Hi,
Yes, Noob on Mikrotik but not given up yet.
After really weeks of trial and error, partial success but not applicable to my problem, I desperately open this topic here.
What I want to achieve is that I have all ipv6 traffic running through the tunnelbroker and ipv4 through the ISPs router.
On a vlan (2500) want to get ipv6 addresses for the clients.
There are limitations which lead to the actual intended solution. The ISPs does not provide any ipv6 support and is not able to route any. So only ipv4 traffic.
There is no possible way to use the ISP router as bridge. The "so called"public ip address is not reachable from outside. Even if it is in an public and not a private address (No Ping).
The openvpn-client is configured and seems to work somehow.
-I get an ipv6 address on the interface.2a05:AAAA:BBBB:CCCC:DDDD::2 and is pingable
-I know the gateway address 2a05:AAAA:BBBB:CCCC:DDDD::1 which is not pingable
-Packets are exchanged in the tunnel visible in the openvpn status.
It should be a trivial problem but… The problem sits as always between keyboard and chair who hopes to find some experts.
And for other problems: Yes, it is a WIP.
I tried to make a more comprehensible picture.
Actual Configuration:
# 2023-06-28 22:04:35 by RouterOS 7.10
# software id = **ELIDED**
#
# model = CRS309-1G-8S+
# serial number = **ELIDED**
/interface bridge
add name="WanBridge v4000"
add admin-mac=48:A9:8A:94:A7:59 auto-mac=no name=v1bridge
add name="v10bridge (internal)"
add name="v99bridge (mgmt)"
add name="v2000bridge (DMZ1)"
add name="v2500bridge (DMZ2)"
add name="v3000bridge (Labor)"
/interface ethernet
set [ find default-name=ether1 ] name=e1
set [ find default-name=sfp-sfpplus1 ] name=s1
set [ find default-name=sfp-sfpplus2 ] name=s2
set [ find default-name=sfp-sfpplus3 ] auto-negotiation=no name=s3
set [ find default-name=sfp-sfpplus4 ] auto-negotiation=no name=s4 \
rx-flow-control=auto speed=10Gbps tx-flow-control=auto
set [ find default-name=sfp-sfpplus5 ] auto-negotiation=no name=s5 speed=\
10Gbps
set [ find default-name=sfp-sfpplus6 ] auto-negotiation=no name=s6 speed=\
10Gbps
set [ find default-name=sfp-sfpplus7 ] auto-negotiation=no name=s7 speed=\
10Gbps
set [ find default-name=sfp-sfpplus8 ] advertise=\
1000M-full,10000M-full,2500M-full,5000M-full name=s8wan
/interface vlan
add interface=e1 name=e1v99 vlan-id=99
add interface=s3 name=s3v10 vlan-id=10
add interface=s3 name=s3v2000 vlan-id=2000
add interface=s3 name=s3v2500 vlan-id=2500
add interface=s3 name=s3v3000 vlan-id=3000
add interface=s3 name=s3v4000 vlan-id=4000
add interface=s4 name=s4v10 vlan-id=10
add interface=s4 name=s4v2000 vlan-id=2000
add interface=s4 name=s4v2500 vlan-id=2500
add interface=s4 name=s4v3000 vlan-id=3000
add interface=s4 name=s4v4000 vlan-id=4000
add interface=s5 name=s5v10 vlan-id=10
add interface=s5 name=s5v2000 vlan-id=2000
add interface=s5 name=s5v2500 vlan-id=2500
add interface=s5 name=s5v3000 vlan-id=3000
add interface=s5 name=s5v4000 vlan-id=4000
add interface=s6 name=s6v10 vlan-id=10
add interface=s6 name=s6v2000 vlan-id=2000
add interface=s6 name=s6v2500 vlan-id=2500
add interface=s6 name=s6v3000 vlan-id=3000
add interface=s7 name=s7v2000 vlan-id=2000
add interface=s7 name=s7v2500 vlan-id=2500
add interface=s7 name=s7v3000 vlan-id=3000
add interface=s7 name=s7v4000 vlan-id=4000
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_v1pool ranges=192.168.0.100-192.168.0.220
add name="dhcp_v2500(DMZ2)pool" ranges=10.20.0.100-10.20.255.220
/ip dhcp-server
add address-pool=dhcp_v1pool interface=v1bridge name=dhcp_v1bridge
add address-pool="dhcp_v2500(DMZ2)pool" interface="v2500bridge (DMZ2)" name=\
"dhcp_v2500bridge (DMZ2)"
/ipv6 pool
add name=pool40 prefix=2a05:AAAA:BBBB:CCCC:DDDD:40::/90 prefix-length=90
add name=pooltb6 prefix=2a05:AAAA:BBBB:CCCC:DDDD::/80 prefix-length=80
/port
set 0 name=serial0
/ppp profile
add bridge-learning=yes dhcpv6-pd-pool=pool40 name=profile_6project \
remote-ipv6-prefix-pool=pooltb6 use-compression=no use-ipv6=required
add name=profile2
/interface ovpn-client
add certificate=6project_client cipher=aes256-cbc comment=\
"6project Tunnelbroker" connect-to=tb.6project.org mac-address=\
02:E0:80:9F:73:50 name=6project.org port=19000 profile=profile_6project \
protocol=udp user=nobody verify-server-certificate=yes
/interface bridge port
add bridge=v1bridge interface=e1
add bridge="WanBridge v4000" comment=WAN interface=s8wan
add bridge="v10bridge (internal)" interface=s3v10
add bridge="v10bridge (internal)" interface=s4v10
add bridge="v10bridge (internal)" interface=s5v10
add bridge="v10bridge (internal)" interface=s6v10
add bridge="v99bridge (mgmt)" interface=e1v99
add bridge="v2000bridge (DMZ1)" interface=s3v2000
add bridge="v2000bridge (DMZ1)" interface=s4v2000
