IPv6 trafic blocked on SwOS

SwOS
1

I recently upgraded my EdgeRouter Lite 24 to CSS326-24G-2S+RM, running 2.0 (built at Tue Oct 18 2016 14:57:22 GMT+0300 (EEST))

I can ping with IPv6 but http(s) doesn’t work. With devices connected through the Mikrotik (v4 and v6 ping to http://www.funet.fi work, only v4 https to http://www.ripe.net works):

root@dns:/tmp# ping http://www.funet.fi
PING http://www.funet.fi (193.166.3.7) 56(84) bytes of data.
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=1 ttl=246 time=8.93 ms
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=2 ttl=246 time=11.0 ms
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=3 ttl=246 time=9.53 ms
^C
— http://www.funet.fi ping statistics —
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 8.937/9.843/11.062/0.902 ms
root@dns:/tmp# ping6 -n http://www.funet.fi
PING http://www.funet.fi(2001:708:10:9::20:7) 56 data bytes
64 bytes from 2001:708:10:9::20:7: icmp_seq=1 ttl=55 time=10.8 ms
64 bytes from 2001:708:10:9::20:7: icmp_seq=2 ttl=55 time=10.9 ms
64 bytes from 2001:708:10:9::20:7: icmp_seq=3 ttl=55 time=10.0 ms
^C
— http://www.funet.fi ping statistics —
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 10.071/10.617/10.967/0.409 ms
root@dns:/tmp# wget -6 https://www.ripe.net/
–2017-04-15 22:18:26-- https://www.ripe.net/
Resolving http://www.ripe.net (http://www.ripe.net)… 2001:67c:2e8:22::c100:68b
Connecting to http://www.ripe.net (http://www.ripe.net)|2001:67c:2e8:22::c100:68b|:443… ^C
root@dns:/tmp# wget -4 https://www.ripe.net/
–2017-04-15 22:18:35-- https://www.ripe.net/
Resolving http://www.ripe.net (http://www.ripe.net)… 193.0.6.139
Connecting to http://www.ripe.net (http://www.ripe.net)|193.0.6.139|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: 88455 (86K) [text/html]
Saving to: ‘index.html.5’

index.html.5 100%[==============================================================================>] 86.38K --.-KB/s in 0.09s

2017-04-15 22:18:35 (1010 KB/s) - ‘index.html.5’ saved [88455/88455]

If I simply switch the cables to the old EdgeSwitch, everything works fine:

root@dns:/tmp# ping http://www.funet.fi
PING http://www.funet.fi (193.166.3.7) 56(84) bytes of data.
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=1 ttl=246 time=10.3 ms
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=2 ttl=246 time=10.7 ms
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=3 ttl=246 time=9.75 ms
64 bytes from http://www.funet.fi (193.166.3.7): icmp_seq=4 ttl=246 time=10.8 ms
^C
— http://www.funet.fi ping statistics —
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 9.759/10.404/10.833/0.434 ms
root@dns:/tmp# ping6 -n http://www.funet.fi
PING http://www.funet.fi(2001:708:10:9::20:7) 56 data bytes
64 bytes from 2001:708:10:9::20:7: icmp_seq=1 ttl=55 time=10.4 ms
64 bytes from 2001:708:10:9::20:7: icmp_seq=2 ttl=55 time=10.0 ms
64 bytes from 2001:708:10:9::20:7: icmp_seq=3 ttl=55 time=10.8 ms
^C
— http://www.funet.fi ping statistics —
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 10.007/10.444/10.851/0.364 ms
root@dns:/tmp# wget -6 https://www.ripe.net/
–2017-04-15 22:15:49-- https://www.ripe.net/
Resolving http://www.ripe.net (http://www.ripe.net)… 2001:67c:2e8:22::c100:68b
Connecting to http://www.ripe.net (http://www.ripe.net)|2001:67c:2e8:22::c100:68b|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: 88455 (86K) [text/html]
Saving to: ‘index.html.3’

index.html.3 100%[==============================================================================>] 86.38K --.-KB/s in 0.1s

2017-04-15 22:15:50 (813 KB/s) - ‘index.html.3’ saved [88455/88455]

root@dns:/tmp# wget -4 https://www.ripe.net/
–2017-04-15 22:15:52-- https://www.ripe.net/
Resolving http://www.ripe.net (http://www.ripe.net)… 193.0.6.139
Connecting to http://www.ripe.net (http://www.ripe.net)|193.0.6.139|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: 88455 (86K) [text/html]
Saving to: ‘index.html.4’

index.html.4 100%[==============================================================================>] 86.38K --.-KB/s in 0.1s

2017-04-15 22:15:52 (835 KB/s) - ‘index.html.4’ saved [88455/88455]


I also tested ipv6 ssh within my LAN and I don’t see any ssh packets at the destination host, v6 ping works just fine.

It seems that SwOS on this switch isn’t passing anything but icmpv6 through (well, only tcpv6 tested).

2

Try with the latest SwOS 2.0 for CSS326 build from https://mikrotik.com/download
You already have 2.0, but I think there is a newer build available

3

Thanks!

Upgraded to “2.0 (built at Thu Jan 26 2017 13:43:16 GMT+0200 (EET))” and now IPv6 works just fine!

root@dns:/tmp# wget -6 www.ripe.net.
–2017-04-17 17:51:03-- http://www.ripe.net./
Resolving www.ripe.net. (www.ripe.net.)… 2001:67c:2e8:22::c100:68b
Connecting to www.ripe.net. (www.ripe.net.)|2001:67c:2e8:22::c100:68b|:80… connected.
HTTP request sent, awaiting response… 301 Moved Permanently
Location: https://www.ripe.net/ [following]
–2017-04-17 17:51:03-- https://www.ripe.net/
Resolving www.ripe.net (www.ripe.net)… 2001:67c:2e8:22::c100:68b
Connecting to www.ripe.net (www.ripe.net)|2001:67c:2e8:22::c100:68b|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: 88455 (86K) [text/html]
Saving to: ‘index.html.8’

index.html.8 100%[==================================================================================>] 86.38K --.-KB/s in 0.09s

2017-04-17 17:51:04 (1004 KB/s) - ‘index.html.8’ saved [88455/88455]

root@dns:/tmp# wget -4 www.ripe.net.
–2017-04-17 17:51:08-- http://www.ripe.net./
Resolving www.ripe.net. (www.ripe.net.)… 193.0.6.139
Connecting to www.ripe.net. (www.ripe.net.)|193.0.6.139|:80… connected.
HTTP request sent, awaiting response… 301 Moved Permanently
Location: https://www.ripe.net/ [following]
–2017-04-17 17:51:08-- https://www.ripe.net/
Resolving www.ripe.net (www.ripe.net)… 193.0.6.139
Connecting to www.ripe.net (www.ripe.net)|193.0.6.139|:443… connected.
HTTP request sent, awaiting response… 200 OK
Length: 88455 (86K) [text/html]
Saving to: ‘index.html.9’

index.html.9 100%[==================================================================================>] 86.38K --.-KB/s in 0.1s

2017-04-17 17:51:08 (820 KB/s) - ‘index.html.9’ saved [88455/88455]