IPv6 how to use it right

RipperR · Thu Oct 10, 2019 12:36 pm

I've 6to4 tunel /48 subnet

I've setup it without DHCPv6 server.
I've connect directly Windows or UNIX machine it works well ... ip adress assign ...
If we got CPE Router like TPLINK(ipv6 ready) between RouterOS and end user ... we got problem router doesnt recive ipv6 declaration or dhcpv6 ip ...

Network logic

ipv6 tunnel give me /48 subnet xxxxx:8105::/48
i've split it to several /64 subnet per vlan

xxxxx:8105:100::/64

xxxxx:8105:200::/64

etc
goal that router recive or one ip and do some routing from internal network
or declarate sub net from

xxxxx:8105:100::/64

Maybe that logic is right but im not shure
recive /48
/54 per vlan
/64 per user

Sob · Thu Oct 10, 2019 5:06 pm

If you need to connect other routers with additional networks behind them, you need DHCPv6 server to give them prefixes to use (the one in RouterOS can do this). Other way is to use static config for everything, manually configure subnets on routers and add routes to them on main one.

Anumrak · Fri Oct 11, 2019 2:21 pm

Hey. TP-Link router have to support IPv6 SLAAC with RFC4941, so your windows and Linux machine does. You dont need dhcpv6 server.

Sob · Fri Oct 11, 2019 2:45 pm

But how does TP-Link get prefix from upstream?

Anumrak · Fri Oct 11, 2019 2:58 pm

But how does TP-Link get prefix from upstream?

Router won't receive the prefix, but he can route /48 with /64 static net that ISP have to provide.

Sob · Fri Oct 11, 2019 3:00 pm

That's what I mentioned as second option.

Anumrak · Fri Oct 11, 2019 3:02 pm

That's what I mentioned as second option.

I thought you talk about TP-Link's LAN, not uplink. Topic starter talked about his LAN.

StubArea51 · Fri Oct 11, 2019 5:25 pm

Here is an overview of IPv6 in MikroTik and how it goes from the BGP edge to the last mile with a customer handoff....it might be helpful.

The configs for the entire network are in the article.

https://www.stubarea51.net/2018/09/14/w ... your-wisp/

Ripper · Wed Oct 16, 2019 12:07 am

At many TP-link routers 1-2 year old with ipv6 support no SLAAC option just DHCPv6, PPPoE, Tunnel 6to4 and STATIC IP...
So as I've understand I have to declarate /56 for each end user router ?
As I don’t have SLAAC option at router I have to use Static V6 ip configuration

I've enter

IPv6 Address: I've Generate IP address from pool /64 or /56 at type it here
IPv6 Gateway: I've type there IPv6 address of Mikrotik Router from that vlan but it doesn’t accept it write error 51000 (default value ::)
MTU 1500
IPv6 Primary DNS 2001:4860:4860::8888
IPv6 Secondary DNS 2001:4860:4860::8844

LAN Type SLAAC
Prefix i give prefix from vlan SLAAC Mikrotik Configuration and Subnet Mask /64

Result Router seen at Ipv6 Neighbor list with mac address for 1-2 min then disappear...
Cant ping it cannot ping LAN address that display TP-LINK ROUTER
Mikrotik replay address unreachable...

Any advice ?

Anumrak · Wed Oct 16, 2019 10:55 am

At many TP-link routers 1-2 year old with ipv6 support no SLAAC option just DHCPv6, PPPoE, Tunnel 6to4 and STATIC IP...
So as I've understand I have to declarate /56 for each end user router ?
As I don’t have SLAAC option at router I have to use Static V6 ip configuration

I've enter

IPv6 Address: I've Generate IP address from pool /64 or /56 at type it here
IPv6 Gateway: I've type there IPv6 address of Mikrotik Router from that vlan but it doesn’t accept it write error 51000 (default value ::)
MTU 1500
IPv6 Primary DNS 2001:4860:4860::8888
IPv6 Secondary DNS 2001:4860:4860::8844

LAN Type SLAAC
Prefix i give prefix from vlan SLAAC Mikrotik Configuration and Subnet Mask /64

Result Router seen at Ipv6 Neighbor list with mac address for 1-2 min then disappear...
Cant ping it cannot ping LAN address that display TP-LINK ROUTER
Mikrotik replay address unreachable...

Any advice ?

If you have only /48 prefix, you can give to users /56 for their LANs and /64 seperatly to each user for connectivity with your router. /64 by static, /56 by SLAAC.

About IPv6 gateway: you need to write IPv6 address via colons like ":" or "::" depends of how you want to write IPv6 address.

You have to ping locally managed IPv6 address. You have to figure at this one out first of all.

Ripper · Wed Oct 16, 2019 12:46 pm

I've setup that way but it doenst work ...

static2.png

static.png

that configuration recived without router

  
  DHCP is on. . . . . . . . . . . : No
    Auto tuning is on. . . . . . : Yes
    IPv6 Address . . . . . . . . . . . : 2a01: xx: xxxx: 400: b413: fa26: d310: eaa3 (Basic)
    The local IPv6 address of the channel. . . : fe80 :: b413: fa26: d310: eaa3% 26 (main)
    IPv4 Address . . . . . . . . . . . : 192.xx.xx.xx (Basic)
    Subnet mask . . . . . . . . . . : 255.255.255.255
    Main gate. . . . . . . . . : fe80 :: f0: 25% 26
                                        0.0.0.0
    IAID DHCPv6. . . . . . . . . . . : 410308651
    DUID of the DHCPv6 client. . . . . . . : 00-01-00-01-24-8B-50-A5-74-D0-xx-xx-xx-xx
    DNS servers. . . . . . . . . . . : 8.8.8.8
                                        2001: 4860: 4860 :: 8888
                                        2606: 4700: 4700 :: 1111
                                        2a01: xx :: 1
    NetBios over TCP / IP. . . . . . . . : Enabled

And its work with it

Anumrak · Wed Oct 16, 2019 1:30 pm

It's not really practical to give to users prefixes for static configuration. Try to find newest firmware for TP-Link routers with IPv6 SLAAC config.

