Just got my hap ac2 and I’m trying to get IPv6 to work. My ISP is providing a GPON with router function and I need to keep this online. They provide dual stack IP v4 & v6 as per the attached picture and the setup is: GPON (handles PPOE and DHCP server for MIKROTIK) ------> MIKROTIK HAP ac2 ------>LAN clients. (cascading dual NAT, I know!, I may consider switching the GPON to bridge and handling PPOE on the tik at a future time)
I’ve got IPv4 working ok but no IPv6 and I followed just about all the online guides as so:
After this I get IPv6 address on LAN connections but I cannot reach test-ipv6.com.
Please, help me understand what I’m doing wrong, I’m not ready to give up that easy
Tks.
You shouldn’t need “/ipv6 settings set accept-router-advertisements=yes”, you’ll get default route added by DHCPv6 client. It’s slightly non-standard, but when DHCPv6 server is same as gateway (which in this case should be), it’s ok.
In DHCPv6 client, request=prefix should be enough, upstream connection should work with just link-local address.
Your “/ipv6 dhcp-server” is useless (unless you’d want to connect yet another router behind hAP), it can’t provide addresses. But don’t worry, you can live without it, addresses will be (well, already are) handled by SLAAC (autoconfiguration).
But even with what you have now, things shouldn’t be broken, so you need to test what exactly is wrong. Start with traceroute to some IPv6 address on internet (e.g. 2a02:610:7501:3000::239, which belongs to forum.mikrotik.com), from both PC and hAP, and see what it does.
If it works from router, but it doesn’t work from device behind router, even though it seems to have address and everything, it looks like something wrong on router. Firewall would be good candidate, but I assume you didn’t touch it, or did you?
You can try to export your config:
/export hide-sensitive file=yourconfig
and post content of resulting yourconfig.rsc in code tags, maybe there will be something visibly wrong…
I don’t see any obvious problem. Try to examine what exactly happens. Start ping from client to internet and keep it going (there’s option -t for that) and check using Tools->Torch on ether1 that those packets passed through router. They should. Next thing you can try is to ping client’s address from outside. If you don’t have anything to test it with yourself, use some online ping service, there’s many of them. And then same thing, you should see incoming packets on ether1.
I guess it’s possible, because unlike with IPv4, DHCPv6 does not get gateway from server and device is supposed to get it from RA. I’m not sure if there’s some exception for prefix delegation and I’m not in the mood to read through RFCs. If accepting RAs helps, keep it that way.
Small problem is that if you enable it, router gets not only default route, but also SLAAC address, and unfortunately because of some limitation in current RouterOS, neither is shown anywhere. But router will surely use this address for outgoing traffic.
Try if traceroute from router still works when you manually specify source address as the one on bridge (2a02:…::1 from pool).
Looks like my ISP /64 prefix delegation is only working in the first layer of the LAN, were the GPON is. I have to switch it to bridge mode and do the ppoe on the tik.
