IPv6 on MikroTik: A Complete Configuration Guide

Byadmin
Share
Tweet
Share
Pin
0 Shares

IPv6 is not optional anymore. ISPs delegate it by default, mobile carriers run IPv6-only cores, and IPv4 exhaustion keeps pushing more networks toward dual-stack. If your MikroTik router still runs IPv4-only, you are one ISP policy change away from a support ticket you cannot explain.

This guide covers a full IPv6 deployment on RouterOS: addressing, DHCPv6 prefix delegation, Router Advertisements, firewall rules, and the mistakes that break connectivity in production. Every command targets RouterOS v7, which ships IPv6 in the main package. Version notes for RouterOS v6 appear where the behavior differs.

Table of Contents

  1. IPv6 Fundamentals You Need Before You Start
  2. Prerequisites and Package Check
  3. Step 1: Configure the WAN Side with DHCPv6-PD
  4. Step 2: Assign a Delegated Prefix to the LAN
  5. Step 3: Configure Router Advertisements
  6. Step 4: Run a DHCPv6 Server (Stateful Mode)
  7. Step 5: Verify Routing and Connectivity
  8. Step 6: Build the IPv6 Firewall
  9. Step 7: Configure DNS for IPv6 Clients
  10. IPv6 over PPPoE
  11. Distributing a /56 Across Multiple LANs and VLANs
  12. Common Problems and How to Fix Them
  13. Quick-Reference Configuration Cheat Sheet
  14. Deployment Checklist
  15. Conclusion

IPv6 Fundamentals You Need Before You Start

A few concepts differ enough from IPv4 that skipping them causes real outages later.

  • Address size. IPv6 addresses are 128 bits, written as eight groups of four hex digits separated by colons. A run of consecutive zero groups can be compressed once per address using ::.
  • Link-local addresses. Every IPv6-capable interface generates a link-local address automatically, in the fe80::/10 range. You cannot disable this. Neighbor Discovery depends on it.
  • No NAT by default. IPv6 hosts get global addresses directly. There is no address translation hiding your LAN. The firewall carries the full weight of perimeter security.
  • SLAAC vs. DHCPv6. Stateless Address Autoconfiguration (SLAAC) lets a host build its own address from a router-advertised prefix. DHCPv6 assigns addresses centrally, the way DHCPv4 does. Most networks run both: SLAAC for addressing, DHCPv6 for DNS and other options.
  • Prefix delegation (PD). Instead of assigning one address to your WAN interface, most ISPs delegate an entire prefix — typically a /56 or /60 — for you to subdivide across your own LANs.
  • ICMPv6 is not optional. Neighbor Discovery, Duplicate Address Detection, and Path MTU Discovery all run over ICMPv6. Blocking it at the firewall breaks IPv6 outright, not just diagnostics.

Prerequisites and Package Check

  1. Confirm your ISP delegates a prefix over DHCPv6-PD. Some ISPs still use static assignment or SLAAC-only on the WAN — check with your provider before troubleshooting a PD client that will never bind.
  2. Confirm the router runs RouterOS v7. IPv6 ships in the main routeros package on v7. On RouterOS v6, IPv6 is a separate package that must be installed and enabled manually.
  3. Confirm your IPv4 setup already works, with a defined WAN interface (e.g. ether1 or a PPPoE client) and a LAN bridge (e.g. bridge1).
/system package print
/ipv6 settings print

If IPv6 is disabled system-wide, enable it under /ipv6 settings before continuing.

Step 1: Configure the WAN Side with DHCPv6-PD

Request a delegated prefix from the ISP on the WAN interface:

/ipv6 dhcp-client add interface=ether1 request=prefix \
  pool-name=isp-pool pool-prefix-length=64 \
  add-default-route=yes use-peer-dns=no comment="ISP DHCPv6-PD"
  • request=prefix — asks the ISP for a delegated prefix, not a single address.
  • pool-name=isp-pool — stores the delegated prefix in a named pool. LAN interfaces pull addresses from this pool.
  • pool-prefix-length=64 — the size of each sub-prefix handed out to your own LAN interfaces. A /64 per LAN is the IPv6 standard; do not go smaller.
  • add-default-route=yes — installs a default IPv6 route toward the ISP automatically.

Verify the client bound successfully:

/ipv6 dhcp-client print detail

Look for status=bound and a prefix listed in the output. If the status stays at searching, the ISP is not answering — check the physical WAN link and confirm the ISP actually supports DHCPv6-PD on that circuit.

Step 2: Assign a Delegated Prefix to the LAN

Pull a /64 out of the delegated pool and assign it to the LAN bridge:

/ipv6 address add address=::1/64 from-pool=isp-pool interface=bridge1 advertise=yes

The ::1 becomes the host portion of the address, combined with whatever prefix the pool delegates. If the ISP hands you 2001:db8:abcd:1::/64, the bridge becomes 2001:db8:abcd:1::1/64.

Confirm the address applied:

/ipv6 address print

The entry shows a D flag for dynamic, since it was pulled from a pool rather than typed statically.