Ripper · Wed Oct 16, 2019 2:13 pm

It's lattest firmare for not cheapest router Archer C7 v1 i've tryed for newer Archer C50v4 (more cheaper) its have same IPv6 setup page .... (TP-LINK 940N V3 i think have same setup page)

Give me advices I will try to check it ... i've no experience at v6 after router ... i've use it as endpoint and its works well 50% traffic goes thrue V6.

Anumrak · Wed Oct 16, 2019 2:20 pm

IPv6 is native IP rpotocol for Windows OS, IPv4 is secondary one. My advice is this one for your clients: https://wiki.mikrotik.com/wiki/Manual:H ... e_for_Home

Otherwise - static routing which is pain in the ass...

Sob · Wed Oct 16, 2019 3:53 pm

Am I seeing it wrong, or do you really have 2a01:xx:xxxx:400:9ade::1 on TP-Link's WAN and 2a01:xx:xxxx:400::/64 on LAN, i.e. same /64 subnet? That wouldn't work well, you need different subnets.

For example, RB may have 2a01:xx:xxxx:400::1/64 on internal interface, connected TP-Link would have 2a01:xx:xxxx:400::401/64 on WAN and 2a01:xx:xxxx:401::1/64 on LAN. On RB you'd add:

/ipv6 route
add dst-address=2a01:xx:xxxx:401::/64 gateway=2a01:xx:xxxx:400::401

And it should work. Or you can configure DHCPv6 server on RB and let TP-Link get prefix from there.

Anumrak · Wed Oct 16, 2019 5:04 pm

And yeah, Ripper, if you will configure same /64 subnet on WAN and LAN sides, it'd be the same as 195.100.50.0/29 on WAN and 195.100.50.0/29 on LAN: your router won't route your traffic to same network via different interfaces, so grab /64 subnet from /60 "special ptp prefix" and grab /56 except that /60 to your clients. Subnets must be different.

Ripper · Thu Oct 17, 2019 12:08 am

I've tryed to enable DHCPv6 that router recive nothing at all ...

Structure

Main Router MT got 2a01:xx:xx:400::/64 at vlan interface that looks to clients TP-LINK Router I want that client recive something below 2a01:xx:xxxx:400:: to recognize it for example 2a01:xx:xxxx:400:1:: and LAN network from that router have to be 2a01:xx:xxxx:400:1:1:: 2a01:xx:xxxx:400:1:2:: 2a01:xx:xxxx:400:1:3:: i dont know how to declararete it right but LAN HAS to BE /64 (cant change lenght)

Sob · Thu Oct 17, 2019 1:09 am

The smallest subnet is /64 (not entirely true, but in practice it is). It means that e.g. 2a01:xx:xxxx:400:1:1:: is beyond that limit (/64 is half of IPv6 address). If you got /48, then what you can work with is YYYY in 2a01:xxxx:xxxx:YYYY:zzzz:zzzz:zzzz:zzzz and it gives you up to 65k /64s.

If you want hierarchical config, you can have /56s for vlans:

2a01:xx:xxxx:00YY::/56
2a01:xx:xxxx:01YY::/56
2a01:xx:xxxx:02YY::/56
...

That will allow you to have 256 vlans. YY is space for clients. If you give them only /64, you can have 256 of them per vlan. But only one /64 is not good, because it can't be divided further, so it's not possible to make e.g. separate guest subnet. It's generally good to give clients more to give them more freedom in what they can do with their networks. Other possibility is to have maximum 16 clients per vlan with /60 (so 16 /64s) for each. Or 32 clients with /61 (8 /64s), 64 clients with /62 (4 /64s), or 128 clients with /63 (2 /64s).

If you don't need that many vlans and 16 would be enough for you, you can instead have:

2a01:xx:xxxx:0YYY::/52
2a01:xx:xxxx:1YYY::/52
2a01:xx:xxxx:2YYY::/52
...

And it would give you extra 4 bits you could use for clients. You don't have to go by 4 bits (as you can see above), but it's more clear, because 4 bits is one hexadecimal digit.

Let's say you choose /56 for each vlan. For static config, RB will have for example:

/ip address
add address=2a01:xx:xxxx:100::1/64 interface=vlan1
add address=2a01:xx:xxxx:200::1/64 interface=vlan2
...
add address=2a01:xx:xxxx:ff00::1/64 interface=vlan256
/ip route
add dst-address=2a01:xx:xxxx:110::/60 gateway=2a01:xx:xxxx:100::110 comment="client1 / vlan1"
add dst-address=2a01:xx:xxxx:120::/60 gateway=2a01:xx:xxxx:100::120 comment="client2 / vlan1"
...
add dst-address=2a01:xx:xxxx:1F0::/60 gateway=2a01:xx:xxxx:100::1F0 comment="client16 / vlan1"
add dst-address=2a01:xx:xxxx:210::/60 gateway=2a01:xx:xxxx:200::210 comment="client1 / vlan2"
add dst-address=2a01:xx:xxxx:220::/60 gateway=2a01:xx:xxxx:200::220 comment="client2 / vlan2"
...
add dst-address=2a01:xx:xxxx:2F0::/60 gateway=2a01:xx:xxxx:200::2F0 comment="client16 / vlan2"
...

And config for clients will be:

WAN address: 2a01:xx:xxxx:100::110/64
Default gateway: 2a01:xx:xxxx:100::1
Available LAN subnets:
2a01:xx:xxxx:110::/64
2a01:xx:xxxx:111::/64
...
2a01:xx:xxxx:11f::/64

Or you can use DHCPv6 server on RB:

/ipv6 pool
add name=pool_vlan1 prefix=2a01:0:0:100::/56 prefix-length=60
add name=pool_vlan2 prefix=2a01:0:0:200::/56 prefix-length=60
...
add name=pool_vlan256 prefix=2a01:0:0:ff00::/56 prefix-length=60
/ipv6 dhcp-server
add address-pool=pool_vlan1 interface=vlan1 name=server1
add address-pool=pool_vlan2 interface=vlan2 name=server2
...
add address-pool=pool_vlan256 interface=vlan256 name=server256

And client can get everything automatically. Also in this case you don't need to add any addresses to vlans on RB.

