So if the "IPv6-only" uplink port is configured for hw=no on the relevant /interface bridge port row, it is well possible that this is the reason why the switch chip rule is bypassed.
i did see that too, and i tried to enable and disable hardware offload to verify if the switch filter is influenced by this setting.
But that make no difference.
I suspect that the "set new destination ports" action in the switch filter does not work if the source port is the switch CPU. Or perhaps that there is no filter available at all for this direction of traffic.
Badly, this is not documented, i think, at least in the Mikrotik help. Should be in the chip documentation nevertheless but i'm not ready to digest that.
So if I get you right, the "IPv6 uplink" port is part of the "IPv4 LAN" bridge, and the "IPv4 uplink" port is either a member of its own bridge or not a member of any bridge at all, correct?
Exact. In fact i have three entities that manage this IPv4 routing / IPv6 hybrid setup :
- A single router port for ISP IPv4, not inside a bridge because there was here no other L2 network to bridge with.
- A Bridge for the main data network, where the ISP IPv6 "main data" port is.
- A bridge for the guest data network, where the ISP IPv6 "guest data" port is.
Other subnetworks don't have IPv6 so they are only routed to the default route (SIP telephony, management and wifi Capsman backbone network for example). They don't have an ISP IPv6 port for bridging IPv6 to them.
Those three physical ports are connected to the ISP box switch. Before i bought the RB3011, i was bridging those 3 ports and filtering them in a Metarouter instance. But in the RB3011 there is no more Metarouter so to avoid a bridge cascade, i idid use three cables to the ISP box.
Another solution, i think, to remove the need for an external switch and 3 cables, would be to use a single bridge for all ports, activate Brige VLAN filter for more safety, and put VLAN interfaces on top of this bridge instead of between each bridge and each bridge port needing vlan unencapsulation .
Nevertheless this would make filtering inside this big Bridge more error prone. I did try it i think a couple years ago but gave up because of the complexity.
Anyway, soon i will change this ISP old box disaster and get a solution with routable IPv6 and direct connection to the fiber !! It's still here mainly because providers here rise their price 30% up if you upgrade with a new box.
But the story was very interesting and formative.
Thanks for the mndp interface discovery trick, i thought to this this morning and i'm going to try it.