I have /ipv6/settings set disable-ipv6=yes, but I noticed in /ipv6/addresses a(n invalid) dynamic link-local address on the wg1 interface.
I'm guessing this is an artefact of MikroTik defaulting the client-allowed-address field to ::/0.
Question 1: Do I have that right?
Self-answer 1 proposed: No, because I /interface/wireguard/peers/set {all} client-allowed-address=0.0.0.0/0 and then restarted the router, and the (invalid) IPv6 link-local address is still there.
Question 2: Okay, so, where is this (invalid, since IPv6 is "completely" disabled) IPv6 link-local address coming from?
Assertion 1: Wherever it's coming from, it's clumsy (or, worse) on MikroTik's part that this exists, because if IPv6 is truly /ipv6/settings/set disable=ipv6=yes then IPv6 should be, you know, disabled (and whatever might try to cause a link-local IPv6 address to be created should throw an error).
I checked some more and found another phantom IPv6 address created by a GRE tunnel. IPIP and EoIP didn't suffer the same problem. I tried deleting both this address and the one created by Wireguard and they both disappeared despite being listed as Dynamic.
@Znevna It gets us a little off-topic, but, yes, that would be a great world.
IPv6 is a necessary and fairly well-designed thing, but for small/ home networks (insert obligatory "then why are there multiple MikroTik devices, various VPNs, etc, etc in the environment" comments here) IPv6 is an unnecessary complication, so I also imagine the real, present world in which IPv6 CAN be disabled because it simply isn't needed.
I get wanting to keep a home network simple, but disabling IPv6 in the settings doesn't actually remove IPv6 from your network, it just blinds your router to it.
Everything in your network (Windows, iOS, Android, PRINTERS) has IPv6 enabled by default.
If you disable the stack on your MikroTik, those devices are still generating link-local addresses and talking to each other on Layer 2.
If a misconfigured device or rogue actor starts broadcasting IPv6 Router Advertisements, your devices will follow them, and your router will have zero visibility or ability to stop it.
The proper way to 'disable' IPv6 isn't to turn off the package. It's to leave it on and use /ipv6 firewall filter to explicitly drop all input and forward traffic.
That way, you maintain control and logging without the routing overhead.
@Znevna True .. -ish. In my particular case, my MikroTik routers are not border security devices, they're internal network service providers (e.g. DHCP) and VPN devices. The firewall rules that I have on these devices are really belt-and-suspenders to provide limited protection to each one of my MikroTik-VPN-connected local LANs from a network-hopping attack that might occur through another of my local LANs, but, really, I could leave the firewalls off and it wouldn't be a meaningfully different overall security posture.
So the fact that my devices (other than my MikroTik routers) may have their own secret IPv6 lives doesn't matter much to me, and at least in the case of the MikroTik routers, I'd rather just avoid the complexity.
Response from MikroTik support, about the fact that IPv6=disabled for WireGuard interface but a link-local IPv6 address is assigned anyway (SUP-226040):
Thank you for contacting MikroTik Support and for the report.
The problem has been registered and will be fixed in an upcoming RouterOS version.
doesn't matter much to me, and at least in the case of the MikroTik routers, I'd rather just avoid the complexity.