Ripper · Thu Oct 17, 2019 12:14 pm

I've made pools

2a01:xx:xxxx:1000::/56 /vlan100
2a01:xx:xxxx:2000::/56 /vlan200
....

I've bind ipv6 adress on vlans

2a01:xx:xxxx:1000::1/64 -> vlan 100 from pool v6vlan100 (CANT BIND 2a01:xx:xxxx:100::1/64 ERR POOL PREFIX)
2a01:xx:xxxx:2000::1/64 -> vlan 200 from pool v6vlan200
....

I've made static route
2a01:xx:xxxx:1001::/64 -> at vlan 100

Set static configuration to router

WAN 2a01:xx:xxxx:1001::
GATEWAY :: (WONT SAVE 2a01:xx:xxxx:1000::1 ERR 51000)
LAN 2a01:xx:xxxx:1002::/64

SEE it at ipv6 neighboor with mark R but cant ping anything ....

Any advices ?

Sob · Thu Oct 17, 2019 1:01 pm

You seem to be mixing it up in a strange way. If you want static config, you don't need to define any pools. Then you need to add routes to client's /64, not to their WAN address, that one should exist automatically, because your router's address and client's WAN address should be in same subnet.

It's pretty much the same as IPv4 would be. Let's say you have 10.0.0.0/8 (instead of IPv6's /48) and you want to give each client one /24 (instead of IPv6's /64). With the same logic, you could have e.g.:

/ip address
add address=10.1.0.254/24 interface=vlan1
add address=10.2.0.254/24 interface=vlan2
...
/ip route
add dst-adress=10.1.1.0/24 gateway=10.1.0.1 comment="client1 / vlan1"
add dst-adress=10.1.2.0/24 gateway=10.1.0.2 comment="client2 / vlan1"
...
add dst-adress=10.2.1.0/24 gateway=10.2.0.1 comment="client1 / vlan2"
add dst-adress=10.2.2.0/24 gateway=10.2.0.2 comment="client2 / vlan2"
...

Client1/vlan1 would have WAN 10.1.0.1/24, gateway 10.1.0.254, LAN 10.1.1.0/24.
Client2/vlan1 would have WAN 10.1.0.2/24, gateway 10.1.0.254, LAN 10.1.2.0/24.
Client1/vlan2 would have WAN 10.2.0.1/24, gateway 10.2.0.254, LAN 10.2.1.0/24.
...

Subnets 10.X.0.0/24 are common connecting subnets between your router and client routers (it assumes that all clients are connected directly in each vlan).

Ripper · Thu Oct 17, 2019 1:53 pm

Ive bind
[*]2a01:xx:xxxx:1000::73 to WAN of Client Router at vlan 100
2a01:xx:xxxx:1000::1 Mikrotik Router vlan100
2a01:xx:xxxx:1001::/64 to LAN of client Router
i've add Static Router 2a01:xx:xxxx:1001::/64 gateway vlan100

Mikrotik can ping 2a01:xx:xxxx:1000::73 for 1-2 min then timeout ....
but Can't ping from global ipv6 network

cant ping Clients LAN 2a01:xx:xxxx:1001:9ade:d0ff:fe84:700c/64 (shown at router CLIENT CONFIG)

Anumrak · Thu Oct 17, 2019 2:15 pm

Ive bind
[*]2a01:xx:xxxx:1000::73 to WAN of Client Router at vlan 100
2a01:xx:xxxx:1000::1 Mikrotik Router vlan100
2a01:xx:xxxx:1001::/64 to LAN of client Router
i've add Static Router 2a01:xx:xxxx:1001::/64 gateway vlan100

Mikrotik can ping 2a01:xx:xxxx:1000::73 for 1-2 min then timeout ....
but Can't ping from global ipv6 network

cant ping Clients LAN 2a01:xx:xxxx:1001:9ade:d0ff:fe84:700c/64 (shown at router CLIENT CONFIG)

Does your main IPv6 router has a 2000::/3 route to your ISP?

Ripper · Thu Oct 17, 2019 2:24 pm

Yes.
Ive made vpn test connection to same sub with prefix declaration from pool and all works thrue VPn to mikrotik all online test done without issue. All ips was auto configured and dynamic route auto added at roting

Anumrak · Thu Oct 17, 2019 2:27 pm

Yes.

Can you ping ipv6 address of your ISP from your router? Can you ping 2001:4860:4860::8888 from your router?

Ripper · Thu Oct 17, 2019 2:33 pm

Ive done all test before writing with beginning configuration that ive described at first post. .. and if i connect notebook windows or Ubuntu directly without router to vlan100 all was automatically assigned and works well ...ipv6 web open and ipv6 speedtest and webtest done ... Also i can ping that laptop outside from other ipv network thrue looking glass ipv6 ready.

Main goal was how to make that work thrue client router ... Directly it works...

Now ive change all configuration as you advise me exapt i dont deleted pools and rule asign from pool.

Also ive tryed enable dhcpv6 ... At router config page no ip at all... But at mikrotik there is ip for that mac but it repeatedly change each 30 sec ... +1 to subnet 1001 1002 and soon.

Anumrak · Thu Oct 17, 2019 3:12 pm

And what routes do you have on TP-Link router to Mikrotik side?

Ripper · Thu Oct 17, 2019 3:25 pm

I cant write here anything ... Just defaults ::
If write here ip of mikrotik at vlan100 it gives an error 51000 at change it back to ::

Anumrak · Thu Oct 17, 2019 3:51 pm

I cant write here anything ... Just defaults ::
If write here ip of mikrotik at vlan100 it gives an error 51000 at change it back to ::

Okay. LAN is OK. Try to choose delegated prefix on WAN interface? You have to receive IPv6 address and gateway address from Tik via router advertisment message.

