IPv6 routing between VRFs (MDU use case)

DarkHelmet · June 14, 2026, 1:57am

I have an RB5009UPr+S+ which I'm using to provide 4 apartments Internet access via a cable provider. This provider gives a /60 via PD and the router is receiving that, and I have it setting the interface addresses for the VRFs. IPv4 is working, well other than fasttrack causing the VRF's to slow to a crawl (60kbit/s), but I was able to exempt them from processing and they appear to be going at line rate now.

IPv6 should be rather simple, add ::/0 to each VRF via the %bridge-local@main and then a route from main to the VRF for the pool IP. This may need to be done via bgp, but at this point I'm just statically defining it to test. I'm unable to ping between the VRFs in testing and via a second test host as well. I can ping the VRF interfaces in the VRF, and even get SLAAC on the test APT1 client, it just doesn't make it out. I've mostly disabled the firewall for v6 and can't seem to get anywhere.

I'm no expert in mikrotik, so am I missing something? Is this something due to using bridge local and VLANs in different VRFs?

VRFs

VRF-APT1
VRF-APT2
VRF-APT3
VRF-APT4

Interfaces

WAN: ether8
LAN: bridge-local
APT1 - VLAN 101 on bridge-local
APT2 - VLAN 102 on bridge-local 
APT3 - VLAN 103 on bridge-local
APT4 - VLAN 104 on bridge-local

routing table

[admin@SPBGFLRT01] /ipv6/route> print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, s - STATIC, d - DHCP, g - SLAAC
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
#     DST-ADDRESS                                GATEWAY                           ROUTING-TABLE  DISTANCE
  D d ::/0                                       fe80::7201:b5ff:fecd:9019%ether8  main                  1
  DAg ::/0                                       fe80::7201:b5ff:fecd:9019%ether8  main                  0
;;; ONE-Default
0   s ::/0                                       bridge-local                      main                  1
  DAc ::1/128                                    lo                                main                  0
  DAd 2603:9000:9608:1ff0::/60                                                     main                  1
  DAc 2603:9000:9608:1ff0::/64                   bridge-local                      main                  0
1   s 2603:9000:9608:1ff0::/64                   bridge-local                      main                  1
2  As 2603:9000:9608:1ff1::/64                   APT1@VRF-APT1                     main                  1
  DAc 2603:9000:ff00:96:4019:aeaa:12e4:17df/128  ether8                            main                  0
  DAc fe80::/64                                  ether8                            main                  0
  DAc fe80::/64                                  bridge-local                      main                  0
3  As ::/0                                       bridge-local                      VRF-APT1              1
  DAc 2603:9000:9608:1ff1::/64                   APT1@VRF-APT1                     VRF-APT1              0
  DAc fe80::/64                                  APT1@VRF-APT1                     VRF-APT1              0
  DAc 2603:9000:9608:1ff2::/64                   APT2@VRF-APT2                     VRF-APT2              0
  DAc fe80::/64                                  APT2@VRF-APT2                     VRF-APT2              0
  DAc 2603:9000:9608:1ff3::/64                   APT3@VRF-APT3                     VRF-APT3              0
  DAc fe80::/64                                  APT3@VRF-APT3                     VRF-APT3              0
  DAc 2603:9000:9608:1ff4::/64                   APT4@VRF-APT4                     VRF-APT4              0
  DAc fe80::/64                                  APT4@VRF-APT4                     VRF-APT4              0

Routes and trying to ping between them

[admin@SPBGFLRT01] /ipv6/route> export
# 2026-06-06 13:47:14 by RouterOS 7.23.1
# software id = 77VT-KL7R
#
# model = RB5009UPr+S+
# serial number = HFG094Z4V9A
/ipv6 route
add comment=ONE-Default disabled=no distance=1 dst-address=::/0 gateway=bridge-local pref-src="" routing-table=main vrf-interface=bridge-local
add disabled=no distance=1 dst-address=2603:9000:9608:1ff1::/64 gateway=APT1@VRF-APT1 pref-src="" routing-table=main
add disabled=no distance=1 dst-address=2603:9000:9608:1ff0::/64 gateway=bridge-local pref-src="" routing-table=VRF-APT1 vrf-interface=\
    bridge-local
add disabled=no dst-address=::/0 gateway=bridge-local@main routing-table=VRF-APT1
[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff0::1 vrf=VRF-APT1
  SEQ HOST                                     SIZE TTL TIME       STATUS
    0 2603:9000:9608:1ff0::1                                        timeout
    1 2603:9000:9608:1ff0::1                                        timeout
    2 2603:9000:9608:1ff0::1                                        timeout
    sent=3 received=0 packet-loss=100%

