Unable to ping IPv6 address

BeNe · Mon Mar 17, 2025 10:21 pm

Hello community,

I have a Mikrotik Chataeu LTE 6 (Vodafone Germany with Ultracard)
IPv6 is enabled and my client on the LAN side is successfully receiving an IPv6 from the router. I am surfing over IPv6 and IPv4 without any problems.
But I am not able to ping the IPv6 address from the router itself or from the client.

Here are my IPv6 addresses

[admin@MikroTik] > /ipv6/address/print 
Flags: I - INVALID; D - DYNAMIC; G - GLOBAL, L - LINK-LOCAL
Columns: ADDRESS, FROM-POOL, INTERFACE, ADVERTISE
 #     ADDRESS                                    FROM-POOL  INTERFACE         ADVERTISE
 0  DL fe80::b76f:a4e9:f821:ba2/64                           back-to-home-vpn  no       
 1  D  ::1/128                                               lo                no       
;;; back-to-home-vpn
 2  DG fc00:0:0:216::1/64                                    back-to-home-vpn  yes      
 3  DL fe80::f61e:57ff:fe15:a690/64                          bridgeLocal       no       
 4  DL fe80::c484:2cff:fed1:4c71/64                          Vodafone LTE      no       
 5  DG fec0:0:0:ffff::1/64                                   bridgeLocal       no       
 6  DG 2a00:20:c009:e995::/64                                bridgeLocal       yes      
 7  DG 2a00:20:c009:e995:f61e:57ff:fe15:a690/128             bridgeLocal       no       
 8  DG 2a00:20:c009:e995:200:ff:fe00:0/128                   Vodafone LTE      no       
;;; OPNsense
 9 I G ::/64                                                 bridgeLocal       yes      
;;; OPNsense
10   G fddd::/64                                  ula-pool6  bridgeLocal       yes

Here my IPv6 Firewall settings - ICMPv6 is allowed in the first rule

[admin@MikroTik] > /ipv6/firewall/filter/export 
# 2025-03-17 18:55:10 by RouterOS 7.18.2
# software id = 7HVT-9KPZ
#
# model = D53G-5HacD2HnD&FG621-EA
/ipv6 firewall filter
add action=accept chain=input comment="Permit ICMP" log=yes protocol=icmpv6
add action=accept chain=forward comment=established,related connection-state=established,related
add action=drop chain=forward comment=invalid connection-state=invalid log=yes log-prefix=ipv6,invalid
[admin@MikroTik] >

I would expect to be able to ping the global IPv6 address of the router from the Internet.
And that I can ping the IPv6 address from the client.

Did i missed a firewall rule ?
Thanks for any help.

itimo01 · Mon Mar 17, 2025 11:24 pm

I would expect to be able to ping the global IPv6 address of the router from the Internet.

Usually in germany the mobile operators have an ipv6 firewall.
Which iirc also applies for Vodafone.

There are special APNs you can use with o2 and Telekom, but that's about it. No clue about Vodafone.

But I am not able to ping the IPv6 address from the router itself or from the client.

1. I do hope you got more firewall rules than that. As Mikrotik clearly states ALLOW ALL is default.
2. Where do you ping from? Mikrotik or Client on LAN? And where to? As your router obviously has multiple IPv6 Addresses.

BeNe · Tue Mar 18, 2025 7:48 pm

Usually in germany the mobile operators have an ipv6 firewall.
Which iirc also applies for Vodafone.

Yes true, Vodafone blocks all incoming traffic on their firewall inside the mobile network!
That's the reason why i don´t receive an ICMP package or other TCP connections via LTE. There is also no option to change to another APN.
Ping from Internal LAN to the LAN Interface is fine.

1. I do hope you got more firewall rules than that. As Mikrotik clearly states ALLOW ALL is default.

Yes

It's a Fallback-Line for the OPNsense Firewall

2. Where do you ping from? Mikrotik or Client on LAN? And where to? As your router obviously has multiple IPv6 Addresses.

From one of my Server located inside the Hetzner Datacenter and from some Online IPv6 Ping Tools

So the traffic is blocked incoming and i will change my Setup to a Wireguard Tunnel and route the traffic inside through that tunnel.
Thanks for your help!

Unable to ping IPv6 address [SOLVED]

Unable to ping IPv6 address

Re: Unable to ping IPv6 address [SOLVED]

Re: Unable to ping IPv6 address