 log=no log-prefix=""

6 ;;; accept DHCPv6 client prefix delegation (input)
chain=input action=accept protocol=udp src-address=fe80::/10 dst-port=546 log=no log-prefix=""

7 ;;; accept IKE (input)
chain=input action=accept protocol=udp dst-port=500,4500 log=no log-prefix=""

8 ;;; accept IPsec AH (input)
chain=input action=accept protocol=ipsec-ah log=no log-prefix=""

9 ;;; accept IPsec ESP (input)
chain=input action=accept protocol=ipsec-esp log=no log-prefix=""

10 ;;; drop DNS from WAN (v6)
chain=input action=drop protocol=udp in-interface-list=WAN dst-port=53

11 ;;; drop DNS from WAN (v6)
chain=input action=drop protocol=tcp in-interface-list=WAN dst-port=53

12 ;;; fasttrack IPv6
chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""

13 ;;; accept established,related,untracked (forward)
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=""

14 ;;; drop invalid (forward)
chain=forward action=drop connection-state=invalid log=no log-prefix=""

15 ;;; drop packets with bad src IPv6
chain=forward action=drop src-address-list=bad_ipv6 log=no log-prefix=""

16 ;;; drop packets with bad dst IPv6
chain=forward action=drop dst-address-list=bad_ipv6 log=no log-prefix=""

17 ;;; rfc4890 drop hop-limit=1
chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 log=no log-prefix=""

18 ;;; accept ICMPv6 (forward)
chain=forward action=accept protocol=icmpv6 log=no log-prefix=""

19 ;;; accept HIP
chain=forward action=accept protocol=139 log=no log-prefix=""

20 ;;; accept IKE
chain=forward action=accept protocol=udp dst-port=500,4500 log=no log-prefix=""

21 ;;; accept IPsec AH
chain=forward action=accept protocol=ipsec-ah log=no log-prefix=""

22 ;;; accept IPsec ESP
chain=forward action=accept protocol=ipsec-esp log=no log-prefix=""

23 ;;; accept all that matches IPsec policy
chain=forward action=accept log=no log-prefix="" ipsec-policy=in,ipsec

24 ;;; drop everything else not coming from LAN
chain=forward action=drop in-interface-list=!LAN log=no log-prefix=""

25 ;;; accept from LAN (input)
chain=input action=accept in-interface-list=LAN

26 ;;; drop everything else not coming from LAN (input)
chain=input action=drop in-interface-list=!LAN

[bobdenaut@bobdenaut-router] /ipv6> nd print detail
Flags: X - disabled, I - invalid; * - default
0 * interface=BRIDGE ra-interval=30s-2m ra-delay=3s mtu=unspecified reachable-time=unspecified retransmit-interval=unspecified ra-lifetime=10m ra-preference=medium
hop-limit=64 advertise-mac-address=no advertise-dns=yes managed-address-configuration=no other-configuration=no dns=fd6c:7f32:8e91:1::2

[bobdenaut@bobdenaut-router] /ipv6> pool/print detail
Flags: D - dynamic
0 D name="ipv6-pool" prefix=2a02:2f04:500e:bb00::/56 prefix-length=64

[bobdenaut@bobdenaut-router] /ipv6> route/print detail
Flags: D - dynamic; X - disabled, I - inactive, A - active;
c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, g - slaac, y - bgp-mpls-vpn; H - hw-offloaded; + - ecmp
0 As dst-address=::/0 routing-table=main gateway=fe80::1%DIGI immediate-gw=fe80::1%DIGI distance=1 scope=30 target-scope=10

D v dst-address=::/0 routing-table=main gateway=DIGI immediate-gw=DIGI distance=2 scope=30 target-scope=10 vrf-interface=DIGI

DId dst-address=::/0 routing-table=main gateway=fe80::1%DIGI immediate-gw="" check-gateway=ping distance=2 scope=30 target-scope=10 vrf-interface=DIGI

DAc dst-address=::1/128 routing-table=main gateway=lo immediate-gw=lo distance=0 scope=10 target-scope=5

DAd dst-address=2a02:2f04:500e:bb00::/56 routing-table=main blackhole immediate-gw="" distance=2 vrf-interface=DIGI

DAc dst-address=2a02:2f04:500e:bb00::/64 routing-table=main gateway=BRIDGE immediate-gw=BRIDGE distance=0 scope=10 target-scope=5

DAc dst-address=2a02:2f04:50ff:ffff::50c:278d/128 routing-table=main gateway=DIGI immediate-gw=DIGI distance=0 scope=10 target-scope=5

DAc dst-address=fd6c:7f32:8e91::/64 routing-table=main gateway=BRIDGE immediate-gw=BRIDGE distance=0 scope=10 target-scope=5

DAc dst-address=fd6c:7f32:8e91:1::/64 routing-table=main gateway=CONTAINERS immediate-gw=CONTAINERS distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=ether1 immediate-gw=ether1 distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=BRIDGE immediate-gw=BRIDGE distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=DIGI immediate-gw=DIGI distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=CONTAINERS immediate-gw=CONTAINERS distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=wg0 immediate-gw=wg0 distance=0 scope=10 target-scope=5

