I just bought a Mikrotik hex router and now I have a problem with it when configuring ipv6 network.
I have a 2a02:2340:1203::/48 network which is routed to routing network 2a02:2340:1200::/64
My address in that network is 2a02:2340:1200::1203/64 and ISP:s side is 2a02:2340:1200::1.
I take 1 /64 subnet from that /48 network and configured it to the brigde (lan) side.
[@RouterOS] > ipv6 address print
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local
# ADDRESS FROM-POOL INTERFACE ADVERTISE
0 DL fe80::4aa9:8aff:fec6:aaf4/64 bridge no
1 DL fe80::4aa9:8aff:fec6:aaf3/64 ether1 no
2 G 2a02:2340:1200::1203/64 ether1 no
3 G 2a02:2340:1203::1/64 bridge yes
[@RouterOS] > ipv6 route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable
# DST-ADDRESS GATEWAY DISTANCE
0 A S ::/0 2a02:2340:1200::1 1
1 ADC 2a02:2340:1200::/64 ether1 0
2 ADC 2a02:2340:1203::/64 bridge 0
I can ping the gateway or google from the router and bridge side ip from client but cannot ping gateway or google from client or client from router ether1 interface
[@RouterOS] > ping 2a02:2340:1200::1 interface=ether1
SEQ HOST SIZE TTL TIME STATUS
0 2a02:2340:1200::1 56 64 1ms echo reply
1 2a02:2340:1200::1 56 64 1ms echo reply
2 2a02:2340:1200::1 56 64 1ms echo reply
sent=3 received=3 packet-loss=0% min-rtt=1ms avg-rtt=1ms max-rtt=1ms
[@RouterOS] > ping 2a00:1450:4026:802::200e interface=ether1
SEQ HOST SIZE TTL TIME STATUS
0 2a00:1450:4026:802::200e 56 58 4ms echo reply
1 2a00:1450:4026:802::200e 56 58 4ms echo reply
sent=2 received=2 packet-loss=0% min-rtt=4ms avg-rtt=4ms max-rtt=4ms
C:\Users\xxx>ping 2a02:2340:1203::1
Pinging 2a02:2340:1203::1 with 32 bytes of data:
Reply from 2a02:2340:1203::1: time<1ms
Reply from 2a02:2340:1203::1: time<1ms
Reply from 2a02:2340:1203::1: time<1ms
Ping statistics for 2a02:2340:1203::1:
Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\Users\xxxxx>ping 2a02:2340:1200::1
Pinging 2a02:2340:1200::1 with 32 bytes of data:
Control-C
^C
[@RouterOS] > ping 2a02:2340:1203::1 interface=ether1
SEQ HOST SIZE TTL TIME STATUS
0 2a02:2340:1203::1 timeout
sent=1 received=0 packet-loss=100%
It seems to be some kind of routing issue because outside access works in both directions. Traffic stops when it tries to go from bridge to ether1 or thw other way around. What I am missing? Can you help?
You should check IPv6 firewall rules (or post them here for us to help you assessing them). Bridge and ether1 are two interfaces of same device and traffic doesn’t go from one side to another side if the end destination is one of router’s own IPv6 addresses, it’s handled by same CPU entity … passing via chain=input (or chain=output if traffic is actually initiated by router itself).
Which makes me wonder why this issue bothers you so much? What is actual problem?
I did not explain the problem clear enough. The problem is that my client cannot access to the internet using ipv6 and cannot figure out why is that. The topology of the network is like this:
client ↔ LAN ↔ router ↔ routing network ↔ internet
client
2a02:2340:1203:0:4eda:9a85:ced6:4686/64
|
LAN - 2a02:2340:1203/64
|
interface Bridge: 2a02:2340:1203::1
Router
interface Ether1: 2a02:2340:1200::1203
|
GW:2a02:2340:1200::1
Routing Network
|
Internet
I can ping internet and gateway from the router and client from the router but not internet from the client.
More information to this. So the router forwards the traffic out to the internet. Here is a capture from target server. It sees the traffic and sends it back
IPv4 fasttrack should not affect IPv6 traffic in any way.
The return ICMPv6 packets should be allowed by first rule for chain=forward (allow established,related). However, if those would be dtopped, then you’d still see them on packet capture on ether1 … firewall drop comes later, router’s IPv6 stack (which does firewalling) is between ether1 and bridge. So this seems to be something upstream from your router (usually that’s ISP).