[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff1::1
  SEQ HOST                                     SIZE TTL TIME       STATUS
    0 2603:9000:9608:1ff1::1                                        timeout
    1 2603:9000:9608:1ff1::1                                        timeout
    2 2603:9000:9608:1ff1::1                                        timeout
    sent=3 received=0 packet-loss=100%

[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff1:: vrf=
VRF-APT1     VRF-APT2     VRF-APT3     VRF-APT4     main
[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff1:: vrf=VRF-APT1
arp-ping     as-value     count     do-not-fragment     dscp     interval     proplist     size     src-address     ttl     without-paging
[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff1:: vrf=VRF-APT1
  SEQ HOST                                     SIZE TTL TIME       STATUS
    0 2603:9000:9608:1ff1::1                      56  64 348us      echo reply
    0 2603:9000:9608:1ff1::1                      56  64 484us      echo reply
    1 2603:9000:9608:1ff1::1                      56  64 371us      echo reply
    1 2603:9000:9608:1ff1::1                      56  64 515us      echo reply
    2 2603:9000:9608:1ff1::1                      56  64 345us      echo reply
    2 2603:9000:9608:1ff1::1                      56  64 489us      echo reply
    sent=3 received=6 packet-loss=-100% min-rtt=345us avg-rtt=425us max-rtt=515us

[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff1::1 vrf=VRF-APT1
  SEQ HOST                                     SIZE TTL TIME       STATUS
    0 2603:9000:9608:1ff1::1                      56  64 353us      echo reply
    0 2603:9000:9608:1ff1::1                      56  64 488us      echo reply
    1 2603:9000:9608:1ff1::1                      56  64 347us      echo reply
    1 2603:9000:9608:1ff1::1                      56  64 491us      echo reply
    sent=2 received=4 packet-loss=-100% min-rtt=347us avg-rtt=419us max-rtt=491us

[admin@SPBGFLRT01] /ipv6/route> /ping 2603:9000:9608:1ff0::1
  SEQ HOST                                     SIZE TTL TIME       STATUS
    0 2603:9000:9608:1ff0::1                      56  64 368us      echo reply
    1 2603:9000:9608:1ff0::1                      56  64 352us      echo reply
    2 2603:9000:9608:1ff0::1                      56  64 342us      echo reply
    sent=3 received=3 packet-loss=0% min-rtt=342us avg-rtt=354us max-rtt=368us