Step 3: Configure Router Advertisements

Router Advertisements (RA) tell LAN hosts which prefix to use and whether to build their own address (SLAAC) or ask a DHCPv6 server. Without RA, hosts have no default gateway, even if DHCPv6 assigns them an address.

/ipv6 nd add interface=bridge1 \
  ra-interval=60s-200s ra-lifetime=1800s \
  advertise-dns=yes dns=2001:db8:abcd:1::1 \
  managed-address-configuration=no other-configuration=no
  • managed-address-configuration=no — tells hosts to use SLAAC for addressing rather than requesting one from DHCPv6.
  • managed-address-configuration=yes — tells hosts to request an address from a DHCPv6 server instead (stateful mode). Pair this with a DHCPv6 server, covered in the next section.
  • other-configuration=yes — tells hosts to pull additional options (like DNS) from DHCPv6, even while still using SLAAC for the address itself. This is the common middle ground: SLAAC for addressing, DHCPv6 for DNS.

Important: accept-router-advertisements on the router itself defaults to accepting RAs only when forwarding is disabled. Once you enable forwarding — which happens automatically when the router routes IPv6 traffic — it stops accepting RAs on its own interfaces. This is expected: a router is not a host.

Step 4: Run a DHCPv6 Server (Stateful Mode)

Use this when you need centralized address tracking, static bindings by DUID, or client hostnames logged — SLAAC alone gives you none of that.

/ipv6 dhcp-server add name=dhcpv6-lan interface=bridge1 \
  address-pool=isp-pool lease-time=1d

Key concept: DHCPv6 never provides a default gateway. That information comes only from Router Advertisements. A DHCPv6 server without RA enabled on the same interface leaves clients with an address and no route out — set managed-address-configuration=yes on the matching /ipv6 nd entry so the two work together.

For downstream routers instead of end hosts, delegate prefixes rather than single addresses:

/ipv6 dhcp-server add name=dhcpv6-pd-downstream interface=bridge2 \
  address-pool=isp-pool lease-time=1d

Configure the pool with prefix-length smaller than /64 (e.g. /60) so it has room to delegate multiple /64s to each downstream router.

Step 5: Verify Routing and Connectivity

/ipv6 route print
/ipv6 neighbor print
/ping 2001:4860:4860::8888
/tool traceroute 2001:4860:4860::8888
  • /ipv6 route print — confirms the default route from DHCPv6-PD installed correctly.
  • /ipv6 neighbor print — the IPv6 equivalent of the ARP table, useful for confirming Neighbor Discovery is working on the LAN.
  • The ping target 2001:4860:4860::8888 is Google’s public IPv6 resolver — a reliable reachability test independent of your own DNS configuration.

Step 6: Build the IPv6 Firewall

IPv6 hosts are globally reachable with no NAT in front of them. The firewall is the only thing standing between your LAN and the internet — treat it as mandatory, not optional hardening.

/ipv6 firewall filter
add chain=input action=accept protocol=icmpv6 comment="Allow ICMPv6 - required for IPv6 to function"
add chain=input action=accept connection-state=established,related comment="Allow established/related"
add chain=input action=accept src-address=fe80::/10 comment="Allow link-local for ND/RA"
add chain=input action=drop connection-state=new in-interface=ether1 comment="Drop new inbound from WAN"

add chain=forward action=accept protocol=icmpv6 comment="Allow ICMPv6 forwarding"
add chain=forward action=accept connection-state=established,related comment="Allow established/related forwarding"
add chain=forward action=drop connection-state=new in-interface=ether1 dst-address=!2001:db8:abcd:1::/64 comment="Drop new inbound to LAN from WAN"
  • Never block ICMPv6. This single mistake breaks Neighbor Discovery, Duplicate Address Detection, and Path MTU Discovery — the entire protocol depends on it.
  • Allow link-local traffic explicitly. RA and Neighbor Discovery both run over link-local addresses (fe80::/10). Blocking this range breaks LAN addressing even though it looks like internal-only traffic.
  • Filter on the forward chain, not just input. The input chain protects the router itself. The forward chain protects everything behind it — this is where most of your perimeter policy belongs, since there’s no NAT to fall back on.

Order matters. Place the ICMPv6 and established/related rules first, so legitimate traffic never reaches the drop rules further down the chain.

Step 7: Configure DNS for IPv6 Clients

  1. Advertise a DNS server via RA (already set in Step 3 with advertise-dns=yes), or
  2. Serve DNS through the DHCPv6 server by adding a dns-server parameter to the DHCPv6 server configuration, or
  3. Run RouterOS itself as a DNS forwarder and advertise its own IPv6 address as the resolver.

Test resolution from a LAN client after applying either method:

nslookup -type=AAAA example.com

IPv6 over PPPoE

If the ISP delivers the WAN connection over PPPoE, IPv6 attaches to the PPPoE interface, not the physical port underneath it.