WAN connection type: None address
Get IPv6 prefix delegation

OR you can choose Pass-through type of WAN connection(Bridge) to advertise IPv6 /64 prefix directly to client's PC from Tik.

Ripper · Thu Oct 17, 2019 4:26 pm

There is no such option https://emulator.tp-link.com/Archer_C7/Index.htm (hardware version v1) and tplink 940v3 such interface and 840n

Anumrak · Thu Oct 17, 2019 4:40 pm

There is no such option https://emulator.tp-link.com/Archer_C7/Index.htm (hardware version v1) and tplink 940v3 such interface and 840n

Looks like this emulator is broken. You have to have an option to add any static address here. Try another router with ipv6 support just for test.

Ripper · Thu Oct 17, 2019 5:28 pm

Static ipv6 is present ... Many first wave ip6 routers from tplink have such interface newest has ipv6 dhcp/slaac auto option but i dont have it to test ... 80 procent ipv6 real routers has such interface that im described old ipv6 Support. Ive test emulator it works for me.

Anumrak · Thu Oct 17, 2019 5:47 pm

Static ipv6 is present ... Many first wave ip6 routers from tplink have such interface newest has ipv6 dhcp/slaac auto option but i dont have it to test ... 80 procent ipv6 real routers has such interface that im described old ipv6 Support. Ive test emulator it works for me.

There is no none address in IPv6 section in order to allow get /64 prefix from Tik. But even in static mode I can't write ipv6 address down. Emulator says it's not ipv6 address

Well, I believe TP link router is programmed to connect via 6to4 tunnel in order to get ipv6 prefix, like for real CPE, not for router-router topology. If it'd be 2 Tiks, I'd manage ipv6 global static addresses and add static route to 2000::/3 from last to first one and from first one to ISP via 6to4 tunnel. Static prefixes to LANs with router advertisment without dhcpv6 with static DNS servers(I read that windows OS not working with dhcpv6). That's it.

Ripper · Thu Oct 17, 2019 6:30 pm

There is strange format have to write with zeros

Not :: at the end but ::0000 and it will aplay

Sob · Thu Oct 17, 2019 8:20 pm

i've add Static Router 2a01:xx:xxxx:1001::/64 gateway vlan100

Gateway for this route should be IP address on clients's WAN interface, i.e. 2a01:xx:xxxx:1000::73.

Ripper · Thu Oct 17, 2019 9:35 pm

Ping LAN IPV6
AND WAN IPV6

But just from MT console ping ....
I doesnt ping from WORLD or from PC from other VLAN

Sob · Thu Oct 17, 2019 9:45 pm

You need to provide more info, exported config perhaps. You may have something in firewall, or a typo somewhere or some other mistake. You can see it, we can't.

Ripper · Thu Oct 17, 2019 9:56 pm

That config

ipv6route.png

firewall.png

adressv6.png

Sob · Fri Oct 18, 2019 4:22 am

Route #6 (static one with dst-address=2a01:xxx:xxx:4000::/56 shouldn't be there.
IP address on sit1 with /48 mask looks suspicious, but it depends on what you got from tunnel provider.
If you try from outside, are you able to ping anything at all in your network?
Firewall looks like it allows pretty much everything except port 53 (default action is accept, so everything you don't specifically block is allowed).
And it's generally better to post exports, because some options may not be visible in screenshots.

Ripper · Fri Oct 18, 2019 11:36 am

2a01:xxx:xxx:4000::/56 added at research stage ... It doesn't make anything in fact...

Xx/48 required by tunnel brocker.

I can ping any gateway from outside ... I can reach linux web server at lan1 interface by ipv6 ip.

But cant reach any router ... Just ping inside vlan...

Ive add ubnt router device at lan1 for testing enable ipv6 slaac it recive ipv6 adress all looks same as web server but reason it can ping only gateway and web server and nothing more (dns works) ... I don't know whats wrong with it ... can ping from web server that router by v6 ip can ping any world wide ipv6.

routing table from ubnt device at lan1 all autoconfig

 
2a01:xx:xxx:77::/64 dev eth0  proto kernel  metric 256  expires 2113186sec mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev br0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev wifi0  proto kernel  metric 256  mtu 2286 advmss 2226 hoplimit 4294967295
fe80::/64 dev ath0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
ff00::/8 dev eth0  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
ff00::/8 dev br0  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
ff00::/8 dev wifi0  metric 256  mtu 2286 advmss 2226 hoplimit 4294967295
ff00::/8 dev ath0  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
default via fe80::xx:xxx:xxx:xx21 dev eth0  proto kernel  metric 1024  expires 1534sec mtu 1500 advmss 1440 hoplimit 64

from web server

2a01:xx:xxxx:77::/64 dev eth0 proto kernel metric 256 expires 2591780sec
fe80::/64 dev eth0 proto kernel metric 256
default via fe80::xx:xxxx:xxx:xx21 dev eth0 proto ra metric 1024 expires 1580sec hoplimit 64

difference when web server pings gateway i see it at ipv6 connections
when ubnt pings i dont see like it do ite some other way ...

Anumrak · Fri Oct 18, 2019 1:49 pm

I believe that /48 was assign to your LAN side from tunnel broker(Hurricane Electric?). And he supposed to assign point to point /64 from another prefix. Thats all I think. Reread address space delegated to you in your accounting page. First thing: point to point /64 prefix has to be reachable from Tik to broker via ipv4(sit1). Second thing: /48 has to be routable via 2000::/3 to point to point ipv6 address on broker side. What you want to do with your /48 is limited only by your imagination. In IPv6 - ND configuration, add your smaller prefixes from /48(/56 or /64) to another interface you want to connect with IPv6 address(TP-Link won't let us set a static route), put a tick inside that ND prefixes to advertise mac and dns.

Ripper · Fri Oct 18, 2019 7:26 pm

Server IPv6 address 2a01:xx:zzzz:105::1/64
Client IPv6 address 2a01:xx:zzzz:105::2/64 bind to sit
Routed /48 IPv6 network 2a01:xx:yyyy::/48
IPv6 DNS server 2a01:xx::1

that tunnel broker config ...

