Ipv6 srcnat

RouterOS Beginner Basics
18

As @eltikpad has wrote, you've set ipv6-interface=bridge and that part appears to be working:

  • Your bridge interface has the /64 GUA prefix and advertise turned on.
  • The default route and the /64 route with the bridge as gateway is ok.
  • Your /ipv6 nd entry is ok for the bridge interface.

Now in theory, if you have devices on the bridge interface, they should have IPv6 addresses in the prefix range through SLAAC. Could please verify that?

With the firewall configuration however, which appears to be an old version of defconf, you have to make sure that the bridge interface is member of the LAN interface list, otherwise traffic from the client devices will not be forwarded to the internet (blocked by the last defconf filter rule at the bottom).

BUT: I also see that you have a vlan1 interface. What do you have on this interface? If vlan1 is the main interface where all your devices are attached too, then you would have to modify the APN to set ipv6-interface=vlan1 instead, and you would also have to add vlan1 to the LAN interface list! The /ipv6 nd entry also needs to be updated with the correct interface (you can create a copy and set the interface in the copy to vlan1).

As I wrote in the previous post, setting ipv6-internet in the APN setting only works for one single LAN interface. If you have multiple of them, the other interfaces will need to have other prefixes (such as ULA or the one from Hurricane Electric) manually added and NAT will need to be configured for those subnet.

About the "old defconf firewall" mention: The "defconf: accept UDP traceroute" rule from your screenshot still have port=33434-33534. This was a security hole has been corrected in the defconf firewall that comes with newer RouterOS version, that you can find here Buying - RB1100AHx4 Dude Edition - Questions about Firewall - #4 by rextended. The parameter has been changed to dst-port=33434-33534.