TM unifi ipv6 and Mikrotik not working

Lowyat.NET forums

Lowyat.NET Kopitiam Garage Sales

Lowyat.NET Rules and Regulations FAQ Help Search Members

Welcome Guest ( Log In | Register )

Lowyat.NET -> Networks and Broadband

Bump Topic Add Reply RSS Feed

2 Pages 1 2 >Bottom

Outline · [ Standard ] · Linear+

TM unifi ipv6 and Mikrotik not working

views

TSPC_CHEAH	Jan 23 2020, 10:33 PM, updated 6y ago Show posts by this member only \| Post #1
Getting Started Junior Member 67 posts Joined: Jun 2015	So far setting this Mikrotik router, I got ipv4 and iptv working, but ipv6 is not working, I followed this guide: https://forum.lowyat.net/index.php?showtopi...&#entry63945436 and also this: https://klseet.com/?view=article&id=258:unifi-ipv6&catid=5 but still not working, not sure what has gone wrong. I got somehow stuck when setting up IPv6 Pool, so I just put ::/40 instead ( the error dialog pops out when I put ::/0 ) here's my ipv6 export: » Click to show Spoiler - click again to hide... « # jan/23/2020 22:23:22 by RouterOS 6.46.2 # software id = RTIL-H9KX # # model = 2011UiAS # serial number = *********** /ipv6 pool add name=pppoev6 prefix=::/40 prefix-length=64 /ipv6 address add from-pool=pppoev6 interface=ether1 /ipv6 dhcp-client add interface=pppoe-unifi pool-name=pppoev6 request=prefix /ipv6 firewall filter add chain=input protocol=icmpv6 add chain=input connection-state=established,related add chain=input dst-port=546 in-interface=ether1 protocol=udp src-port=547 add action=drop chain=input connection-state=invalid add action=drop chain=input connection-state=new in-interface=ether1 add chain=forward protocol=icmpv6 add chain=forward connection-state=established,related add chain=forward connection-state=new in-interface=!ether1 add action=drop chain=forward connection-state=invalid add action=drop chain=forward connection-state=new in-interface=ether1 /ipv6 nd set [ find default=yes ] interface=bridge mtu=1480 /ipv6 nd prefix default set preferred-lifetime=1h valid-lifetime=2h
Card PM	Report Top Like Quote Reply

soonwai	Jan 23 2020, 10:45 PM Show posts by this member only \| Post #2
 All Stars 11,460 posts Joined: Oct 2007 From: KL	QUOTE(PC_CHEAH @ Jan 23 2020, 10:33 PM) So far setting this Mikrotik router, I got ipv4 and iptv working, but ipv6 is not working, I followed this guide: https://forum.lowyat.net/index.php?showtopi...&#entry63945436 and also this: https://klseet.com/?view=article&id=258:unifi-ipv6&catid=5 but still not working, not sure what has gone wrong. I got somehow stuck when setting up IPv6 Pool, so I just put ::/40 instead ( the error dialog pops out when I put ::/0 ) here's my ipv6 export: » Click to show Spoiler - click again to hide... « # jan/23/2020 22:23:22 by RouterOS 6.46.2 # software id = RTIL-H9KX # # model = 2011UiAS # serial number = *********** /ipv6 pool add name=pppoev6 prefix=::/40 prefix-length=64 /ipv6 address add from-pool=pppoev6 interface=ether1 /ipv6 dhcp-client add interface=pppoe-unifi pool-name=pppoev6 request=prefix /ipv6 firewall filter add chain=input protocol=icmpv6 add chain=input connection-state=established,related add chain=input dst-port=546 in-interface=ether1 protocol=udp src-port=547 add action=drop chain=input connection-state=invalid add action=drop chain=input connection-state=new in-interface=ether1 add chain=forward protocol=icmpv6 add chain=forward connection-state=established,related add chain=forward connection-state=new in-interface=!ether1 add action=drop chain=forward connection-state=invalid add action=drop chain=forward connection-state=new in-interface=ether1 /ipv6 nd set [ find default=yes ] interface=bridge mtu=1480 /ipv6 nd prefix default set preferred-lifetime=1h valid-lifetime=2h No need to create the pool, the DHCPv6 client will do that for you.
Card PM	Report Top Like Quote Reply