I've change miss at sit ipv6 to 2a01:xx:zzzz:105::2/64 not to /48 writen before but it doesnt change any thing

I've got two unix based machines at one lan1 network ...
Both take autoIPv6 both has same routing table but just one can go to internet .... ubuntu web server can reach internet (and i can see it thure other isp looking glass too) and UBNT router take ip but can ping just inside one lan1 ... cant even ping from mikrotik to it ... (at ubnt logs got that error 6relayd[1158]: A default route is present but there is no public prefix on br0 thus we don't announce a default route!)

TP-LINK router can ping inside vlan but can ping from other vlan, cant ping world ...
I cant give you more info in private but i dont know how to write PM at that forum board.

mkx · Fri Oct 18, 2019 7:46 pm

I cant give you more info in private but i dont know how to write PM at that forum board.

There's a list of consultants available which will be happy to discuss your problem with most discretion. I'm sure of it ...

sutrus · Fri Oct 18, 2019 10:08 pm

Server IPv6 address 2a01:xx:zzzz:105::1/64
Client IPv6 address 2a01:xx:zzzz:105::2/64 bind to sit
Routed /48 IPv6 network 2a01:xx:yyyy::/48
IPv6 DNS server 2a01:xx::1

that tunnel broker config ...

I've change miss at sit ipv6 to 2a01:xx:zzzz:105::2/64 not to /48 writen before but it doesnt change any thing

I've got two unix based machines at one lan1 network ...
Both take autoIPv6 both has same routing table but just one can go to internet .... ubuntu web server can reach internet (and i can see it thure other isp looking glass too) and UBNT router take ip but can ping just inside one lan1 ... cant even ping from mikrotik to it ... (at ubnt logs got that error 6relayd[1158]: A default route is present but there is no public prefix on br0 thus we don't announce a default route!)

TP-LINK router can ping inside vlan but can ping from other vlan, cant ping world ...
I cant give you more info in private but i dont know how to write PM at that forum board.

Change default route. Replace IPv6 address in gateway after interface name.
/ipv6 route
add distance=1 dst-address=2000::/3 gateway=Name_IPv6_interface

Ripper · Fri Oct 18, 2019 10:15 pm

its already set

0 A S  2000::/3                 2a01:xx:zzzz:105::1             1

reachable sit1

ubnt router was several times rebooted and changed ipv6 adress at lan1 from
2a01:xx:yyyy:77::/64
to
2a01:xx:yyyy:7700::1/64

and ubnt router start to be rechable from outside world ...

and add route

A S  2a01:xx:yyyy:7700::/56   lan1                            1

I dont know whats make a deal but at least one device alive ...

Im continue fighting with TPLINK C7

PS... ubnt reachable for 1-2min then timeout .... if i ping gateway from UBNT its alive (cant ping even ipv6.google.com but after gateway ping i can ping google) .... WTF? route alive for short time
(after ping new route apears 2a01:xx:zzzz:7700::1/128 2a01:xx:zzzz:7700::1 LAN0) after that v6 alive for a short time
all route table of ubnt

2a01:xx:zzzz:7700::/64	::	LAN0
fe80::/64	::	LAN0
fe80::/64	::	BRIDGE0
fe80::/64	::	wifi0
fe80::/64	::	WLAN0
ff02::1/128	ff02::1	BRIDGE0
ff02::1/128	ff02::1	LAN0
ff02::16/128	ff02::16	BRIDGE0
ff02::fb/128	ff02::fb	BRIDGE0
ff02::1:2/128	ff02::1:2	BRIDGE0
ff02::1:3/128	ff02::1:3	BRIDGE0
ff00::/8	::	LAN0
ff00::/8	::	BRIDGE0
ff00::/8	::	wifi0
ff00::/8	::	WLAN0
::/0	fe80::xxx:xxxx:xxxx:4421	LAN0

Sob · Fri Oct 18, 2019 11:37 pm

I'd suggest to get rid of everything and go step by step. Do not add anything else, keep it as simple as possible. You can add other stuff when you get a hang of it. So for simple all-static config as a starting point, do this:

- Create your sit1 interface
- Add address 2a01:xx:zzzz:105::2/64 to sit1 (advertise=no)
- Add default route (dst-address=::/0 gateway=2a01:xx:zzzz:105::1)
- 2a01:xx:zzzz:105::2 (your router) must be now reachable from outside
- Don't bother with creating any pools when you then create static config anyway
- Select one internal interface for testing, for example your lan1
- Add address 2a01:xx:yyyy:77::1/64 to lan1 (advertise=no)
- 2a01:xx:yyyy:77::1 (also your router) must be now reachable from outside

- Connect some testing device to lan1 (maybe just PC for start)
- Configure it with static address 2a01:xx:yyyy:77::2/64 and gateway 2a01:xx:yyyy:77::1
- IPv6 access to internet must now work on testing device

- Connect another router to lan1
- Configure it with static address 2a01:xx:yyyy:77::3/64 on WAN and gateway 2a01:xx:yyyy:77::1
- 2a01:xx:yyyy:77::3 must be now reachable from outside (well, should, but the device itself can block access to it, so if it's not reachable, don't worry about it at this point)
- Configure static subnet 2a01:xx:yyyy:78::/64 on another router's LAN (use 2a01:xx:yyyy:78::1/64 if it wants you to input address)
- On RB, add route to this subnet (dst-address=2a01:xx:yyyy:78::/64 gateway=2a01:xx:yyyy:77::3)
- Connect some other device to this router's LAN and it will get address 2a01:xx:yyyy:78:<something>/64 and gateway 2a01:xx:yyyy:78::1 (what router has on LAN)
- IPv6 access to internet must now work on this device

Ripper · Sat Oct 19, 2019 12:41 am

I got few more questions
At exaple of tunnel brocker config for MT is
- Add address 2a01:xx:zzzz:105::2/64 to sit1 (advertise=no) (advertise=YES) recomended
- Add default route (dst-address=::/0 gateway=2a01:xx:zzzz:105::1) dst-address=2000::/3 recomended
should I ignore it ?

