Mikrotik Unifi PPPoE IPV6 configuration (tested on RB750 ROS 5.17 + BSRBRF01)

Prerequisites :

i. IPV6 RouterOS modules loaded in System -> Packages (Winbox)
ii. PPPoE Client profile (default) must have IPV6 set to Yes n PPP -> Profiles -> 'default' -> Protocols (Use IPv6 = Yes)

1. Replace "ether1_vlan500_UNIFI" with the name of your Unifi PPPoE client interface :

In terminal :



2. Terminal on my RouterOS says the commands for IPv6 addressing are invalid .. so use Winbox GUI and go into :



3. Disable and enable your PPPoE client interface. It should get a new DHCPv6 prefix which will propagate to your IPv6 address list and LAN clients.


...

Reconnect your LAN clients and it should auto negotiate an IPv6 address for them.

** Do not set static /64 prefixes, they appear to be dynamic and unique to your PPPoE session ID and will change upon reconnect.

TCP MSS Fix :

As pointed out by wKkaY, use the MTU flag in the IPv6 RA to advertise the proper link MTU to your clients :

In Winbox :

IPv6 -> ND

Select your default ND (operates on 'all' interfaces by default), change the MTU option to 1480 (or whatever your PPPoE MTU is) :



Old MSS mangle fix below (don't use this unless the above method isn't working for you) :


Faster prefix expiry :

IPv6 -> ND -> Prefixes tab -> Default

Set a 2H/1H valid/preferred lifetime for your prefixes :




Firewall Configuration (Security):

Enabling the IPv6 stack means no NAT to protect you and no firewall rules (by default) to prevent someone from hitting your Mikrotik login at ::0 or your devices behind the router. Setup these firewall rules to protect your network.

Replace "ether1_vlan500_UNIFI" with the name of your Unifi PPPoE client interface :


** input chain rules affect traffic heading to ::0 (your router's public IPv6), forward chain rules affect traffic from your clients behind the router

** Updated firewall rules to whitelist DHCPv6 packets

** MTU value tag used rather than iptables6 mangle for TCP MSS fixing

** Lower prefix expiry (30days/7days vs 2hours/1hour) to match Unifi's dynamic IPv6 prefix distribution

This post has been edited by rizvanrp: Oct 21 2013, 08:40 PM

1. Nope, it's getting a link local address then negotiating DHCPv6 over that via its DHCPv6 client. I've only seen the rp-pppoe client manage to negotiate a public IPv6 prefix using ICMPv6 RA's .. that's the client being used in TM's routers anyway. I think Mikrotik is using a modified older version of rp-pppoe or proprietary client.

2. For that MSS clamping command, I simply duplicated the mangle rules created by Mikrotiks default PPP profile (Change TCP MSS - yes) and reduced the MSS size by 20 bytes. I was seeing IPv4 headers at 20 bytes and IPv6 headers at 40 bytes .. so I figured reducing the MSS clamping rule by that difference would be enough to accommodate the larger IPv6 header size.

iptables man page also seems to assume a 20 byte MSS difference :


I'm not sure why you would need to clamp to PMTU specifically as path MTU discovery in IPv6 doesn't operate the same way as it does in IPv4 and assumes the MTU is that of the link layer interface.

3. There seem to be a few bugs in Mikrotik's IPv6 implementation. I noted a GUI/terminal bug in my guide where I wasn't able to use the exported configuration from the Winbox GUI on the terminal. The router had no issues updating its IPv6 address list upon disabling/enabling the PPPoE client interface however I'm not sure how it would behave if the session hung or was disconnected administratively at the BRAS. Router reboots also seem to cause some instability with its ability to obtain a DHCPv6 lease and distribute the /64 to LAN clients. And yeah, I had to constantly bring the client interfaces down and up in order to get it to update the prefixes.

When I was testing it back at the lab in TM, accounts were assigned static /64 prefixes and I did not need to test DHCPv6 as the rp-pppoe client was able to obtain the prefix by itself. I think it should be possible to script the Mikrotik to rectify these issues though.

Oh okay. I had to set 4 additional commands inside the rp-pppoe config to get it to obtain an IPv6 address so I assumed it was rp-pppoe

** My bad, it was pppd's config

This post has been edited by rizvanrp: Oct 18 2013, 10:03 PM

Setting a smaller MTU in the RA's seems the possible using the IPv6 -> ND option in RouterOS

I just tested using both my Windows/Linux boxes.

i. Manually changing the IPv6 address in ROS or disabling/enabling the PPPoE client (sending a PPPoE terminate request and obtaining a new /64 prefix), the Mikrotik sends out an RA and the clients will have the previous + current /64's bound
ii. A BRAS session reset from the headend results in the same behavior from the client .. so hung sessions or administrative disconnects shouldn't be a problem

My Linux client doesn't seem to be unaffected when having multiple /64 prefixes on the interface. Refreshing the client interface may only be needed if you want to purge the older invalid prefixes but it doesn't seem to affect the ability for the clients to utilize IPv6 as long as one of the prefixes is valid. I've tried getting the Routerboard to force the clients to drop the older prefix but nothing seems to work so far.

Interestingly, during one of the server side session terminates I requested.. I was reassigned the same IPv4 address but my IPv6 prefix was incremented by 1.. so it seems the IPv6 prefix isn't being derived from the IPv4 value but rather the session identifier itself.

Agreed, the mangle rules have an additional disadvantage of using more resources on the router. Setting the MTU flag in the RAs seems to work

My only remaining issue is getting rid of the expired v6 prefixes once the session is killed. My home server interface currently looks like this.. :

Adjustable in IPv6 -> ND -> Prefixes -> Default for RouterOS

No Unifi at my site so maybe someone else with a Mikrotik can test if it works

RA is sent immediately after configuration is applied, should be able to script this right?



This post has been edited by rizvanrp: Oct 21 2013, 08:47 PM

Something like this maybe?


I was trying to grab the prefix directly from the interface but no luck, kept getting garbage so I ended up pulling from the DHCPv6 client pool instead

** Updated the if check for the previous IPv6 prefix

This post has been edited by rizvanrp: Oct 21 2013, 10:17 PM

Hey seet, if I'm not mistaken Unifibiz static IP users get a static /56 IPv6 prefix as well (at least this is what I'm seeing on one of my BIZ10 lines). It could be possible that they haven't provisioned a prefix for your account.

It seems only biz accounts created after the IPv6 implementation have a v6 prefix assigned to them. Those on biz accounts created prior to that need to request for a v6 prefix.. non biz users get a dynamic lease based on the PPPoE session.