Hello folks,
I bought a CCR for evaluation and am currently faced with some problems regarding ipv6 forwarding. But first, some facts about our network:
We are a University in Germany and are currently evaluating to switch to mikrotik products for smaller subdevisions and for the associated dorms.
Until now we only used them as ipv4 Nat-routers which worked like a charm. As of last week I wanted to test their abilities regarding ipv6. We have a pulicly routed ipv6 net at hand so I just need them to forward the traffic to our core router.
This also worked like a charm. Here is the config:
/ipv6 address
add address=2001:7c0:900:c4:b9:7e:dfdd:f002 advertise=no interface=outside
add address=2001:7c0:900:10c4::1 interface=inside
/ipv6 dhcp-server
add address-pool=whm-dhcpv6 authoritative=yes disabled=no interface=inside lease-time=1w name=whm-dhcpv6
/ipv6 pool
add name=whm-dhcpv6 prefix=2001:7c0:900:10c4::/64 prefix-length=64
/ipv6 firewall filter
add chain=input comment="Allow established connections" connection-state=established
add chain=input comment="Allow related connections" connection-state=related
add chain=input comment="Allow limited ICMP" limit=50/5s,5 protocol=icmpv6 src-address-list=allowed_wildcard
add chain=input comment="Allow UDP" protocol=udp
add chain=input in-interface=inside
add action=drop chain=input disabled=yes
add chain=forward protocol=icmpv6
add chain=forward comment="Allow established connections" connection-state=established
add chain=forward comment="Allow related connections" connection-state=related
add chain=forward comment="Allow any to internet" out-interface=outside
add action=drop chain=forward
/ipv6 route
add distance=1 gateway=2001:7c0:900:c4:b9:7e:dfdd:f001
As soon as I enable the filter rule “drop all” in the input chain no more ipv6 traffic is forwarded to the inside of the network. This is somewhat confusing as I thought that packets passing through the router were not processed by this chain.
Can anybody give me a hint on what I am doing wrong?
Note: stateless dhcpv6 is explicitly wanted!