And just update info my TP-LINK route alive ... i've just change browser D and i can put default gateway here 2a01:xx:yyyy:77::1
BUT now just with DHCPv6 LAN connfig (Default config with link local adress will it work with just link local (cant test)) and It reachable from world now ... =) but not for long time after 5-10 min it again goes unreachable ...
it so strange with that timing ... if UBNT always ping world ipv6 it doesnt lose connection ... i've made prefix decalration LAN of UBNT with other subnet add static route for that sub and its ping outside ... but till main router is alive (can ping world ip) ...

I any way to make auto route two prefix customer router subnet (LAN) or better dont use it and let it defaul link-local with single WAN IP to router as ipv4 style ? will it work ?

Sob · Sat Oct 19, 2019 2:04 am

The advertise option for IP address tells router if it should enable autoconfiguration (SLAAC) on that interface (with /64 subnet taken from address). It allows host devices (not routers!) connected to that subnet to automatically configure correct address and gateway. I don't see why tunnel broker would want it on the link to them, but if they say so, why not.

Difference between ::/0 and 2000::/3 is that the first one is whole IPv6 address space, and the other is currenly allocated IPv6 space (the rest is in reserve for future use). So 2000::/3 is more correct, but in practice it makes no difference which one you use.

You mean that if you use static WAN config for TP-Link, it doesn't allow SLAAC for LAN? Hmm, I don't have any explanation why it shouldn't be possible. If I look at the emulator you posted a link to earlier, I'd say it should work.

Connection working for a while and them breaking up is definitely strange.

I'm not sure if I understand the last paragraph. But there's no difference in routing and subnetting between IPv4 and IPv6. You can have one subnet between upstream router and client router, and you can route as many subnets over it as you want. Completely different /64s, two adjacent /64 as /63, four as /62, etc. You don't even need to have any extra subnet to link the routers, because there are always link-local addresses (fe80::...) and they can be used as well. But it may be more difficult to keep track of them.

One more thing, I don't know how much are you set on static config, but there's also DHCPv6 and prefix delegation. I personally like static config, but if it's not strict requirement for you, it could be easier without it. For example, you can do:

/ipv6 pool
add name=clients1 prefix=2a01:xx:yyyy:100::/56 prefix-length=60
/ipv6 dhcp-server
add address-pool=clients1 interface=lanX name=server1

And then you just connect TP-Link to lanX and select DHCPv6 for its WAN and it should receive prefix and auto-configure LAN.

Ripper · Sat Oct 19, 2019 1:53 pm

You mean that if you use static WAN config for TP-Link, it doesn't allow SLAAC for LAN? Hmm, I don't have any explanation why it shouldn't be possible. If I look at the emulator you posted a link to earlier, I'd say it should work.

After several routers reboots it allow me to put extra subnet as prefix to LAN ... and its works pingable inside and outside network but for reach them i add static route both routers UBNT + TP-LINK set by IP static and work for 5-6 hours with real traffic ....

 6 A S  ;;;
        2a01:xx:yyyy:4001::/64   2a01:xxx:yyyy:4000::4073         1

But its not conveniently to make it by hands each time ... and add to queque two ips for ecach user ipv6 ip of router then ipv6 subnet for LAN + iPV4 ip ...
So i've ask is any way to make it works without hand writing routes and to use just one IPv6 to WAN of router or just one sub net to router ... to make it easier to use in real life.

I've tryed to change pool size and enable DHCPv6 ... tested at UBNT ... it constantly change ip by info of MT and no ip by UBNT router ifconfig ... same way was with TP-LINK (RS 6.42.6)

that what is going on if DHCPv6 SERVER ENABLED

dhcpv6.png

new prefix each 30-60 sec

Sob · Sat Oct 19, 2019 5:23 pm

If you want it easy, DHCPv6 is for you. It automatically gives subnets to clients, adds routes and everything, no more manual configuration should be necessary.

Unfortunatelly, my experience with that is limited. I know it's there, I tested it a little, it did what I expected, and everything looked fine. But I didn't get to any problems and throubleshooting. Client device asking for too many subnets seems strange, I don't know why it does that.

Hopefully someone else who has more experience with this steps in and gives you more info.

Ripper · Sun Oct 20, 2019 10:42 am

Still issue with routing i have to always ping router to keep its alive (static route to subnet with check gateway (wan router) by ping keep it alive ... But strange ... And im still think how to use one prefix per router ... No two as now.

Ripper · Thu Oct 24, 2019 11:10 am

After some time static Router going unreachable ... so ipv6 down no wan ping no lan ping ... from world ... have to reboot router to make it alive again ...

Anumrak · Thu Oct 24, 2019 4:13 pm

After some time static Router going unreachable ... so ipv6 down no wan ping no lan ping ... from world ... have to reboot router to make it alive again ...

Hmmm... What public IP do you got from your ipv4 ISP?

Ripper · Thu Oct 24, 2019 8:09 pm

IP is static all is good with it SIT didnt down (UP router SIT ipv6 ip reachable no proble all the time)...half test ipv6 routers down (unreachable) half still works ...

