(I am likely missing something quite basic, so I wanted more eyes on this problem to catch what I did wrong.)
I have a functional environment with a switch, a router, and an ISP-provided gateway to which I want to add IPv6. I have three VLANs with the following routes (actual addresses altered for privacy):
All DHCP is handled by the router, which connects to the gateway via ether1. All clients connect directly to the switch, and their packets come in over the various VLAN interfaces. When I configured IPv6, I set an address for the router using the advertised prefix (which I previously misidentified as SLAAC) and configured the following routes:
The link-local address that is the gateway for ::/0 is the gateway provided by my ISP. Traffic leaving the router over ether1 passes to the Internet and back without trouble as I confirmed via ping. However, traffic from COMMON_VLAN never makes it past the router. A packet capture on the router shows the packets entering from COMMON_VLAN with the correct destination address, but I never see them leaving via ether1. The counters for the drop actions in the router’s IPv6 firewall filter do not increase, so I assume these packets are not being blocked there. Also, all VLAN interfaces are allowed access to the WAN:
12 ;;; VLAN Internet access
chain=forward action=accept connection-state=new in-interface-list=VLAN out-interface-list=WAN
I am certain this problem has to do with my route configuration, but I do not see where I went wrong.
So client machines, connected to COMMON_VLAN, autoconfigure with IPv6 addresses from correct prefix? Also verify that they have correctly autoconfigured IPv6 routes …
Other than that: you’re surely aware that IPv6 firewall is in its own configuration subtree under /ipv6 firewall …
Yes, I checked each client from which I tested. They all have IPv6 addresses configured with the correct prefix. Also, the firewall entry I pasted came from
I know it’s a default setting, but does forward under /ipv6 settings show yes? Because if it does, the router should not acquire its own visible IPv6 address using SLAAC. Maybe I just haven’t understood properly what you wrote about SLAAC?
@sindy, you’re probably right … if one sets router’s address directly, then /ipv6 address print will show only “G” in the flags column … definitely not a “D”. But then … if router got its own IPv6 address through SLAAC, who’s announcing the prefix? Some other device in the same network?
I’m anything but an IPv6 expert, but routers should not use SLAAC to configure their own addresses. A Mikrotik router can get its own one via SLAAC even if set up as a router if you insist (through setting accept-router-advertisements to yes rather than yes-if-forwarding-disabled), but it won’t be shown by /ipv6 address print at all. So I was assuming the upstream router to announce the prefix; eventual other device in the same network would have to be a router too to announce a prefix. But as said, I may have completely misunderstood the sentence regarding SLAAC.
You probably did not misread the sentence (or not completely at least). Something is fishy about that IPv6 address…
On my (working) IPv6 router I have addresses set like this:
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local
# ADDRESS FROM-POOL INTERFACE ADVERTISE
0 DL fe80::1:59d4:1e1e/64 ipip-target1 no
1 DL fe80::1:bce6:d79d/64 ipip-target2 no
2 G 2a00:XXX:YYY:ABC::1:0/64 vlan-42 yes
3 G 2a00:XXX:YYY:DEF:b869:f4ff:fe20:a549/64 pool-ipv6 vlan-41 yes
4 G 2a00:XXX:YYY:GHI:b869:f4ff:fe20:a549/64 pool-ipv6 vlan-40 yes
5 DL fe80::b869:f4ff:fe20:a549/64 vlan-99 no
6 DL fe80::b869:f4ff:fe20:a549/64 vlan-40 no
7 DL fe80::b869:f4ff:fe20:a549/64 bridge no
8 DL fe80::b869:f4ff:fe20:a549/64 vlan-41 no
9 DL fe80::b869:f4ff:fe20:a549/64 vlan-42 no
10 DL fe80::b869:f4ff:fe20:a549/64 vlan-2 no
11 DL fe80::e68d:8cff:fec6:11c9/64 cap1 no
12 DL fe80::e/64 pppoe-out1 no
(the first two lines are IPv4 IPIP tunnels and don’t actually pass any IPv6 traffic. And I don’t care about that.
(I’m not entirely sure I actually set that seudo-random postfix on the last two lines myself, could well be result of setting eui-64=yes). BTW, pool-ipv6 gets “topped up” by DHCPv6 client, which delivers a /56 prefix.
As could clearly be seen, none of addresses have “A” or “D” in the flags column.
That could be part of the problem. I disabled accept-redirects per the note in https://wiki.mikrotik.com/wiki/Manual:IPv6/Settings, but I did not change forward. To clarify what I said about SLAAC (which could be wrong):
# ADDRESS FROM-POOL INTERFACE ADVERTISE
0 DL fe80::4a8f:5aff:fe6a:4767/64 COMMON_VLAN no
1 DL fe80::4a8f:5aff:fe6a:4767/64 bridge no
2 DL fe80::4a8f:5aff:fe6a:4767/64 PVTIO_VLAN no
3 DL fe80::4a8f:5aff:fe6a:4767/64 BASE_VLAN no
4 DL fe80::4a8f:5aff:fe6a:4766/64 ether1 no
5 G 2600:1700:0001:000f:xxxx:xxxx:xxxx:xxxx/64 COMMON_VLAN yes
These are the IPv6 addresses for the router. It picked up the prefix from the gateway and then I added an address with
This is how I understand IPv6: there are a few ways of how devices end up having IPv6 addresses:
SLAAC … which can work if there’s a router broadcasting Router Advertisements … those include prefix and gateway’s IPv6 address. Devices, receiving these RAs, construct a pseudo-random IPv6 address which conforms received prefix, the rest is “made up”.
static IPv6 assignment, where network administrator sets IPv6 address, making sure it is adhering to same prefix as router.
DHCPv6 … where there’s a DHCPv6 server in L2 network, assigning addresses to DHCPv6 clients in (semi)controlled manner. It will pass additional configuration (which RAs typically don’t), such as NDS servers, NTP servers, etc.
usually DHCPv6 serves addresses (to end devices)
sometimes DHCPv6 serves prefixes (to lower-tier routers)
So it seems your router receives IPv6 address via RA from ISPs router. However this doesn’t mean the whole prefix is yours to use in LAN, upstream router is expecting to deliver packets, destined to any host in given prefix, directly (same as IPv4 subnets).
Proper way is to obtain a prefix using DHCPv6 client, that way you can use prefix (or multiple, depending the prefix length you get from upstream) for LAN uses.
So try to run DHCPv6 client on WAN interface, request a prefix and store result in address pool. After a while check the status (/ipv6 dhcp-client print).
I am not quite certain what I did, but this is now working. I will spend tonight picking apart the setup to see what I did wrong. Thank you for your help!
Just one remark, it’s good idea to mention what info you got from ISP, config, etc. I don’t see it in original post.
People sometimes say they got IPv6 from ISP, but it doesn’t work, so they try all kinds of crazy things with routes, DHCPv6 and whatnot, mixing made up static config with dynamic, etc. Only to finally find out that it can’t work, because ISP just enabled IPv6 on their modem/router and there’s only autoconfiguration for directly connected devices, but no way how to get it behind another router. Probably not your case, when it started to work. But it’s important to provide as much info as possible, to avoid exploring dead ends.