TSPC_CHEAH	Jan 23 2020, 11:10 PM Show posts by this member only \| Post #3
Getting Started Junior Member 67 posts Joined: Jun 2015	QUOTE(soonwai @ Jan 23 2020, 10:45 PM) No need to create the pool, the DHCPv6 client will do that for you. Okay, now when I test ipv6 and I got this: I remember I set MTU somewhere but not sure UPDATE: now it does not work anymore. This post has been edited by PC_CHEAH: Jan 23 2020, 11:27 PM
Card PM	Report Top Like Quote Reply

soonwai	Jan 23 2020, 11:33 PM Show posts by this member only \| Post #4
 All Stars 11,460 posts Joined: Oct 2007 From: KL	QUOTE(PC_CHEAH @ Jan 23 2020, 11:10 PM) Okay, now when I test ipv6 and I got this: I remember I set MTU somewhere but not sure UPDATE: now it does not work anymore. Here's my config. I see that you set mtu 1480 in /ipv6 nd. I don't think that matters but try removing that. Mine is unspecified. Ensure your ipv6 firewall accepts & forwards icmpv6. See my config. » Click to show Spoiler - click again to hide... « CODE /ipv6 address add address=::/64 advertise=yes disabled=no eui-64=no from-pool=ipv6pool50 interface=vlan50 no-dad=no /ipv6 dhcp-client add add-default-route=no dhcp-options="" disabled=yes interface=pppoe-out1 pool-name=ipv6pool50 pool-prefix-length=64 \ prefix-hint=::/0 request=prefix use-peer-dns=no /ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" disabled=no dynamic=no list=bad_ipv6 add address=::1/128 comment="defconf: lo" disabled=no dynamic=no list=bad_ipv6 add address=fec0::/10 comment="defconf: site-local" disabled=no dynamic=no list=bad_ipv6 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" disabled=no dynamic=no list=bad_ipv6 add address=::/96 comment="defconf: ipv4 compat" disabled=no dynamic=no list=bad_ipv6 add address=100::/64 comment="defconf: discard only " disabled=no dynamic=no list=bad_ipv6 add address=2001:db8::/32 comment="defconf: documentation" disabled=no dynamic=no list=bad_ipv6 add address=2001:10::/28 comment="defconf: ORCHID" disabled=no dynamic=no list=bad_ipv6 add address=3ffe::/16 comment="defconf: 6bone" disabled=no dynamic=no list=bad_ipv6 add address=::224.0.0.0/100 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::127.0.0.0/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::255.0.0.0/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\ fe80::/10 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=forward comment="defconf: accept HIP" protocol=139 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN /ipv6 nd set [ find default=yes ] advertise-dns=no advertise-mac-address=yes disabled=no hop-limit=unspecified interface=all \ managed-address-configuration=no mtu=unspecified other-configuration=no ra-delay=3s ra-interval=3m20s-10m ra-lifetime=30m \ reachable-time=unspecified retransmit-interval=unspecified /ipv6 nd prefix default set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d /ipv6 settings set accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes-if-forwarding-disabled forward=yes \ max-neighbor-entries=8192 [/spolier] This post has been edited by soonwai: Jan 23 2020, 11:35 PM
Card PM	Report Top Like Quote Reply