I don't understand that magic trick to make link alive i have to ping gateway from router WTF for exaple 2a01:xx:yyyy:7700::1 ? and its alive for short time then i have to do that again or make always ping it from outside (WAN to keep it alive)

 interface
eth1      Link encap:Ethernet  HWaddr xx:xx:xx:x:xx:BA
          inet addr:xx.xx.xx.62  Bcast:xx.xx.xx.255  Mask:255.255.255.0
          inet6 addr: 2a01:xx:yyyy:7700:zz:zzzz:zzzz:zzba/64 Scope:Global
          inet6 addr: fe80::zz:zzzz:zzzz:zzba/64 Scope:Link
          UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:351979 errors:0 dropped:0 overruns:0 frame:0
          TX packets:141364 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:498206870 (475.1 MiB)  TX bytes:16916325 (16.1 MiB)

Routing recived from router

2a01:xx:yyyy:7700::/64 dev eth1  proto kernel  metric 256  expires 2145657sec mtu 1500 advmss 1440 hoplimit 4294967295 (PREFIX DECLARATED)
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
ff00::/8 dev eth1  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
default via fe80::xxx:xxxx:xxxx:4421 dev eth1  proto kernel  metric 1024  expires 1632sec mtu 1500 advmss 1440 hoplimit 64 (MIKROTIK LINK LOCAL ADRESS AT INTERFACE)

from unix direct connected machine works without any tricks

eth0      Link encap:Ethernet  HWaddr zz:zz:zz:zz:zz:2a
          inet addr:zz.zz.zz.3  Bcast:zz.zz.zz.255  Mask:255.255.255.0
          inet6 addr: fe80::zzz:zzzz:zzzz:zz2a/64 Scope:Link
          inet6 addr: 2a01:xx:yyyy:7700:zzz:zzzz:zzzz:zz2a/64 Scope:Общий
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5249 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6454 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:792687 (792.6 KB)  TX bytes:1093865 (1.0 MB)

2a01:xx:yyyy:7700::/64 dev eth0  proto kernel  metric 256  expires 2591995sec (SAME PREFIX)
fe80::/64 dev eth0  proto kernel  metric 256
default via fe80::xxx:xxxx:xxxx:4421 dev eth0  proto ra  metric 1024  expires 1795sec hoplimit 64 (MIKROTIK LINK LOCAL ADRESS AT INTERFACE)

Same interface but Unix base machine works ... router has problems

Sob · Thu Oct 24, 2019 10:25 pm

Can't it be your firewall? Did you try to allow *all* input from interface where the routers are connected?

Ripper · Thu Oct 24, 2019 10:57 pm

But unux machine works ... ? windows machine too (direct connect without router)
But two different router has same issue (TP-LINK and ubnt) has to ping to keep alive ...

radvd

interface eth1
{
        AdvSendAdvert on;
        # Note: {Min,Max}RtrAdvInterval cannot be obtained with radvdump
        AdvManagedFlag on;
        AdvOtherConfigFlag on;
        AdvReachableTime 0;
        AdvRetransTimer 0;
        AdvCurHopLimit 64;
        AdvDefaultLifetime 1800;
        AdvHomeAgentFlag off;
        AdvDefaultPreference medium;
        AdvSourceLLAddress on;

        RDNSS 2001:4860:4860::8888 2606:4700:4700::1111 2a01:xx::1
        {
                AdvRDNSSPreference 0;
                AdvRDNSSOpen off;
                AdvRDNSSLifetime 900;
        }; # End of RDNSS definition

        prefix 2a01:xx:yyyy:7700::/64
        {
                AdvValidLifetime 2592000;
                AdvPreferredLifetime 604800;
                AdvOnLink on;
                AdvAutonomous on;
                AdvRouterAddr off;
        }; # End of prefix definition


}; # End of interface definition

Is any way to declarate default gateway not link local ... maybe problem with that

and one more situation if link fault for any reason for 1-2min ipv6 connection would recover even if routing table ping it ... has to reboot router

danunjaya123 · Fri Oct 25, 2019 5:31 pm

I have issue with IPv6 in DHCP and PPPoE, Im not able to get gateway and DNS for clients.

May i Know how it will be come on PPPoE and DHCP.

Mikrotik CCR1036-12G-4S

Ripper · Tue Oct 29, 2019 12:06 pm

Community lost interest to tread but problem isnt fixed ...

Sob · Tue Oct 29, 2019 4:01 pm

I wouldn't describe it as lost interest, just being out of ideas. But maybe I have one, make the simplest lab setup, use one MikroTik device as main router, another as client router, connect something behind it and test that. It must work. Make the config as simple as possible, skip firewall and everything. Then replace client router with TP-Link or another device and test with that. If it still works, then examine what's the difference between lab config and your real config.

mducharme · Wed Oct 30, 2019 7:35 pm

I do this with MikroTik routers but unfortunately there are many problems with off-the-shelf routers with IPv6 DHCP - here are two very common IPv6 problems that affect most routers (including TP-Link):

1. Inability for the router to handle receiving a prefix, but not an address, from IPv6 DHCP. MikroTik routers provide the client device only with a prefix, no address, via DHCPv6. The resulting behavior is that the router will request address and prefix, get prefix only and fail to bind prefix because it didn't get an address. MikroTik DHCPv6 server bindings tab will show "offered" but never "bound". Meanwhile it has an address via SLAAC. The devices are supposed to handle this correctly but many do not.
2. Inability to handle any customer prefix size other than /64. Unfortunately most home routers only support receiving a /64 prefix from the ISP, and giving only a single /64 goes against RFC recommendations. Such a router will accept and bind the /56 prefix, and will then promptly place the entire /56 on the LAN interface. /56 is too big and breaks SLAAC so nothing can get an address and IPv6 doesn't work as a result. This bug has resulted in many ISPs giving up and actually going against RFC recommendations and giving /64's to home customers by default to work around the incorrect behavior of home routers.

To give you an idea of how widespread these issues are, when we rolled out IPv6 to all of our retail customers (we have about 800 retail customers), there were about 300 customer routers that "supported IPv6". Of those, about 290 suffered from either problem #1 or problem #2 (or both). So we only had 10 customers successfully on IPv6 as a result.

We are now rolling out MikroTik routers as home routers since they do this correctly, and all of those customers have working IPv6.

Anumrak · Thu Oct 31, 2019 3:47 pm

I have issue with IPv6 in DHCP and PPPoE, Im not able to get gateway and DNS for clients.

May i Know how it will be come on PPPoE and DHCP.

Mikrotik CCR1036-12G-4S

Use IPv6 dns servers in IP - DNS settings and distribute IPv6 prefixes to your clients via SLAAC solicitation.

Ripper · Sat Nov 02, 2019 10:05 pm

I have a question how to cast default route gateway to client if i didnt put static gateway it trying to use link local adress of mikrotik router of that interface and didnt get router to internet ( ...
how to cast global ipv6 adress of Mikrotik from that interface ...

