Dear Colleagues,
Does MikroTik support IPv6 pin-holing or something like UPnP for IPv6?
UPnP work with NAT,
IPv6 usually do not support NAT, since each machine has it’s own IPv6.
Simply leave open the port on firewall vs that IPv6…
Or define your real needs for do not lost time with the XY Problem…
This is pretty obvious. In fact, that is the reason I created the topic as "pin-holing" and not "UPnP".
Simply leave open the port on firewall vs that IPv6....
Manual firewall configuration is inconvenient when multiple IPv6 devices and applications want to receive incoming IPv6 traffic on various dynamic ports and dynamic IPv6 addresses.
Or define your real needs for do not lost time
miniupnpd AFAIK supports punching holes in the IPv6 firewall, speaking the UPnP protocol. Do you think Mikrotik could do that?
It’s needed to be created one feature request on the support page (not here on forum, +1 & co. are uselesss).
But I not think that feature is on the top of the list…
Honestly, it hadn’t happened to me yet and I hadn’t thought about it, when IPv6 and ports are dynamic…
If you invested time into assigning static IPv6 to a machine, then you can add a hole in IPv6 firewall. If the client machine is using address based on RAs, then indeed one would need something similar to UPnP. But then, how is the pseudo-random IP address then made known to internet device wanting to connect to your client machine?
Can somebody write here if there’s some standard way of IPv6 firewall pinholing (similar to UPnP)? If there isn’t, then … well …
I usually don’t do that on an IPv6 LAN. But even if the addresses are static, listening ports can still be dynamic.
If the client machine is using address based on RAs, then indeed one would need something similar to UPnP. But then, how is the pseudo-random IP address then made known to internet device wanting to connect to your client machine?
There has to be a central directory. For example, Bittorrent clients register their addresses and ports with a Bittorrent tracker. Syncthing also has a central registry. Game clients can register their addresses/ports with their respective game servers etc.
Can somebody write here if there’s some standard way of IPv6 firewall pinholing (similar to UPnP)? If there isn’t, then … well …
I know there are consumer routers (supplied by ISPs) with IPv6 pinholing support. I suppose they utilize the UPnP protocol because why invent something new when there is a standard and popular protocol? But perhaps someone knows better.
Or simply do not firewall IPv6 traffic…
I don't think it is a good idea. Maybe it is not as bad as not filtering incoming IPv4 traffic but still not good.
I meant it was the ISP not doing it, not that you don’t have to…
If they declare IPv6 pin-holing support in their documentation, I doubt it means just the absence of any IPv6 ingress filtering 
Unfortunately, Mikrotik's UPnP doesn't support IPv6 (RouterOS 7.19.4):
❯ upnpc -6 -r 6666 6666 tcp
upnpc : miniupnpc library test client, version 2.2.6.
(c) 2005-2024 Thomas Bernard.
Go to http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
for more information.
No IGD UPnP Device found on the network !
The only solution that I found for now is to allow forwarding all IPv6 incoming connections. It's not an adequate solution, but it's safer than doing a similar setup for IPv4, although it is easier to configure an adequate solution in IPv4 (UPnP & DST-NAT filter).
I hate the idea of babysitting my firewall. For a business network, it makes sense to implement a draconian firewall, but for home? If a game, application, or device wants a port, just request it, and that's all. I don't want to manage this.
If someone has a viable solution for opening ports inside the IPv6 firewall directly from the devices, please let me know.
Sent a feature request to Mikrotik: SUP-197477
UPnP with IPv6 support depends on PCP, so if they add the feature, PCP will be available as well.
Meanwhile, I need to guarantee that the host firewalls are configured properly, but these days they are. In general, the firewalls allow by default 1025-65535 TCP/UDP and ICMP, and block everything else.
Coming from different router brand, there is something called IGD2 that can be enabled which allow requesting ports for IPv6.
My ISP assigns dynamic IPv6 prefix, and addresses assigned with SLAAC. So the client IP keep changing and I cannot keep static rules for games/torrent/etc...
My ISP assigns dynamic IPv6 prefix, and addresses assigned with SLAAC. So the client IP keep changing and I cannot keep static rules for games/torrent/etc...
Same motivation here. I don't want to fuss with manual rules. If I've enabled something like UPnP, and a device I've allowed on my network needs some config, then Just Do It.