TSPC_CHEAH	Jan 24 2020, 12:36 AM Show posts by this member only \| Post #5
Getting Started Junior Member 67 posts Joined: Jun 2015	QUOTE(soonwai @ Jan 23 2020, 11:33 PM) Here's my config. I see that you set mtu 1480 in /ipv6 nd. I don't think that matters but try removing that. Mine is unspecified. Ensure your ipv6 firewall accepts & forwards icmpv6. See my config. » Click to show Spoiler - click again to hide... « CODE /ipv6 address add address=::/64 advertise=yes disabled=no eui-64=no from-pool=ipv6pool50 interface=vlan50 no-dad=no /ipv6 dhcp-client add add-default-route=no dhcp-options="" disabled=yes interface=pppoe-out1 pool-name=ipv6pool50 pool-prefix-length=64 \ prefix-hint=::/0 request=prefix use-peer-dns=no /ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" disabled=no dynamic=no list=bad_ipv6 add address=::1/128 comment="defconf: lo" disabled=no dynamic=no list=bad_ipv6 add address=fec0::/10 comment="defconf: site-local" disabled=no dynamic=no list=bad_ipv6 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" disabled=no dynamic=no list=bad_ipv6 add address=::/96 comment="defconf: ipv4 compat" disabled=no dynamic=no list=bad_ipv6 add address=100::/64 comment="defconf: discard only " disabled=no dynamic=no list=bad_ipv6 add address=2001:db8::/32 comment="defconf: documentation" disabled=no dynamic=no list=bad_ipv6 add address=2001:10::/28 comment="defconf: ORCHID" disabled=no dynamic=no list=bad_ipv6 add address=3ffe::/16 comment="defconf: 6bone" disabled=no dynamic=no list=bad_ipv6 add address=::224.0.0.0/100 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::127.0.0.0/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::255.0.0.0/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\ fe80::/10 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=forward comment="defconf: accept HIP" protocol=139 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN /ipv6 nd set [ find default=yes ] advertise-dns=no advertise-mac-address=yes disabled=no hop-limit=unspecified interface=all \ managed-address-configuration=no mtu=unspecified other-configuration=no ra-delay=3s ra-interval=3m20s-10m ra-lifetime=30m \ reachable-time=unspecified retransmit-interval=unspecified /ipv6 nd prefix default set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d /ipv6 settings set accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes-if-forwarding-disabled forward=yes \ max-neighbor-entries=8192 [/spolier] I followed some of your configs and still doesn't getting it to work. In the route list, something says unreachable which I'm not sure what it is the dhcpv6 server is empty, my clients doesnt get any ipv6 address. » Click to show Spoiler - click again to hide... « # jan/24/2020 00:34:35 by RouterOS 6.46.2 # software id = RTIL-H9KX # # model = 2011UiAS # serial number = - /ipv6 address add from-pool=ipv6pool50 interface=vlan500 /ipv6 dhcp-client add interface=pppoe-unifi pool-name=ipv6pool50 request=prefix use-peer-dns=no /ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" list=bad_ipv6 add address=::1/128 comment="defconf: lo" list=bad_ipv6 add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6 add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6 add address=100::/64 comment="defconf: discard only " list=bad_ipv6 add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6 add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6 add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6 add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6 add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6 add address=::/104 comment="defconf: other" list=bad_ipv6 add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" \ connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 \ protocol=udp add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." \ dst-port=546 protocol=udp src-address=fe80::/10 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=input comment="defconf: accept all that matches ipsec policy" \ ipsec-policy=in,ipsec add action=drop chain=input comment="defconf: drop everything else not coming from in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept established,related,untrac connection-state=established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=inva add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \ src-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \ dst-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit equal:1 protocol=icmpv6 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=forward comment="defconf: accept HIP" protocol=139 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 pro udp add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-a add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec- add action=accept chain=forward comment="defconf: accept all that matches ipsec pol ipsec-policy=in,ipsec add action=drop chain=forward comment="defconf: drop everything else not coming fro in-interface-list=!LAN /ipv6 nd set [ find default=yes ] advertise-dns=no
Card PM	Report Top Like Quote Reply