Routing table with WAN SLAAC mode (IP adress recived) (LAN static prefix manual)
Router UBNT

2a01:xx:yyyy:7700::/64	::	LAN1 (WAN INTERFACE TO MIKROTIK)
2a01:xx:yyyy:7702::/64	::	BRIDGE0 (LAN INTERFACE UBNT USER)
fe80::/64	::	LAN0
fe80::/64	::	wifi0
fe80::/64	::	WLAN0
fe80::/64	::	BRIDGE0
fe80::/64	::	LAN1
ff00::/8	::	LAN0
ff00::/8	::	wifi0
ff00::/8	::	WLAN0
ff00::/8	::	BRIDGE0
ff00::/8	::	LAN1
::/0	fe80::20c:zzzz:zzzz:yy21 LAN1 (LINK LOCAL FROM MIKROTIK ROUTER)

Doesnt WORK AT AUTO

2a01:xx:yyyy::1/128	2a01:xx:yyyy:7700::1	LAN0 (WAN INTERFACE TO MIKROTIK)
2a01xx:yyyy::/64	::	LAN0
2a01xx:yyyy:7701::/64	::	BRIDGE0 (LAN INTERFACE UBNT USER)
fe80::/64	::	LAN0
fe80::/64	::	BRIDGE0
fe80::/64	::	wifi0
fe80::/64	::	WLAN0
ff02::fb/128	ff02::fb	BRIDGE0
ff02::1:2/128	ff02::1:2	BRIDGE0
ff02::1:3/128	ff02::1:3	BRIDGE0
ff00::/8	::	LAN0
ff00::/8	::	BRIDGE0
ff00::/8	::	wifi0
ff00::/8	::	WLAN0
::/0	2a01:xx:yyyy:7700::1	LAN0(GLOBAL IPV6 adress FROM MIKROTIK ROUTER gateway)

That setup is static with manual gateway but it work till it pings gateway ... (till it reachable if it failes it not recover)

mducharme · Sun Nov 03, 2019 12:27 am

I have a question how to cast default route gateway to client if i didnt put static gateway it trying to use link local adress of mikrotik router of that interface and didnt get router to internet ( ...
how to cast global ipv6 adress of Mikrotik from that interface ...

I don't understand what you mean. When you enable SLAAC on that interface on the MikroTik (by setting advertise=yes on the global /64 IPv6 address facing the client), the client should get the default gateway advertised by SLAAC, which is the link-local, not the global.

Ripper · Sun Nov 03, 2019 12:08 pm

Yes it get link local gateway but ... (look at my routetabels posted above) problem that there is no route to global adress that users get at LAN behind router ... and no internet at all ... to make it work ... (direct pc connection works) if i make static IPV6 (with global gateway adress from that interface) it works but ... not for long time ... i have to always to ping gateway or any outside ip ... to keep route alive if route fails for any reason (or no activity no ping etc) it wouldnt recovers i have to manual ping gateway (global ip) and its alive and internet alive ...

I've tried second scenario (global IP for WAN of client router and link local at lan) result wan pingable not internet at lan ...

same problem at 3 different routers (TP-LINK Archer C7, tplink 1045N, ubnt router)

To make it work i have to make static config at WAN (with gateway global) + make static router from Mikrotik ->WAN router -> prefix LAN (to make it work and pingable inter LAN) but that thing work for random time from several days to week but any way it failes ...

I need to make it work with SLAAC config for router (to keep all auto), i've to make some way to auto write static route WAN client router->LAN prefix (or make it work with WAN global -> LAN link-local (more safe))

danunjaya123 · Sun Nov 03, 2019 5:23 pm

My PPPoE issue was resolved but coming to DHCP for my office purpose there i was issues.
1. Unable to get Default Gateway
2. Unable to get DNS.

I have issue with IPv6 in DHCP and PPPoE, Im not able to get gateway and DNS for clients.

May i Know how it will be come on PPPoE and DHCP.

Mikrotik CCR1036-12G-4S
I got help from Mikrotik team and they given me solution on PPPoE DNS.
Use IPv6 dns servers in IP - DNS settings and distribute IPv6 prefixes to your clients via SLAAC solicitation.

mducharme · Sun Nov 03, 2019 9:27 pm

Yes it get link local gateway but ... (look at my routetabels posted above) problem that there is no route to global adress that users get at LAN behind router ... and no internet at all ...

This suggests your DHCPv6 prefix delegation server is not working. It is the role of DHCPv6 prefix delegation server to automatically add a route for this subnet to the router acting as the DHCPv6 server. You probably do not have it configured correctly.

But I thought your MikroTik was the DHCPv6 prefix delegation server? or have you replaced the MikroTik with a Ubiquiti?

mducharme · Sun Nov 03, 2019 10:07 pm

that what is going on if DHCPv6 SERVER ENABLED
dhcpv6.png

new prefix each 30-60 sec

That appears to be a Ubiquiti bug or wrong setting, it is generating a new DUID each time it requests a prefix. The info field shows the DUID. The DUID is supposed to be fixed for a given router and never change. Your router changing its DUID would be like a router on IPv4 changing its mac address each time it makes a DHCP request so that each time it appears to be a different customer.

Ripper · Mon Nov 04, 2019 2:12 am

That issue got TP-LINK routers DUID new each time ...

I've disable DHCPv6 becouse of that ...

mducharme · Mon Nov 04, 2019 3:08 am

That issue got TP-LINK routers DUID new each time ...

I've disable DHCPv6 becouse of that ...

Can’t you just replace the TPlink devices? Or upgrade them to fix it? Disabling DHCPV6 is not a good solution, IPV6 with manual config is too much work.

danunjaya123 · Mon Nov 18, 2019 1:25 pm

I think Google DNS is not going resolve any sites immediately, I have tried with Cloud fare DNS this is better than google DNS.

Yes.
Can you ping ipv6 address of your ISP from your router? Can you ping 2001:4860:4860::8888 from your router?

Who is online