[bobdenaut@bobdenaut-router] /ipv6> settings/print
disable-ipv6: no
forward: yes
multipath-hash-policy: l3
accept-redirects: yes-if-forwarding-disabled
accept-router-advertisements: yes
accept-router-advertisements-on: all
disable-link-local-address: no
stale-neighbor-detect-interval: 30
stale-neighbor-timeout: 60
min-neighbor-entries: 4096
soft-max-neighbor-entries: 8192
max-neighbor-entries: 16384
allow-fast-path: yes
ipv6-fast-path-active: no
ipv6-fast-path-packets: 0
ipv6-fast-path-bytes: 0
ipv6-fasttrack-active: yes
ipv6-fasttrack-packets: 609
ipv6-fasttrack-bytes: 58085

[bobdenaut@bobdenaut-router] /ipv6> /interface/pppoe-client/print detail
Flags: X - disabled, I - invalid; R - running
0 R name="DIGI" max-mtu=auto max-mru=auto mrru=disabled interface=ether1 user="xxx" profile=default keepalive-timeout=10 service-name="" ac-name=""
add-default-route=yes default-route-distance=2 dial-on-demand=no use-peer-dns=no allow=pap,chap,mschap1,mschap2

[bobdenaut@bobdenaut-router] /ipv6> /ping [:resolve ipv6.google.com]
SEQ HOST SIZE TTL TIME STATUS
0 2a00:1450:4017:807::200e timeout
1 2a00:1450:4017:807::200e timeout
2 2a00:1450:4017:807::200e timeout
sent=3 received=0 packet-loss=100%

PS C:\Windows\System32> ping -6 2606:4700:4700::1111

Pinging 2606:4700:4700::1111 with 32 bytes of data:
Request timed out.

Ping statistics for 2606:4700:4700::1111:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C
PS C:\Windows\System32> curl.exe -6 -v https://[2606:4700:4700::1111]/

Trying [2606:4700:4700::1111]:443...

Any help is appreciated!

CGGXANNX · August 5, 2026, 4:13am

If you are using PPPoE for your WAN, then this static default route you manually added is probably wrong:

Try to remove or disable it. When using PPPoE, this currently inactive route:

should be the active one. That dynamic route is added with the setting add-default-route=yes on the PPPoE client, and is correct so. Keep this setting like that.

The 3rd invalid route is wrong, this one:

It has been automatically added because you turned on add-default-route=yes on the DHCPv6 client instance. It's a hack, don't do that (it's wrong when you use PPPoE anyway). So you should set add-default-route=no on the DHCPv6 client.

In short: do not manually add the static default route with gateway=fe80::1%DIGI, and do not turn on add-default-route=yes on the DHCPv6 client.

Use add-default-route=yes on the PPPoE client instance instead. Of if you prefer to add the route manually, then turn off that setting and add the default route with only the interface specified as gateway.

/ipv6 route add dst-address=::/0 gateway=DIGI routing-table=main

For point-to-point like PPPoE, the gateway is the interface.

livione · August 5, 2026, 6:51am

I really appreciate you took the time to debug my settings, so here is after a small manual tweak:

[bobdenaut@bobdenaut-router] > /interface/pppoe-client/print detail
Flags: X - disabled, I - invalid; R - running
0 R name="DIGI" max-mtu=auto max-mru=auto mrru=disabled interface=ether1 user="xxx" profile=default keepalive-timeout=10 service-name="" ac-name=""
add-default-route=yes default-route-distance=2 dial-on-demand=no use-peer-dns=no allow=pap,chap,mschap1,mschap2

[bobdenaut@bobdenaut-router] > /interface/print detail where name=DIGI
Flags: D - dynamic; X - disabled; I - inactive, R - running; S - slave; P - passthrough
0 R name="DIGI" type="pppoe-out" mtu=1492 actual-mtu=1492 vrf=main last-link-down-time=2026-08-05 09:37:04 last-link-up-time=2026-08-05 09:37:06 link-downs=4

[bobdenaut@bobdenaut-router] > /ipv6/dhcp-client/print detail
Flags: D - dynamic; X - disabled, I - invalid
0 interface=DIGI status=bound duid="0x0003000104f41c5e2e42" dhcp-server-v6=fe80::1 request=address,prefix accept-prefix-without-address=no add-default-route=no
default-route-tables=default check-gateway=ping use-peer-dns=no validate-server-duid=no allow-reconfigure=no dhcp-options="" pool-name="ipv6-pool"
pool-prefix-length=64 prefix-hint=::/56 prefix-address-lists="" dhcp-options="" prefix=2a02:2f04:500f:f100::/56, never address=2a02:2f04:50ff:ffff::50c:ceb6, never