soonwai	Jan 24 2020, 02:52 AM Show posts by this member only \| Post #6
 All Stars 11,460 posts Joined: Oct 2007 From: KL	QUOTE(PC_CHEAH @ Jan 24 2020, 12:36 AM) I followed some of your configs and still doesn't getting it to work. In the route list, something says unreachable which I'm not sure what it is the dhcpv6 server is empty, my clients doesnt get any ipv6 address. » Click to show Spoiler - click again to hide... « # jan/24/2020 00:34:35 by RouterOS 6.46.2 # software id = RTIL-H9KX # # model = 2011UiAS # serial number = - /ipv6 address add from-pool=ipv6pool50 interface=vlan500 /ipv6 dhcp-client add interface=pppoe-unifi pool-name=ipv6pool50 request=prefix use-peer-dns=no /ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" list=bad_ipv6 add address=::1/128 comment="defconf: lo" list=bad_ipv6 add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6 add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6 add address=100::/64 comment="defconf: discard only " list=bad_ipv6 add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6 add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6 add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6 add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6 add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6 add address=::/104 comment="defconf: other" list=bad_ipv6 add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" \ connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 \ protocol=udp add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." \ dst-port=546 protocol=udp src-address=fe80::/10 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=input comment="defconf: accept all that matches ipsec policy" \ ipsec-policy=in,ipsec add action=drop chain=input comment="defconf: drop everything else not coming from in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept established,related,untrac connection-state=established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=inva add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \ src-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \ dst-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit equal:1 protocol=icmpv6 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=forward comment="defconf: accept HIP" protocol=139 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 pro udp add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-a add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec- add action=accept chain=forward comment="defconf: accept all that matches ipsec pol ipsec-policy=in,ipsec add action=drop chain=forward comment="defconf: drop everything else not coming fro in-interface-list=!LAN /ipv6 nd set [ find default=yes ] advertise-dns=no Mikrotik IPv6 Server only supports ipv6 prefix delegation so we don't use that. Instead use RADVD (Router Advertisement) to hand out the IPv6 addresses to your clients. You'll see in my config that there is no ipv6 DHCP server. Not sure why yours all unreachable. What happened to all your IPv6 link local addresses? This post has been edited by soonwai: Jan 24 2020, 03:23 AM
Card PM	Report Top Like Quote Reply

TSPC_CHEAH	Jan 24 2020, 06:45 AM Show posts by this member only \| Post #7
Getting Started Junior Member 67 posts Joined: Jun 2015	QUOTE(soonwai @ Jan 24 2020, 02:52 AM) Mikrotik IPv6 Server only supports ipv6 prefix delegation so we don't use that. Instead use RADVD (Router Advertisement) to hand out the IPv6 addresses to your clients. You'll see in my config that there is no ipv6 DHCP server. Not sure why yours all unreachable. What happened to all your IPv6 link local addresses? The ipv6 address in my pc is like this: my ipv4 export » Click to show Spoiler - click again to hide... « /ip ipsec proposal set [ find default=yes ] enc-algorithms=3des /ip pool add name=dhcp ranges=172.16.8.5-172.16.8.200 /ip dhcp-server add address-pool=dhcp disabled=no interface=bridge name=defconf /ip address add address=172.16.8.4/24 comment=defconf interface=ether2 network=172.16.8.0 /ip cloud set ddns-enabled=yes ddns-update-interval=1m /ip dhcp-client add comment=defconf interface=ether1 /ip dhcp-server lease add address=172.16.8.40 client-id=1:9c:5c:8e:7b:c1:23 mac-address=9C:5C:8E:7B:C1:23 \ server=defconf add address=172.16.8.41 client-id=1:90:fb:a6:4d:63:26 mac-address=90:FB:A6:4D:63:26 \ server=defconf /ip dhcp-server network add address=172.16.8.0/24 comment=defconf gateway=172.16.8.4 netmask=24 /ip dns set servers=2001:4860:4860::8888,2001:4860:4860::8844,8.8.8.8,8.8.4.4 /ip dns static add address=172.16.8.4 comment=defconf name=router.lan /ip firewall address-list add address=xxxxxxxxxxxx.sn.mynetname.net list=WAN-IP /ip neighbor discovery-settings set discover-interface-list=LAN /ip firewall filter add action=accept chain=input comment=WBremote dst-port=8291 protocol=tcp add action=accept chain=input comment="defconf: accept established,related,untracked" \ connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp add action=accept chain=input comment=\ "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept in ipsec policy" \ ipsec-policy=in,ipsec add action=accept chain=forward comment="defconf: accept out ipsec policy" \ ipsec-policy=out,ipsec add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \ connection-state=established,related add action=accept chain=forward comment=\ "defconf: accept established,related, untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \ connection-nat-state=!dstnat connection-state=new in-interface-list=WAN /ip firewall nat add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=172.16.8.0/24 \ src-address=172.16.8.0/24 add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none \ out-interface-list=WAN add action=dst-nat chain=dstnat comment="Minecraft Server port from 172.16.8.40" \ dst-address-list=WAN-IP dst-port=25565 in-interface=pppoe-unifi protocol=tcp \ to-addresses=172.16.8.40 to-ports=25565 /ip ipsec policy set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0 /ip ssh set strong-crypto=yes IPV6 EXPORT » Click to show Spoiler - click again to hide... « /ipv6 address add from-pool=ipv6pool50 interface=vlan500 /ipv6 dhcp-client add interface=pppoe-unifi pool-name=ipv6pool50 request=prefix use-peer-dns=no /ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" list=bad_ipv6 add address=::1/128 comment="defconf: lo" list=bad_ipv6 add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6 add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6 add address=100::/64 comment="defconf: discard only " list=bad_ipv6 add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6 add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6 add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6 add address=::224.0.0.0/100 comment="defconf: other" list=bad_ipv6 add address=::127.0.0.0/104 comment="defconf: other" list=bad_ipv6 add address=::/104 comment="defconf: other" list=bad_ipv6 add address=::255.0.0.0/104 comment="defconf: other" list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" \ connection-state=established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=input comment="defconf: accept UDP traceroute" port=\ 33434-33534 protocol=udp add action=accept chain=input comment=\ "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \ src-address=fe80::/10 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \ protocol=udp add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=input comment="defconf: accept all that matches ipsec policy" \ ipsec-policy=in,ipsec add action=drop chain=input comment=\ "defconf: drop everything else not coming from LAN" in-interface-list=!LAN add action=accept chain=forward comment=\ "defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \ src-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \ dst-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=\ equal:1 protocol=icmpv6 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=forward comment="defconf: accept HIP" protocol=139 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 \ protocol=udp add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=forward comment=\ "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=forward comment=\ "defconf: drop everything else not coming from LAN" in-interface-list=!LAN This post has been edited by PC_CHEAH: Jan 24 2020, 07:05 AM
Card PM	Report Top Like Quote Reply