config

# 2026-06-06 13:51:54 by RouterOS 7.23.1
# software id = 77VT-KL7R
#
# model = RB5009UPr+S+
# serial number = HFG094Z4V9A
/interface bridge
add admin-mac=78:9A:18:D6:14:7C auto-mac=no comment=defconf name=bridge-local port-cost-mode=short
/interface ethernet
set [ find default-name=ether4 ] l2mtu=1514 name=WAP-AP1
set [ find default-name=ether5 ] l2mtu=1514 name=WAP-AP2
set [ find default-name=ether1 ] l2mtu=1514 name=WAP-APT3 rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether2 ] l2mtu=1514
set [ find default-name=ether3 ] l2mtu=1514
set [ find default-name=ether6 ] l2mtu=1514
set [ find default-name=ether7 ] l2mtu=1514
set [ find default-name=ether8 ] l2mtu=1514
set [ find default-name=sfp-sfpplus1 ] l2mtu=9008 mtu=1520
/interface vlan
add interface=bridge-local name=APT1 vlan-id=101
add interface=bridge-local name=APT2 vlan-id=102
add interface=bridge-local name=APT3 vlan-id=103
add interface=bridge-local name=APT4 vlan-id=104
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp0 ranges=192.168.0.100-192.168.0.249
add comment=APT-ONE-POOL name=ONE-POOL ranges=172.19.1.101-172.19.1.199
/ip dhcp-server
add address-pool=dhcp0 authoritative=after-2sec-delay interface=bridge-local lease-time=10m name=dhcp1
add address-pool=ONE-POOL interface=APT1 name=ONE
/ip smb users
set [ find default=yes ] disabled=yes
/ip vrf
add interfaces=APT4 name=VRF-APT4
add interfaces=APT3 name=VRF-APT3
add interfaces=APT2 name=VRF-APT2
add interfaces=APT1 name=VRF-APT1
/routing id
add disabled=no id=192.168.3.211 name=id-1 select-dynamic-id="" select-from-vrf=main
/routing ospf instance
add disabled=no name=ospf-instance-1 originate-default=never redistribute=connected,static,ospf router-id=192.168.3.211 routing-table=main
/routing ospf area
add disabled=no instance=ospf-instance-1 name=ospf-area-0
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0 disabled=yes
add addresses=0.0.0.0/0 authentication-protocol=SHA1 encryption-protocol=AES name=KeeklesSNMP security=private
/interface bridge port
add bridge=bridge-local comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=WAP-AP1 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=WAP-AP2 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=ether6 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=ether7 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=WAP-APT3 internal-path-cost=10 path-cost=10
add bridge=bridge-local comment=defconf interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all lldp-mac-phy-config=yes lldp-max-frame-size=yes lldp-med-net-policy-vlan=1 lldp-vlan-info=yes
/ipv6 settings
set accept-router-advertisements=yes
/interface bridge vlan
add bridge=bridge-local tagged=WAP-AP2,WAP-AP1,WAP-APT3 vlan-ids=1,100-105
/interface list member
add comment=defconf interface=bridge-local list=LAN
add comment=defconf interface=ether8 list=WAN
add interface=APT1 list=LAN
add interface=APT2 list=LAN
add interface=APT3 list=LAN
add interface=APT4 list=LAN
/ip address
add address=192.168.3.211 interface=lo network=192.168.3.210
add address=192.168.0.254/24 interface=bridge-local network=192.168.0.0
add address=172.19.1.254/24 comment="APT1 LAN" interface=APT1 network=172.19.1.0
add address=172.19.2.254/24 comment="APT2 LAN" interface=APT2 network=172.19.2.0
add address=172.19.3.254/24 comment="APT3 LAN" interface=APT3 network=172.19.3.0
add address=172.19.4.254/24 comment="APT4 LAN" interface=APT4 network=172.19.4.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf default-route-tables=main,VRF-APT1,VRF-APT2,VRF-APT3,VRF-APT4 interface=ether8 name=ether8
/ip dhcp-server lease
/ip dhcp-server network
add address=172.19.1.0/24 comment=APT-ONE-LAN dns-server=1.1.1.1 gateway=172.19.1.254 netmask=24
add address=192.168.0.0/24 comment="Apt3 Lan" dns-server=192.168.8.150,1.1.1.1 gateway=192.168.0.254
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set servers=192.168.8.150
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall address-list
add address=192.168.0.0/24 comment=local list=allowed_to_router
add address=192.168.0.0 comment=mgmt list=MGMT
add address=192.168.0.0/16 comment=mgmt list=MGMT
/ip firewall filter
add action=accept chain=input comment="allow mgmt" in-interface-list=WAN src-address-list=MGMT
add action=accept chain=forward comment="51413 in" dst-port=51413 in-interface-list=WAN protocol=tcp
add action=accept chain=forward comment="42615 tcp in" dst-port=42615 in-interface-list=WAN protocol=tcp
add action=accept chain=forward comment="42615 udp in" dst-port=42615 in-interface-list=WAN protocol=udp
add action=accept chain=forward comment="51413 in" dst-port=51413 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="allow all from tunnel interface" in-interface=TAMSFLDERT1
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid log=yes
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec log=yes
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log=yes
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new \
	in-interface-list=WAN
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN log=yes
/ip firewall mangle
add action=mark-connection chain=prerouting connection-state=new new-connection-mark=APT1 passthrough=no src-address=172.19.1.0/24
add action=mark-connection chain=prerouting connection-state=new new-connection-mark=APT2 passthrough=no src-address=172.19.2.0/24