  1. Configure the PPPoE client as usual for IPv4.
  2. Run the DHCPv6 client on the PPPoE interface instead of the raw Ethernet interface: 
    /ipv6 dhcp-client add interface=pppoe-out1 request=prefix \
  pool-name=isp-pool add-default-route=yes
  3. If you run a PPPoE server for downstream customers, PPP creates a dynamic DHCPv6-PD server automatically when a client connects. Enable this by setting a pool on the PPP profile: 
    /ppp profile set default dhcpv6-pd-pool=customer-pool

Distributing a /56 Across Multiple LANs and VLANs

A /56 delegation gives you 256 individual /64 networks to hand out. A /60 gives you 16. Plan the split before configuring interfaces:

  • Request the right size upfront. Set pool-prefix-length=64 on the DHCPv6 client only if you need exactly one /64 per interface. For a multi-VLAN network, request a larger delegation (/56 or /60) from your ISP so you have enough /64s to assign.
  • Assign each VLAN its own /64 from the pool, the same way Step 2 assigns one to the bridge: 
    /ipv6 address add address=::1/64 from-pool=isp-pool interface=vlan10-guest advertise=yes
/ipv6 address add address=::1/64 from-pool=isp-pool interface=vlan20-iot advertise=yes
  • Use address lists to keep firewall rules maintainable. With multiple /64 prefixes in play, hardcoding each one into every firewall rule becomes unmanageable fast: 
    /ipv6 firewall address-list
add list=trusted-lans address=2001:db8:abcd:1::/64
add list=trusted-lans address=2001:db8:abcd:2::/64

    Reference src-address-list=trusted-lans in firewall rules instead of repeating each prefix.

Common Problems and How to Fix Them

DHCPv6 client stuck in “searching”

  • Cause: The ISP does not support DHCPv6-PD on this circuit, or the physical WAN link is down.
  • Fix: Confirm with the ISP that PD is enabled on the account. Some providers require a specific VLAN or account flag for IPv6.

LAN hosts get an IPv6 address but no default gateway

  • Cause: DHCPv6 is running, but Router Advertisements are not configured on the same interface. DHCPv6 never carries gateway information.
  • Fix: Add an /ipv6 nd entry for the interface, even in stateful mode.

IPv6 connectivity works on the LAN but not to the internet

  • Cause 1: No default route installed — check that add-default-route=yes is set on the DHCPv6 client.
  • Cause 2: ICMPv6 blocked somewhere in the firewall chain. Path MTU Discovery relies on ICMPv6 packet-too-big messages; blocking them causes large packets to silently fail while small ones succeed.

Hosts get a link-local address only, no global address

  • Cause: RA is not advertising a prefix, or advertise=yes was left off the LAN address assignment in Step 2.
  • Fix: Re-check the /ipv6 address entry for advertise=yes, and confirm /ipv6 nd print shows the interface active.

Duplicate or conflicting addresses after a router reboot

  • Cause: The delegated prefix changed after the DHCPv6-PD lease renewed with a different prefix than before — common with some consumer ISPs that do not guarantee prefix stability.
  • Fix: Use pool-based addressing (Step 2) rather than hardcoded static addresses, so LAN addressing follows the pool automatically when the delegation changes.

Quick-Reference Configuration Cheat Sheet

# WAN: request delegated prefix
/ipv6 dhcp-client add interface=ether1 request=prefix \
  pool-name=isp-pool pool-prefix-length=64 add-default-route=yes

# LAN: assign a /64 from the pool
/ipv6 address add address=::1/64 from-pool=isp-pool interface=bridge1 advertise=yes

# Router Advertisements: SLAAC + DHCPv6 for DNS
/ipv6 nd add interface=bridge1 advertise-dns=yes \
  managed-address-configuration=no other-configuration=yes

# Minimum safe firewall
/ipv6 firewall filter
add chain=input action=accept protocol=icmpv6
add chain=input action=accept connection-state=established,related
add chain=input action=accept src-address=fe80::/10
add chain=input action=drop connection-state=new in-interface=ether1
add chain=forward action=accept protocol=icmpv6
add chain=forward action=accept connection-state=established,related
add chain=forward action=drop connection-state=new in-interface=ether1

Deployment Checklist

  • Confirm ISP delegates a prefix via DHCPv6-PD before configuring anything
  • Verify RouterOS version and IPv6 package availability
  • Configure DHCPv6 client on WAN with request=prefix
  • Confirm status=bound before moving to LAN configuration
  • Assign a /64 per LAN or VLAN from the delegated pool
  • Configure Router Advertisements on every LAN interface
  • Set up DHCPv6 server only if stateful tracking is needed
  • Never block ICMPv6 anywhere in the firewall chain
  • Allow link-local traffic (fe80::/10) explicitly
  • Filter the forward chain, since there is no NAT to fall back on
  • Use address lists once more than one /64 prefix is in play
  • Test with both ping and traceroute to a known-good IPv6 target

Conclusion

IPv6 on MikroTik follows a consistent shape: request a prefix on the WAN, delegate pieces of it to each LAN, advertise it correctly, and firewall the result properly since NAT no longer hides anything. Get DHCPv6-PD and Router Advertisements right first — most of the problems above trace back to one of those two steps. Once the base configuration is stable, scaling to more VLANs is just repeating Step 2 with a new interface and a new /64.

Check our list of MikroTik guides

Similar Posts

Leave a Reply

Your email address will not be published. Required fields are marked *