TSPC_CHEAH	Jan 29 2020, 04:17 PM Show posts by this member only \| IPv6 \| Post #8
Getting Started Junior Member 67 posts Joined: Jun 2015	QUOTE(soonwai @ Jan 24 2020, 02:52 AM) Mikrotik IPv6 Server only supports ipv6 prefix delegation so we don't use that. Instead use RADVD (Router Advertisement) to hand out the IPv6 addresses to your clients. You'll see in my config that there is no ipv6 DHCP server. Not sure why yours all unreachable. What happened to all your IPv6 link local addresses? Ah, finally I got it working. /ipv6 address add from-pool=ipv6pool50 interface=vlan500 The guide from first post says something about master port, I thought it was the WAN port (ETH1) for the interface, Then I changed the interface to Eth 2 and it worked. Maybe it is because Eth2 was bridged so all other ports assigned to bridge can get IPv6. I remember the old firmware before I updated has master port, after updating the firmware the master port thingy was gone. Thank you for your help anyways.
Card PM	Report Top Like Quote Reply

weikee	Jan 29 2020, 06:16 PM Show posts by this member only \| Post #9
10k Club All Stars 12,019 posts Joined: Jan 2003	QUOTE(PC_CHEAH @ Jan 29 2020, 04:17 PM) Ah, finally I got it working. /ipv6 address add from-pool=ipv6pool50 interface=vlan500 The guide from first post says something about master port, I thought it was the WAN port (ETH1) for the interface, Then I changed the interface to Eth 2 and it worked. Maybe it is because Eth2 was bridged so all other ports assigned to bridge can get IPv6. I remember the old firmware before I updated has master port, after updating the firmware the master port thingy was gone. Thank you for your help anyways. Are you able to go lowyat with ipv6? Tested in late 2018 wasn't able to access lowyat with ipv6
Card PM	Report Top Like Quote Reply