[bobdenaut@bobdenaut-router] > /ipv6/route/print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, d - DHCP, v - VPN
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
DST-ADDRESS GATEWAY ROUTING-TABLE DISTANCE
DAv ::/0 DIGI main 2
DAc ::1/128 lo main 0
DAd 2a02:2f04:500f:f100::/56 main 2
DAc 2a02:2f04:500f:f100::/64 BRIDGE main 0
DAc 2a02:2f04:50ff:ffff::50c:ceb6/128 DIGI main 0
DAc fd6c:7f32:8e91::/64 BRIDGE main 0
DAc fd6c:7f32:8e91:1::/64 CONTAINERS main 0
DAc fe80::/64 ether1 main 0
DAc fe80::/64 BRIDGE main 0
DAc fe80::/64 DIGI main 0
DAc fe80::/64 CONTAINERS main 0
DAc fe80::/64 wg0 main 0

[bobdenaut@bobdenaut-router] > /ipv6/route/print detail
Flags: D - dynamic; X - disabled, I - inactive, A - active;
c - connect, s - static, r - rip, b - bgp, o - ospf, i - is-is, d - dhcp, v - vpn, m - modem, g - slaac, y - bgp-mpls-vpn; H - hw-offloaded; + - ecmp
DAv dst-address=::/0 routing-table=main gateway=DIGI immediate-gw=DIGI distance=2 scope=30 target-scope=10 vrf-interface=DIGI

DAc dst-address=::1/128 routing-table=main gateway=lo immediate-gw=lo distance=0 scope=10 target-scope=5

DAd dst-address=2a02:2f04:500f:f100::/56 routing-table=main blackhole immediate-gw="" distance=2 vrf-interface=DIGI

DAc dst-address=2a02:2f04:500f:f100::/64 routing-table=main gateway=BRIDGE immediate-gw=BRIDGE distance=0 scope=10 target-scope=5

DAc dst-address=2a02:2f04:50ff:ffff::50c:ceb6/128 routing-table=main gateway=DIGI immediate-gw=DIGI distance=0 scope=10 target-scope=5

DAc dst-address=fd6c:7f32:8e91::/64 routing-table=main gateway=BRIDGE immediate-gw=BRIDGE distance=0 scope=10 target-scope=5

DAc dst-address=fd6c:7f32:8e91:1::/64 routing-table=main gateway=CONTAINERS immediate-gw=CONTAINERS distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=ether1 immediate-gw=ether1 distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=BRIDGE immediate-gw=BRIDGE distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=DIGI immediate-gw=DIGI distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=CONTAINERS immediate-gw=CONTAINERS distance=0 scope=10 target-scope=5

DAc dst-address=fe80::/64 routing-table=main gateway=wg0 immediate-gw=wg0 distance=0 scope=10 target-scope=5

[bobdenaut@bobdenaut-router] > /ipv6/address/print
Flags: D - DYNAMIC; G - GLOBAL, L - LINK-LOCAL
Columns: ADDRESS, FROM-POOL, INTERFACE, VRF, ADVERTISE

ADDRESS FROM-POOL INTERFACE VRF ADVERTISE

0 G 2a02:2f04:500f:f100::1/64 ipv6-pool BRIDGE main yes
1 G fd6c:7f32:8e91::1/64 BRIDGE main yes
2 G fd6c:7f32:8e91:1::1/64 CONTAINERS main no
3 DL fe80::4d50:375b:b51f:1d7a/64 wg0 main no
4 D ::1/128 lo main no
5 DL fe80::6f4:1cff:fe5e:2e43/64 BRIDGE main no
6 DL fe80::d06d:edff:fefc:40db/64 CONTAINERS main no
7 DL fe80::6f4:1cff:fe5e:2e42/64 ether1 main no
8 DL fe80::c/64 DIGI main no
9 DG 2a02:2f04:50ff:ffff::50c:ceb6/128 DIGI main no
[bobdenaut@bobdenaut-router] > /ping [:resolve ipv6.google.com]
SEQ HOST SIZE TTL TIME STATUS
0 2a00:1450:4017:824::200e timeout
1 2a00:1450:4017:824::200e timeout
2 2a00:1450:4017:824::200e timeout
sent=3 received=0 packet-loss=100%

[bobdenaut@bobdenaut-router] > /ping 2606:4700:4700::1111
SEQ HOST SIZE TTL TIME STATUS
0 2606:4700:4700::1111 timeout
1 2606:4700:4700::1111 timeout
2 2606:4700:4700::1111 timeout
sent=3 received=0 packet-loss=100%

so what the heck is going on?

CGGXANNX · August 5, 2026, 10:23am

Your default route looks correct now, and the packets are correctly sent out of the DIGI interface. I would say the problem is on your ISP side. You should probably contact their support.

Using looking glass tools like this to try a traceroute to your address, the traceroute doesn't even reach your ISP at all:

livione · August 5, 2026, 10:29am

yeah, I just connected my laptop directly to their equipment and I have the same issue, they will come over soon, not sure how well prepare they are

livione · August 5, 2026, 1:02pm

The technician came, took a look and left, he escalated to other team

I had a feeling