IPv6 policy routing example.

RouterOS General
1

Hi.

Setup that I have:

  • two ipv6 tunnels, one from HE.net, another from local ISP via 6rd.
  • /48 block from HE.net (statically allocated), /56 block from local ISP 6rd (dynamic)
  • bunch of hosts in “DMZ” and “LAN” that have native IPv6 connectivity on ethernet or wifi.

what I’m interested, is to have proper routing based on source. I’m fine to have my both /48 and /56 blocks talking to each other directly, but when it comes to outgoing world traffic, “default” route should be pointing to different tunnels.

I’ve made it working for connection intiated from outside world to my blocks by connection marking on incoming interfaces… but no luck with outgoing from my DMZ/LANs that will not break inter-area traffic.

this is what I currently have, any hints on improvements?

/ipv6 firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=he new-connection-mark=he passthrough=no
/ipv6 firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=6rd new-connection-mark=6rd passthrough=no
/ipv6 firewall mangle add action=mark-routing chain=output connection-mark=he new-routing-mark=he
/ipv6 firewall mangle add action=mark-routing chain=output connection-mark=6rd new-routing-mark=6rd
/ipv6 firewall mangle add action=mark-routing chain=prerouting connection-mark=6rd disabled=yes dst-address-type=!local new-routing-mark=6rd
/ipv6 firewall mangle add action=mark-routing chain=prerouting connection-mark=he disabled=yes dst-address-type=!local new-routing-mark=he
/routing table add disabled=no fib name=he
/routing table add disabled=no fib name=6rd
/ipv6 route add disabled=no dst-address=2000::/3 gateway=he routing-table=he
/ipv6 route add disabled=no dst-address=2000::/3 gateway=6rd routing-table=6rd
IPv6 different gateways for different subnets
2

Not tested, but routing rules should do the trick, without any mangling:

/routing rule
add action=lookup dst-address=<he-subnet>/48 table=main
add action=lookup dst-address=<6rd-subnet>/56 table=main
add action=lookup src-address=<he-subnet>/48 table=he
add action=lookup src-address=<6rd-subnet>/56 table=6rd

You can update rules for dynamic prefix from lease script.

3

Thanks for idea, will try. I was trying to avoid hardcoding addresses in the rules.
One idea that I had was to mark-connection on forward chain in mangle, but that seems not working, at least in 7.7rc2.

4

If you use addresses from each tunnel in distinct part of LAN and you can identify source even without using addresses (e.g. by interface), then you could use mangle rules the same way as for incoming connections. Marking connection in forward is possible, but it won’t help you with outgoing ones, because in forward it’s too late to influence routing.