TSPC_CHEAH	Jan 29 2020, 09:30 PM Show posts by this member only \| IPv6 \| Post #10
Getting Started Junior Member 67 posts Joined: Jun 2015	QUOTE(weikee @ Jan 29 2020, 06:16 PM) Are you able to go lowyat with ipv6? Tested in late 2018 wasn't able to access lowyat with ipv6 Yes, can browse with IPv6 without problems, nslookup ed it and can get ipv6 address for this site.
Card PM	Report Top Like Quote Reply

weikee	Jan 30 2020, 09:19 AM Show posts by this member only \| Post #11
10k Club All Stars 12,019 posts Joined: Jan 2003	QUOTE(PC_CHEAH @ Jan 29 2020, 09:30 PM) Yes, can browse with IPv6 without problems, nslookup ed it and can get ipv6 address for this site. Thanks, Will try setup again soon.
Card PM	Report Top Like Quote Reply

squall0833	Mar 25 2020, 04:40 AM Show posts by this member only \| Post #12
Regular Senior Member 1,473 posts Joined: Oct 2006 From: Jupiter	QUOTE(soonwai @ Jan 23 2020, 11:33 PM) Here's my config. I see that you set mtu 1480 in /ipv6 nd. I don't think that matters but try removing that. Mine is unspecified. Ensure your ipv6 firewall accepts & forwards icmpv6. See my config. » Click to show Spoiler - click again to hide... « CODE /ipv6 address add address=::/64 advertise=yes disabled=no eui-64=no from-pool=ipv6pool50 interface=vlan50 no-dad=no /ipv6 dhcp-client add add-default-route=no dhcp-options="" disabled=yes interface=pppoe-out1 pool-name=ipv6pool50 pool-prefix-length=64 \ prefix-hint=::/0 request=prefix use-peer-dns=no /ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" disabled=no dynamic=no list=bad_ipv6 add address=::1/128 comment="defconf: lo" disabled=no dynamic=no list=bad_ipv6 add address=fec0::/10 comment="defconf: site-local" disabled=no dynamic=no list=bad_ipv6 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" disabled=no dynamic=no list=bad_ipv6 add address=::/96 comment="defconf: ipv4 compat" disabled=no dynamic=no list=bad_ipv6 add address=100::/64 comment="defconf: discard only " disabled=no dynamic=no list=bad_ipv6 add address=2001:db8::/32 comment="defconf: documentation" disabled=no dynamic=no list=bad_ipv6 add address=2001:10::/28 comment="defconf: ORCHID" disabled=no dynamic=no list=bad_ipv6 add address=3ffe::/16 comment="defconf: 6bone" disabled=no dynamic=no list=bad_ipv6 add address=::224.0.0.0/100 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::127.0.0.0/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 add address=::255.0.0.0/104 comment="defconf: other" disabled=no dynamic=no list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=\ fe80::/10 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=\ established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 add action=accept chain=forward comment="defconf: accept HIP" protocol=139 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN /ipv6 nd set [ find default=yes ] advertise-dns=no advertise-mac-address=yes disabled=no hop-limit=unspecified interface=all \ managed-address-configuration=no mtu=unspecified other-configuration=no ra-delay=3s ra-interval=3m20s-10m ra-lifetime=30m \ reachable-time=unspecified retransmit-interval=unspecified /ipv6 nd prefix default set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d /ipv6 settings set accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes-if-forwarding-disabled forward=yes \ max-neighbor-entries=8192 I've also followed the two guides above that TS posted. didn't get ipv6 to work, it doesnt get an ipv6 still no connection for ipv6 what did i miss and do wrong? IPv6 give me this address instead when connected to internet fe80::a/64 heres my config » Click to show Spoiler - click again to hide... « CODE /ipv6 address add from-pool=IPv6 interface=vlan500 /ipv6 dhcp-client add add-default-route=yes interface=UniFi pool-name=IPv6 request=address,prefix use-peer-dns=no /ipv6 firewall filter add action=accept chain=input connection-state=established in-interface=UniFi add action=accept chain=forward connection-state=established in-interface=UniFi add action=accept chain=input connection-state=related in-interface=UniFi add action=accept chain=forward connection-state=related in-interface=UniFi add action=accept chain=input in-interface=UniFi src-address=fe80::/16 add action=drop chain=input in-interface=UniFi add action=drop chain=forward in-interface=UniFi /ipv6 nd set [ find default=yes ] advertise-dns=no mtu=1480 /ipv6 nd prefix add interface=ether1-WAN prefix=::/0 /ipv6 nd prefix default set preferred-lifetime=1h valid-lifetime=2h This post has been edited by squall0833: Mar 25 2020, 04:56 AM
Card PM	Report Top Like Quote Reply