add action=mark-connection chain=prerouting connection-state=new new-connection-mark=APT3 passthrough=no src-address=172.19.3.0/24
add action=mark-connection chain=prerouting connection-state=new new-connection-mark=APT4 passthrough=no src-address=172.19.4.0/24
add action=mark-routing chain=prerouting connection-mark=APT1 in-interface-list=WAN new-routing-mark=VRF-APT1
add action=mark-routing chain=prerouting connection-mark=APT2 in-interface-list=WAN new-routing-mark=VRF-APT2
add action=mark-routing chain=prerouting connection-mark=APT3 in-interface-list=WAN new-routing-mark=VRF-APT3
add action=mark-routing chain=prerouting connection-mark=APT4 in-interface-list=WAN new-routing-mark=VRF-APT4
/ip firewall nat
add action=dst-nat chain=dstnat comment="torrent to lunchladydoris" dst-port=51413 in-interface-list=WAN protocol=udp to-addresses=192.168.0.245 \
	to-ports=51413
add action=dst-nat chain=dstnat comment="torrent to lunchladydoris" dst-port=51413 in-interface-list=WAN protocol=tcp to-addresses=192.168.0.245 \
	to-ports=51413
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=42615 in-interface-list=WAN protocol=tcp to-addresses=192.168.0.60 to-ports=42615
add action=dst-nat chain=dstnat dst-port=42615 in-interface-list=WAN protocol=udp to-addresses=192.168.0.60 to-ports=42615
/ip nat-pmp
set enabled=yes
/ip nat-pmp interfaces
add interface=bridge-local type=internal
add interface=WAP-APT3 type=external
/ip route
add disabled=yes distance=1 dst-address=192.168.0.0/16 gateway=192.168.255.17 routing-table=main scope=30 target-scope=10
/ipv6 route
add comment=ONE-Default disabled=no distance=1 dst-address=::/0 gateway=bridge-local pref-src="" routing-table=main vrf-interface=bridge-local
add disabled=no distance=1 dst-address=2603:9000:9608:1ff1::/64 gateway=APT1@VRF-APT1 pref-src="" routing-table=main
add disabled=no distance=1 dst-address=2603:9000:9608:1ff0::/64 gateway=bridge-local pref-src="" routing-table=VRF-APT1 vrf-interface=\
	bridge-local
add disabled=no dst-address=::/0 gateway=bridge-local@main routing-table=VRF-APT1
/ip service
set www-ssl disabled=no
/ipv6 address
add from-pool=delegation interface=bridge-local
add address=0:0:0:1::1 from-pool=delegation interface=APT1
add address=0:0:0:2::1 from-pool=delegation interface=APT2
add address=0:0:0:3::1 from-pool=delegation interface=APT3
add address=0:0:0:4::1 from-pool=delegation interface=APT4
/ipv6 dhcp-client
add add-default-route=yes allow-reconfigure=yes interface=ether8 pool-name=delegation pool-prefix-length=64 prefix-hint=::/60 request=\
	address,prefix use-interface-duid=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=fasttrack-connection chain=forward comment="Enable FastTracked v6 traffic" connection-state=established,related
add action=accept chain=forward comment="accept established,related,untracked" connection-state=established,related,untracked disabled=yes
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMPv6" disabled=yes protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" disabled=yes port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." disabled=yes dst-port=546 protocol=udp src-address=\
	fe80::/10
add action=accept chain=input comment="defconf: accept IKE" disabled=yes dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" disabled=yes protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" disabled=yes protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked disabled=\
	yes
add action=accept chain=input comment="Accept DHCPv6 client prefix delegation" disabled=yes dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="Accept DHCPv6 client prefix delegation" disabled=yes
add action=accept chain=forward comment="defconf: accept ipsec AH" disabled=yes protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept IKE" disabled=yes dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept ICMPv6" disabled=yes protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ipsec ESP" disabled=yes protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept HIP" disabled=yes protocol=139
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" disabled=yes in-interface-list=!LAN
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid disabled=yes
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" disabled=yes src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" disabled=yes hop-limit=equal:1 protocol=icmpv6
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" disabled=yes in-interface-list=!LAN
/ipv6 nd
set [ find default=yes ] advertise-dns=yes hop-limit=64 interface=bridge-local
add hop-limit=64 interface=ether8
add advertise-dns=yes dns=2606:4700:4700::1111,2606:4700:4700::1001 hop-limit=64 interface=APT1
/routing filter rule
add chain=ospf-in disabled=no rule="if (dst == 192.168.0.0/16 ) { accept } else {reject}"
add chain=ospf-out disabled=no rule="if (dst == 192.168.0.0/16 ) { accept } else {reject}"
/routing ospf interface-template
add area=ospf-area-0 disabled=no prefix-list=192.168.0.0/16
/routing settings
set policy-rules=vrf-lookup,vrf-unreach,mangle,local,user,main
/system clock
set time-zone-name=America/New_York
/system identity
set name=SPBGFLRT01
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Diagram

