Don't tell me that you did not know that the firewall rule is just a wrapper for an iptables command, or ip6tables to be exact. That's why I mentioned iptables directly instead of routerOS firewall.

When I talk about Shodan, I am talking about client-level security in general, not IPv6 only to be exact. The devices you see in Shodan are all devices with lousy client-level security implementations, but you assume that all devices out there has stellar client-level security implementations, at least for IPv6. You rely too much on the hope that device manufacturers will implement robust security on their IPv6-supporting devices, but not all will do so, just like Sony.

Probably that the option, the last I did was just factory reset, perhaps can give this a try when I have more free time to do this.
I did not test speed in particular but I have no issue for 500Mbps on default Speedtest,believedjust using IPv4.

Here you go, I have even try disable all the bridge to test it out.

Disabled all IPv6 filter rules and not helping. Able to max out to 320Mbps and CPU is still 100% when speedtesting.

I see. Attached.

iptv basically following this guide for Unifi IPTV 600
Vlan 10 for "guest" network, no LAN access.

See if this can see the settings

1. Queue - yes enabled queue tree


2. Tools> Profile

3. Address list from IPV6
[attachmentid=11488503]


4. Filter Rules are default, never add additional rules.

same lingering around 300-350Mbps after disabling all filter rules, address lists

I will share the export later.
This is how it is connected.

Update the diagram. The 500 actually is just for trunk the Internet to the switch, Unifi TV box is connected to the switch that is why 500 & 600 is trunk
See if this is what you looking for?

Yeah, could you please help to change things for the right way?

/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2-master internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf hw=no ingress-filtering=no interface=sfp1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf ingress-filtering=no interface=wlan2 internal-path-cost=10 path-cost=10
add bridge=UniFi-IPTV ingress-filtering=no interface=vlan.600-TrunkPort5 internal-path-cost=10 path-cost=10
add bridge=bridge hw=no ingress-filtering=no interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge disabled=yes ingress-filtering=no interface=vlan.500-TrunkPort5 internal-path-cost=10 path-cost=10
add bridge=UniFi-IPTV ingress-filtering=no interface=vlan.600 internal-path-cost=10 path-cost=10
add bridge=bridge ingress-filtering=no interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge ingress-filtering=no interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge.vlan10 ingress-filtering=no interface=wlan3 internal-path-cost=10 path-cost=10
add bridge=bridge.vlan10 ingress-filtering=no interface=vlan.10-TrunkPort5 internal-path-cost=10 path-cost=10
add bridge=bridge.vlan10 ingress-filtering=no interface=vlan.10-Gesuto internal-path-cost=10 path-cost=10
add bridge=bridge.vlan10 ingress-filtering=no interface=vlan.10-TrunkPort4 internal-path-cost=10 path-cost=10
Ok, does this looks correct. I've remove the VLAN on switch, a quick test looks ok.
Now does that mean I do no need to trunk 500 for vlan , only need the trunk 600 for IPTV?

Sadly, my IPv6 still does not appear.

Do you mean factory restore and restore configuration?

I'm planning to set up a new networking system for my new double-storey house. I'm thinking of placing a MikroTik CSS610-8G-2S+IN on the first floor and a CRS112-8G-4S-IN on the second floor, with multimode fiber for the interconnect.

Is it possible to configure LACP between a CRS running RouterOS and a CSS running SwOS?

Any links/tips to downgrade from RouterOS7.x to RouterOS6.x?

no hope with RB750 on ipv6. still at 350Mbps. I think I have bricked it when trying to install openwrt's initramfs after successfully downgraded to 6.49.2.
Will try to debrick it when I have time.

Tried, still IPv6 does not appear.
One question, how should I configure if I still want to trunk my vlan500?

Thanks man for the research.  So the CRS is not supporting LACP, only static bonding without any control protocol.
The biggest effort is actually pulling the cable between the floors. I actually don't mind whether it is a copper or fiber, the cost is not that significant (apart from additional cost for the SFP/SFP+). Redundancy is important, that's why I am pulling two cables. I can start with 1G if I want and replace it with a 10G SFP in the future. But yeah, thanks for the input.