soonwai	Mar 25 2020, 03:14 PM Show posts by this member only \| Post #13
 All Stars 11,460 posts Joined: Oct 2007 From: KL	QUOTE(squall0833 @ Mar 25 2020, 04:40 AM) I've also followed the two guides above that TS posted. didn't get ipv6 to work, it doesnt get an ipv6 still no connection for ipv6 what did i miss and do wrong? IPv6 give me this address instead when connected to internet fe80::a/64 heres my config » Click to show Spoiler - click again to hide... « CODE /ipv6 address add from-pool=IPv6 interface=vlan500 /ipv6 dhcp-client add add-default-route=yes interface=UniFi pool-name=IPv6 request=address,prefix use-peer-dns=no /ipv6 firewall filter add action=accept chain=input connection-state=established in-interface=UniFi add action=accept chain=forward connection-state=established in-interface=UniFi add action=accept chain=input connection-state=related in-interface=UniFi add action=accept chain=forward connection-state=related in-interface=UniFi add action=accept chain=input in-interface=UniFi src-address=fe80::/16 add action=drop chain=input in-interface=UniFi add action=drop chain=forward in-interface=UniFi /ipv6 nd set [ find default=yes ] advertise-dns=no mtu=1480 /ipv6 nd prefix add interface=ether1-WAN prefix=::/0 /ipv6 nd prefix default set preferred-lifetime=1h valid-lifetime=2h /ipv6 address add from-pool=IPv6 interface=vlan500 This should be your local interface. Usually your bridge or ethernet port. Assuming you're not using any local VLANs. /ipv6 nd prefix add interface=ether1-WAN prefix=::/0 You can remove this. This post has been edited by soonwai: Mar 25 2020, 03:15 PM
Card PM	Report Top Like Quote Reply

heidarren	Mar 25 2020, 03:29 PM Show posts by this member only \| IPv6 \| Post #14
Getting Started Junior Member 248 posts Joined: Aug 2018	Unifi 800mbps plan, hAP ac2, I can maxed out the ISP speed of 839mbps with ipv4, but with ipv6 I can only get 600mbps+-, with firewall setup it even drops to 350mbps, so normally I leave ipv6 off and use only ipv4. I wonder what speed u guys can get. But recently speed gets really low maybe due to lock down, everyone is using internet so the whole world's speed got impact, so I decided to use ipv6 and it seems better than ipv4 now, the respond seems faster
Card PM	Report Top Like Quote Reply

Ebony & Ivory	Mar 25 2020, 03:50 PM Show posts by this member only \| Post #15
Enthusiast Senior Member 962 posts Joined: Jan 2016	QUOTE(heidarren @ Mar 25 2020, 03:29 PM) Unifi 800mbps plan, hAP ac2, I can maxed out the ISP speed of 839mbps with ipv4, but with ipv6 I can only get 600mbps+-, with firewall setup it even drops to 350mbps, so normally I leave ipv6 off and use only ipv4. normal, this is due to IPv6 traffic is not fasttrack in mikrotik.
Card PM	Report Top Like Quote Reply