A simple diagram of this.

I've been suggested that I need to mark the packets in the IPv6 firewall, but this should be simple routing, no NAT, just forwarding traffic, so I don't think that's needed.

From my testing, is IPv6 in VRF's just not supported?

npeca75 · June 14, 2026, 8:59am

but why VRF ?
why not simply 4 pcs of VLANs, each with own address space ?

DarkHelmet · June 14, 2026, 2:26pm

They are independent private networks, they shouldn't be able to see each other. If they are in the same routing table, then they would be able to talk.

npeca75 · June 14, 2026, 2:38pm

ok, when you separate them on L2 (vlans) and L3 (ip) and put proper L3 firewall, allow each vlan only to exit WAN and nothing more, your goal is achieved

DarkHelmet · June 14, 2026, 5:36pm

Each customer should have their own table, this is just good network design. Having a firewall filter as the only thing keeping customer separated is a huge risk.

The other issue is how you would update the firewall rules for ipv6 when the prefix changes.

npeca75 · June 14, 2026, 6:09pm

very simple, using in_interface

vlan101 for ap1
vlan102 for ap2
etc

firewall rule
forward allow from vlan101 to WAN6
forward allow from vlan102 to WAN6
...etc
forward drop all

no need to specify IPv6 addr in filters

same thing for v4

DarkHelmet · June 14, 2026, 8:15pm

Thanks, it's a backup option if I can't get VRFs to work.

lurker888 · June 14, 2026, 8:50pm

VRFs on Linux systems are not totally the same concept as on Ciscos. On Linuxes, vrfs mainly serve the purpose of dynamic routing scenarios, or situations where the ip address ranges might overlap.

The Linuxy way of configuring this is indeed properly done via the firewall. And it's really simple.

Saying "what if the firewall malfunctions" is a bit disingenuous: besides the fact that firewalling is a primary function of the device, if that fails then your tenants would be exposed to the whole internet; do they present a more severe threat to each other or is a random hacker more dangerous? How long will it take someone on the internet to take over your router altogether? Do you not depend heavily on connection tracking?

CGGXANNX · June 15, 2026, 12:49am

As the other have said, there is no real reason to require VRF in your setup. The isolation provided by the VLANs (layer 2) and the IP firewall (drop forwarding between in-interface/in-interface-list and out-interface/out-interface-list for layer 3) are perfectly fine.

But if you insist on using VRF, then the reason routing to the internet doesn't work with your setup is due to the way you specify the static default route in the VRF:

Specifying bridge-local@main will not work because internet addresses are not directly connected on bridge-local, and you don't have a point-to-point interface. The correct gateway must be a copy from the default route that RA provides on ether1 (the DAg route), that the DHCPv6 client also added (the inactive D d route).

/ipv6 route
add dst-address=::/0 gateway=fe80::7201:b5ff:fecd:9019%ether8@main routing-table=VRF-APT1

You need to specify the link-local address of the gateway on ether8. If that address is dynamic, you'll need some scripting to copy the gateway from the default dynamic route (the DAg one or the D d one) to the static routes you added to the VRF routing tables.

EDIT: If the gateway that the "Add Default Route" workaround that MikroTik added to DHCPv6 client is the same as the real gateway provided by Router Advertisements, then you can use the following feature of recent RouterOS version:

To automatically add the default routes to the 4 VRF routing tables, no script is needed.

DarkHelmet · June 15, 2026, 12:58am

Thanks, but I'm not using Linux here, this is on the router directly. I have a Linux box I can test from if needed. Linux can do Network Name Spaces, which closely mirror what most routers can do. I've done routing using network name spaces on Linux and can confirm forwarding works correctly, and ICMP responses come from the interface IPs inside the namespaces. I have this setup under a Linux box and can confirm it doesn't need anything in the firewall throw this in a terminal: 'traceroute -m 255 becky.keekles.org'

A VRF is a general term i was just using as mikrotik says it's supported, Cisco calls it that, but Junos uses routing instances, Nokia calls them VPRN's. I'm going to say something is very broken in Mikrotik land with VRFs if the firewall is involved.

