Let me start by saying that I have searched and spent hours on this on my own, but being such a novice in networks has hindered my ability to get this up and running. I’m sorry if this is a stupid or redundant post.
I have a really simple IPv4 network up and running and now I’m working on getting IPv6 working. My ISP provides IPv6 using either 6in4 or 6rd tunnels. I’d prefer to set this up using Winbox if possible.
Here are my current interfaces:
My ISP provide the following information:
If you have a different, IPv6RD capable device, you can configure it to use 6RD with the following settings:
6RD prefix: 2602:240::/28
6RD Endpoint: 184.23.144.1
I think I need to do the following:
- Add 6to4 tunnel interface with MTU of 1280 and Remote Address 184.23.144.1
- Add IPv6 Address 2602:240::/28 on Interface 6to4 tunnel
- Add IPv6 Address to bridge Interface for LAN? I’m not sure about this.
- Add IPv6 DNS servers
- ???
Obviously this didn’t work, but I’m not sure why. IPv6 isn’t being given out on the LAN. The problem I think I’m having is getting the IPv6 Address List, IPv6 Route List, and IPv6 Pool.
Hello, the information seems incomplete. You’ll need to get the IPv4 subnet associated to the 6RD server.
Then calculate the IPv6 prefix using https://alephs.org/6rdcalc.html.
Enter number (32-mask) in “using … bits” field.
Add 6rd interface
/interface 6to4
add !keepalive name=6rd remote-address=184.23.144.1
Assigning an address to the lan interface is enough to make RA work.
(Use the calculcated 6rd prefix!)
/ipv6 address
add address=2012:34:56:7800::1 interface=bridge
Make sure firewall is adequate (check /system default-configuration print).
/ipv6 firewall {
address-list add list=bad_ipv6 address=::/128 comment="defconf: unspecified address"
address-list add list=bad_ipv6 address=::1 comment="defconf: lo"
address-list add list=bad_ipv6 address=fec0::/10 comment="defconf: site-local"
address-list add list=bad_ipv6 address=::ffff:0:0/96 comment="defconf: ipv4-mapped"
address-list add list=bad_ipv6 address=::/96 comment="defconf: ipv4 compat"
address-list add list=bad_ipv6 address=100::/64 comment="defconf: discard only "
address-list add list=bad_ipv6 address=2001:db8::/32 comment="defconf: documentation"
address-list add list=bad_ipv6 address=2001:10::/28 comment="defconf: ORCHID"
address-list add list=bad_ipv6 address=3ffe::/16 comment="defconf: 6bone"
address-list add list=bad_ipv6 address=::224.0.0.0/100 comment="defconf: other"
address-list add list=bad_ipv6 address=::127.0.0.0/104 comment="defconf: other"
address-list add list=bad_ipv6 address=::/104 comment="defconf: other"
address-list add list=bad_ipv6 address=::255.0.0.0/104 comment="defconf: other"
filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=input action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
filter add chain=input action=accept protocol=udp port=33434-33534 comment="defconf: accept UDP traceroute"
filter add chain=input action=accept protocol=udp dst-port=546 src-address=fe80::/10 comment="defconf: accept DHCPv6-Client prefix delegation."
filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
filter add chain=input action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
filter add chain=input action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
filter add chain=input action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=forward action=drop src-address-list=bad_ipv6 comment="defconf: drop packets with bad src ipv6"
filter add chain=forward action=drop dst-address-list=bad_ipv6 comment="defconf: drop packets with bad dst ipv6"
filter add chain=forward action=drop protocol=icmpv6 hop-limit=equal:1 comment="defconf: rfc4890 drop hop-limit=1"
filter add chain=forward action=accept protocol=icmpv6 comment="defconf: accept ICMPv6"
filter add chain=forward action=accept protocol=139 comment="defconf: accept HIP"
filter add chain=forward action=accept protocol=udp dst-port=500,4500 comment="defconf: accept IKE"
filter add chain=forward action=accept protocol=ipsec-ah comment="defconf: accept ipsec AH"
filter add chain=forward action=accept protocol=ipsec-esp comment="defconf: accept ipsec ESP"
filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept all that matches ipsec policy"
filter add chain=forward action=drop in-interface-list=!LAN comment="defconf: drop everything else not coming from LAN"
}
Add a default route.
/ipv6 route
add distance=1 dst-address=2000::/3 gateway=6rd
IPv4 DNS is sufficient for AAAA records.