squall0833	Mar 25 2020, 04:19 PM Show posts by this member only \| Post #16
Regular Senior Member 1,473 posts Joined: Oct 2006 From: Jupiter	QUOTE(soonwai @ Mar 25 2020, 03:14 PM) /ipv6 address add from-pool=IPv6 interface=vlan500 This should be your local interface. Usually your bridge or ethernet port. Assuming you're not using any local VLANs. /ipv6 nd prefix add interface=ether1-WAN prefix=::/0 You can remove this. heres how my interface looks like i tried changed that to bridge or my ether1 WAN still no luck do let me know what information u need from me This post has been edited by squall0833: Mar 25 2020, 04:26 PM
Card PM	Report Top Like Quote Reply

soonwai	Mar 25 2020, 04:33 PM Show posts by this member only \| Post #17
 All Stars 11,460 posts Joined: Oct 2007 From: KL	QUOTE(squall0833 @ Mar 25 2020, 04:19 PM) heres how my interface looks like i tried changed that to bridge or my ether1 WAN still no luck do let me know what information u need from me Didn't see this earlier. /ipv6 dhcp-client add add-default-route=yes interface=UniFi pool-name=IPv6 request=address,prefix use-peer-dns=no change request=address,prefix to request=prefix Check /ipv6 address, do you get an ipv6 address there? Other than the fe80 ones. This post has been edited by soonwai: Mar 25 2020, 04:35 PM
Card PM	Report Top Like Quote Reply

squall0833	Mar 25 2020, 04:41 PM Show posts by this member only \| Post #18
Regular Senior Member 1,473 posts Joined: Oct 2006 From: Jupiter	QUOTE(soonwai @ Mar 25 2020, 04:33 PM) Didn't see this earlier. /ipv6 dhcp-client add add-default-route=yes interface=UniFi pool-name=IPv6 request=address,prefix use-peer-dns=no change request=address,prefix to request=prefix it gives prefix now but ipv6 doesnt seem work yet
Card PM	Report Top Like Quote Reply

soonwai	Mar 25 2020, 04:52 PM Show posts by this member only \| Post #19
 All Stars 11,460 posts Joined: Oct 2007 From: KL	QUOTE(squall0833 @ Mar 25 2020, 04:41 PM) it gives prefix now but ipv6 doesnt seem work yet You didn't change this? /ipv6 address add from-pool=IPv6 interface=vlan500 to /ipv6 address add from-pool=IPv6 interface=bridge
Card PM	Report Top Like Quote Reply

squall0833	Mar 25 2020, 05:00 PM Show posts by this member only \| Post #20
Regular Senior Member 1,473 posts Joined: Oct 2006 From: Jupiter	QUOTE(soonwai @ Mar 25 2020, 04:52 PM) You didn't change this? /ipv6 address add from-pool=IPv6 interface=vlan500 to /ipv6 address add from-pool=IPv6 interface=bridge i did as shown in the image, tried both "bridge" and "ether1WAN" result is same my current settings in ipv6 CODE /ipv6 pool add name=IPv6 prefix-length=63 /ipv6 address add from-pool=IPv6 interface=bridge /ipv6 dhcp-client add add-default-route=yes interface=UniFi pool-name=IPv6 request=prefix use-peer-dns=no /ipv6 firewall filter add action=accept chain=input connection-state=established in-interface=UniFi add action=accept chain=forward connection-state=established in-interface=UniFi add action=accept chain=input connection-state=related in-interface=UniFi add action=accept chain=forward connection-state=related in-interface=UniFi add action=accept chain=input in-interface=UniFi src-address=fe80::/16 add action=drop chain=input in-interface=UniFi add action=drop chain=forward in-interface=UniFi /ipv6 nd set [ find default=yes ] advertise-dns=no mtu=1480 /ipv6 nd prefix default This post has been edited by squall0833: Mar 25 2020, 05:05 PM
Card PM	Report Top Like Quote Reply

« Next Oldest · Networks and Broadband · Next Newest »

2 Pages 1 2 >Top

Add Reply Options

Change to:

0.0218sec

1.25

6 queries

GZIP Disabled
Time is now: 24th December 2025 - 09:50 PM

All Rights Reserved © 2002- 2025 Vijandren Ramadass (~unite against racism~)

Removal Request

Powered by Invision Power Board © 2025 IPS, Inc.