CGGXANNX · June 15, 2026, 1:21am

The reason @lurker888 mentioned Linux is because RouterOS is just Linux underneath (currently based on kernel 5.6.3), and for many concepts and features, everthing just mirrors the Linux's behavior.

lurker888 · June 15, 2026, 5:20am

I will admit that my response was somewhat argumentative (rant would be a more apt characterization), but I meant no harm.

Basically my argument boils down to this: if you already rely on the firewall for many aspects of the functionality, and it's mostly fully functional and available, and it does what you want: why not use it and be done with it.

Mikrotik's current implementation of VRFs in indeed lacking in some (many) respects. One of the primary one is that the "main" vrf is a special case in many regards, including route leaking. Most firewall distributions, including commercial ones based on Linux, get around this limitation by simply not using main, but enclosing everything in a vrf, even when this is done implicitly. One example of this is having a "management" vrf for all of the router's internal functions. The other aspect in which Mikrotik is currently lacking is that there is currently no support for per-vrf conntrack tables.

Network namespaces is a different and much more extensive concept. They really create independent networks that have well defined points where they interface. As useful as they are (and as much as I like them), Mikrotik currently doesn't allow access to them outside of the very limited scope of containers.

I'm jut a bit baffled at the approach of saying that the firewall is an improper place to control who can talk to whom. That's exactly the point of having a firewall. If you don't need anything more advanced, take the readily available solution that's handed to you on a platter.

DarkHelmet · June 16, 2026, 4:19am

I can understand this, go with what is mature and works.

As I've come to find out, the VRF implementation is not great and isn't what true VRF/instances would be. I can understand why they have some of it, but it just doesn't make sense to sell it as VRF.

Since Mikrotik is just Linux, I'd wonder why they don't use NS for true VRF. Cisco has this with the VASI interfaces on XE, and NS would work the same.

This is a service provider network, and in such customers private networks should be separated by routing instances/VRFs/VPRNs what ever you call them. Makes it very easy to keep configs/firewalls/etc all under the VRF, and it fails open rather than closed in terms of different customers if you have to remove a firewall.

I suppose doing it all in the same instance with filters to keep it all isolated is an option, and may be the only option here. I'm testing a couple other things, but may go this way.

Would fasttrack work as expected in this case, so it doesn't need to be disabled?

CGGXANNX · June 16, 2026, 4:33am

In this case, VRF works fine with IPv6. You just need to properly set the gateway as I mentioned in the post above.

npeca75 · June 16, 2026, 4:39am

looks like you comming from another (net) world ... maybe cisco,or pure linux
then acousing MT that they FW is not good enough, and asking basic question about fasttrack ...
nice

yes, it will work

one of "good" roles for MT devices is vlan-for-each-customer & firewall & (ipv4) nat & v4/v6 fasttrack & L2 hw offload on one vlan filtered bridge

using this way many devices for years

DarkHelmet · June 16, 2026, 6:40am

There is one networking world, Cisco, Linux, Mikrotik, Juniper, Nokia, Arista, all produce kit to the standards. Some of it fails to meet those standards, sometimes spectacularly. My first exposure to Mikrotik was a customer trying to provision theirs on a circuit, circa 2008. We assigned it a /31 for V4, and it didn't support RFC 3021 /31 masks. I changed it to a /30 and moved on.

noted, thank you.

DarkHelmet · June 16, 2026, 6:41am

I can confirm your way did work, I tested it. However to make IPv4 work I had to disable fast-track or have just painfully slow IPv4. V6 worked great.

I ended up just doing as @lurker888 suggested, and keeping it all in the main instance/table. I setup some interface groups and a v6 rule as below. In testing this kept everything separate.

/ipv6 firewall filter
add action=drop chain=forward comment=APT1 in-interface-list=UNIT1 out-interface-list=!WAN

Thank much on this, I have this router as just something quiet on a wall with POE at a MDU. It's low power/fanless is the main reason I went with it.