Mikrotik Unifi PPPoE IPV6 configuration (tested on RB750 ROS 5.17 + BSRBRF01)
Prerequisites :i. IPV6 RouterOS modules loaded in System -> Packages (Winbox)
ii. PPPoE Client profile (default) must have IPV6 set to Yes n PPP -> Profiles -> 'default' -> Protocols (Use IPv6 = Yes)
1. Replace "ether1_vlan500_UNIFI" with the name of your Unifi PPPoE client interface :
In terminal :
CODE
/ipv6 dhcp-client add interface="ether1_vlan500_UNIFI" pool-name="pppoev6" disabled=no
2. Terminal on my RouterOS says the commands for IPv6 addressing are invalid .. so use Winbox GUI and go into :
CODE
IPv6 -> Addresses
Add a new IPv6 address :
Address = ::/64
From Pool = pppoev6
Interface = ether2-local-master (replace with your LAN switch master port)
EUI64 = No
Advertise = Yes
3. Disable and enable your PPPoE client interface. It should get a new DHCPv6 prefix which will propagate to your IPv6 address list and LAN clients.
CODE
/interface pppoe-client disable ether1_vlan500_UNIFI; /interface pppoe-client enable ether1_vlan500_UNIFI
...
Reconnect your LAN clients and it should auto negotiate an IPv6 address for them.
** Do not set static /64 prefixes, they appear to be dynamic and unique to your PPPoE session ID and will change upon reconnect.
TCP MSS Fix :As
pointed out by wKkaY, use the MTU flag in the IPv6 RA to advertise the proper link MTU to your clients :
In Winbox :
IPv6 -> ND
Select your default ND (operates on 'all' interfaces by default), change the MTU option to 1480 (or whatever your PPPoE MTU is) :
Old MSS mangle fix below (
don't use this unless the above method isn't working for you) :
» Click to show Spoiler - click again to hide... «
Mangle rules so sites like Cloudflare will load. Clamps MSS to -20 bytes under IPv4 default which is 1440 (to match the difference between IPv4 and IPv6 header sizes).
CODE
/ipv6 firewall mangle add action=change-mss chain=forward disabled=no in-interface=ether1_vlan500_UNIFI new-mss=1420 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1421-65535
/ipv6 firewall mangle add action=change-mss chain=forward disabled=no new-mss=1420 out-interface=ether1_vlan500_UNIFI passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1421-65535
IPv6 -> ND -> Prefixes tab -> Default
Set a 2H/1H valid/preferred lifetime for your prefixes :
Firewall Configuration (Security):Enabling the IPv6 stack means no NAT to protect you and no firewall rules (by default) to prevent someone from hitting your Mikrotik login at ::0 or your devices behind the router. Setup these firewall rules to protect your network.
Replace "ether1_vlan500_UNIFI" with the name of your Unifi PPPoE client interface :
CODE
/ipv6 firewall filter add action=accept chain=input connection-state=established disabled=no in-interface=ether1_vlan500_UNIFI
/ipv6 firewall filter add action=accept chain=forward connection-state=established disabled=no in-interface=ether1_vlan500_UNIFI
/ipv6 firewall filter add action=accept chain=input connection-state=related disabled=no in-interface=ether1_vlan500_UNIFI
/ipv6 firewall filter add action=accept chain=forward connection-state=related disabled=no in-interface=ether1_vlan500_UNIFI
/ipv6 firewall filter add action=accept chain=input disabled=no dst-port=546 in-interface=ether1_vlan500_UNIFI protocol=udp src-address=fe80::/16
/ipv6 firewall filter add action=drop chain=input disabled=no in-interface=ether1_vlan500_UNIFI
/ipv6 firewall filter add action=drop chain=forward disabled=no in-interface=ether1_vlan500_UNIFI
** input chain rules affect traffic heading to ::0 (your router's public IPv6), forward chain rules affect traffic from your clients behind the router
** Updated firewall rules to whitelist DHCPv6 packets
** MTU value tag used rather than iptables6 mangle for TCP MSS fixing
** Lower prefix expiry (30days/7days vs 2hours/1hour) to match Unifi's dynamic IPv6 prefix distribution
This post has been edited by rizvanrp: Oct 21 2013, 08:40 PM 
Oct 1 2013, 12:35 AM, updated 9y ago
)
ipv6.pcap.zip ( 922bytes )
Number of downloads: 1041
Quote
last time 115.x.x.x 
is he going to restore the site anytime soon 
0.3095sec
1.74
6 queries
GZIP Disabled