I have configured my RB951Ui-2nD to have a working HE.NET tunnelbroker. I am able to ping the outside IPv6 world from connected clients and Mikrotik allocates single IPv6s to them from the default /64 (I couldn’t figure out changing the commands to allocate /64s from the /48 which HE provide, so it’s sitting unused but I’ll bang my head with that at some later date).
Questions is: How to enable inbound ping to the public single IPv6 addresses which clients receive from /64 on the Mikrotik? Probably something in IPv6 firewall, but I don’t know. I have all default configuration.
I’m failing the ICMP test on ipv6-test.com and would like to get 20/20 just to brag to my ISP about how cool IPv6 is.
The default IPv6 firewall configuration (at least, in its current iteration) allows all ICMPv6 basically. You should find “accept” rules in both the input and forward chain for icmpv6. If you do not have those rules, you can create them.
C:\WINDOWS\system32>netsh advfirewall show allprofiles state
Domain Profile Settings:
State OFF
Private Profile Settings:
State OFF
Public Profile Settings:
State OFF
Ok.
Now I am able to ping the PC from outside, but the website still gives me 17/20 with ICMP blocked. Is there anything else I should allow in any firewall?
I am sorry - I didn’t get your hint. Which part of the router config should I post and how to print it out? Supout.rif file?
The test complains about the following:
“Your router or firewall is filtering ICMPv6 messages sent to your computer. An IPv6 host that cannot receive ICMP messages may encounter problems like some web pages loading partially or not at all.”
I don’t think you have dumb questions. And even if you did, it wouldn’t be big deal, especially in Beginners Basics forum.
Relevant part of config in this case would be “/ipv6 firewall”. But if ping works from another server, it’s probably ok. You can try to post it anyway. Use export command in terminal to get it (e.g. /ipv6 firewall export file=myipv6firewall).
You can also use packet sniffer to see what exactly is going on. Either on client device, or Tools->Packet sniffer on router. It would allow you to see what the remote server is sending, if client gets it, what it sends back in response, etc.
Router doesn’t assign IPv6 addresses, it’s different from IPv4. What you use now (because RouterOS currently doesn’t support anything else) is autoconfiguration (SLAAC). Router just announces available subnet and clients select addresses themselves. Originally they were derived from interface’s MAC address, so they stayed the same. But since that would allow tracking between different networks, they invented so-called Privacy Extensions, and in the end addresses are pretty much random, and on top of that changing all the time, because clients use multiple short-lived temporary addresses. It can be influenced by client config. There’s also DHCPv6, which may be a little more controllable, but even that doesn’t prevent clients from getting different temporary addresses. And RouterOS currently doesn’t support it for addresses, only DHCPv6-PD for prefixes.