add bridge="v2000bridge (DMZ1)" interface=s5v2000
add bridge="v2000bridge (DMZ1)" interface=s6v2000
add bridge="v2000bridge (DMZ1)" interface=s7v2000
add bridge="v2500bridge (DMZ2)" interface=s3v2500
add bridge="v2500bridge (DMZ2)" interface=s4v2500
add bridge="v2500bridge (DMZ2)" interface=s5v2500
add bridge="v2500bridge (DMZ2)" interface=s6v2500
add bridge="v2500bridge (DMZ2)" interface=s7v2500
add bridge="v3000bridge (Labor)" interface=s3v3000
add bridge="v3000bridge (Labor)" interface=s4v3000
add bridge="v3000bridge (Labor)" interface=s5v3000
add bridge="v3000bridge (Labor)" interface=s6v3000
add bridge="v3000bridge (Labor)" interface=s7v3000
add bridge="WanBridge v4000" interface=s3v4000
add bridge="WanBridge v4000" interface=s4v4000
add bridge="WanBridge v4000" interface=s5v4000
add bridge="WanBridge v4000" interface=s7v4000
/ipv6 settings
set accept-router-advertisements=yes forward=no
/interface detect-internet
set detect-interface-list=all internet-interface-list=all
/interface list member
add interface="WanBridge v4000" list=WAN
add interface=v1bridge list=LAN
add interface="v99bridge (mgmt)" list=LAN
/ip address
add address=10.100.0.1/16 interface="v99bridge (mgmt)" network=10.100.0.0
add address=10.0.100.254/16 interface="v10bridge (internal)" network=10.0.0.0
add address=10.10.100.254/16 interface="v2000bridge (DMZ1)" network=10.10.0.0
add address=10.20.0.1/16 interface="v2500bridge (DMZ2)" network=10.20.0.0
add address=10.30.0.1/16 interface="v3000bridge (Labor)" network=10.30.0.0
add address=192.168.0.1/24 interface=v1bridge network=192.168.0.0
/ip dhcp-client
add interface="WanBridge v4000"
/ip dhcp-server network
add address=10.20.0.0/16 dns-server=9.9.9.9,149.112.112.112,192.168.2.1 \
gateway=10.20.0.1
add address=192.168.0.0/24 dns-server=9.9.9.9,149.112.112.112,192.168.2.1 \
gateway=192.168.0.1
/ip dns
set allow-remote-requests=yes servers=\
9.9.9.9,149.112.112.112,2620:fe::fe,2620:fe::9
/ip firewall filter
add action=accept chain=input comment="20230621 FP Access from 10.20.0.0/16 " \
src-address=10.20.0.0/16
add action=accept chain=input comment="20230621 FP Access from vlan 2500" \
in-interface="v2500bridge (DMZ2)"
add action=accept chain=input comment="Temp: Access Nils" disabled=yes \
in-interface="ovpn-out1 Nils"
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment=\
"Forwarding Rule DMZ2 to White Zone (20230618)" in-interface=\
"v2500bridge (DMZ2)" log=yes out-interface="WanBridge v4000"
add action=accept chain=forward comment=\
"Forwarding Rule Router to White Zone (20230619)" in-interface=v1bridge \
out-interface="WanBridge v4000"
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="Inter-Vlan communication blocking" \
in-interface-list=!WAN out-interface-list=!WAN
add action=accept chain=input comment="20230621 FP Access from 10.20.0.0/16 " \
src-address=10.20.0.0/16
add action=accept chain=input comment="20230621 FP Access from vlan 2500" \
in-interface="v2500bridge (DMZ2)"
add action=accept chain=input comment="Temp: Access Nils" disabled=yes \
in-interface="ovpn-out1 Nils"
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment=\
"Forwarding Rule DMZ2 to White Zone (20230618)" in-interface=\
"v2500bridge (DMZ2)" log=yes out-interface="WanBridge v4000"
add action=accept chain=forward comment=\
"Forwarding Rule Router to White Zone (20230619)" in-interface=v1bridge \
out-interface="WanBridge v4000"
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="Inter-Vlan communication blocking" \
in-interface-list=!WAN out-interface-list=!WAN
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=\
"WanBridge v4000"
add action=masquerade chain=srcnat disabled=yes log=yes out-interface=\
"WanBridge v4000" src-address=10.20.0.0/16
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=\
"WanBridge v4000"
add action=masquerade chain=srcnat disabled=yes log=yes out-interface=\
"WanBridge v4000" src-address=10.20.0.0/16
/ipv6 route
add check-gateway=ping disabled=no distance=1 dst-address=::/0 gateway=\
2a05:AAAA:BBBB:CCCC:DDDD::1 routing-table=main scope=30 target-scope=10
/ipv6 address
add address=2a05:AAAA:BBBB:CCCC:DDDD::2/80 advertise=no interface=6project.org
/ipv6 firewall mangle
add action=passthrough chain=prerouting comment=\
";;; special dummy rule to show fasttrack counters"
add action=passthrough chain=forward comment=\
";;; special dummy rule to show fasttrack counters"
add action=passthrough chain=prerouting comment=\
";;; special dummy rule to show fasttrack counters"
add action=passthrough chain=forward comment=\
";;; special dummy rule to show fasttrack counters"
/ipv6 nd
set [ find default=yes ] interface="v2500bridge (DMZ2)"
/system clock
set time-zone-name=Europe/Zurich
/system note
set show-at-login=no
/system routerboard settings
set boot-os=router-os