I'm a new MikroTik user and brand new to this forum.
The problem I am experiencing appears to be that some IPv6 address configuration is lost every time the router reboots, either through fluctuations in power supply or through a manual shutdown. In each case I lose some of my IPv6 configuration. To be explicit, I assign the following addresses to my interfaces:
Code: Select all
/ipv6 address
add address=::1 from-pool=ULA-pool6 interface=bridge
add address=::1 from-pool=general-pool6 interface=bridge-guest
add address=::1 from-pool=general-pool6 interface=bridge
add address=::1 from-pool=ULA-pool6 interface=bridge-guest
This all works as expected and the router functions as intended. All IPv6 addresses are assigned to my interfaces, advertised and I have complete (IPv4 and IPv6) connectivity for all connected SLAAC devices and router itself.
However, when the router reboots after a power outage or manual shutdown, only a part of my initial address assignment remains. If I type "/ipv6 address export" after a reboot I see:
Code: Select all
/ipv6 address
add address=::1 from-pool=ULA-pool6 interface=bridge
add address=::1 from-pool=general-pool6 interface=bridge-guest
This loss of address assignment configuration (and hence no corresponding addresses are being assigned) has happened repeatedly and consistently after 2 short power outages and one manual shutdown.
I have upgraded to RouterOS 6.49.7 and some time later (probably the better part of a week) upgraded the firmware to 6.49.7.
I have Googled and I am aware that similar problems have existed in some versions of RouterOS: viewtopic.php?t=184711&sid=a03de18f52ad ... b4c576e3cc However, I am not sure whether I am being bitten by a similar bug or some other mis-configuration is to blame (I am new to this). Any help, guidance or pointers would be much appreciated.
My full configuration is below:
Code: Select all
# may/05/2023 11:23:48 by RouterOS 6.49.7
# software id = 9KW1-TWC8
#
# model = RB760iGS
# serial number = xxxxxxxxxx
/interface bridge
add admin-mac=48:A9:8A:17:0C:13 auto-mac=no comment="Private LAN" name=bridge
add name=bridge-guest
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 use-peer-dns=yes user=\
joesoap@bestip.com
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add comment="Changed address pool for DHCP" name=dhcp ranges=10.17.227.31-10.17.227.254
add comment="Guest network address pool" name=dhcp_pool1 ranges=10.28.107.2-10.28.107.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=1d name=defconf
add address-pool=dhcp_pool1 disabled=no interface=bridge-guest lease-time=1h name=dhcp1
/ipv6 pool
add name=ULA-pool6 prefix=fd19:8a99:2d5e::/56 prefix-length=64
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=sfp1
add bridge=bridge-guest interface=ether3
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf disabled=yes interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add comment="Added bridge-guest to LAN interfaces" interface=bridge-guest list=LAN
/ip address
add address=10.17.227.1/24 comment="Changed default router address" interface=bridge network=\
10.17.227.0
add address=10.28.107.1/24 interface=bridge-guest network=10.28.107.0
/ip cloud
set update-time=no
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server network
add address=10.17.227.0/24 gateway=10.17.227.1 netmask=24
add address=10.28.107.0/24 gateway=10.28.107.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=2001:4860:4860::8888
/ip dns static
add address=10.17.227.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" \
dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=\
established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="Deny guest network traffic access to the private LAN" \
dst-address=10.17.227.0/24 src-address=10.28.107.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none \
out-interface-list=WAN src-address=10.17.227.0/24
add action=masquerade chain=srcnat comment="Allow guest network access to the internet" \
ipsec-policy=out,none out-interface-list=WAN src-address=10.28.107.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set winbox address=10.17.227.0/24
set api-ssl disabled=yes
/ipv6 address
add address=::1 from-pool=ULA-pool6 interface=bridge
add address=::1 from-pool=general-pool6 interface=bridge-guest
add address=::1 from-pool=general-pool6 interface=bridge
add address=::1 from-pool=ULA-pool6 interface=bridge-guest
/ipv6 dhcp-client
add add-default-route=yes interface=pppoe-out1 pool-name=general-pool6 request=prefix \
use-peer-dns=no
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6
add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6
add address=::/104 comment="defconf: other" list=bad_ipv6
add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=\
udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." \
dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" \
ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=\
bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=\
bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 \
protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" \
ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" \
in-interface-list=!LAN
/ipv6 nd
set [ find default=yes ] disabled=yes
add interface=bridge ra-interval=20s-1m
add interface=bridge-guest
/system clock
set time-zone-name=Europe/London
/system identity
set name=RouterOS
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Richard