ICT Portfolio Blog
Infrastructure, networking, and cloud.
They're not wrong.... 🤣
Deployment tips on understanding Prefix Delegation (PD), Router Advertisements (RA), Neighbor Discovery (ND), and stateful firewalling: A successful IPv6 configuration.
Goal:
This post walks through IPv6 for AT&T Internet (a non-SLA service behind an AT&T RG).
Unlike a Spectrum deployment which hands out generous /56 prefixes. AT&T
delegates a single /64. Yep. A single measly /64. Needlessly stingy imo, but we can work with that.
Solution:
How to set it up and secure isolated IPv6 connectivity for a single Windows "test" VM.
1. Network Topology
ether16_ipv6 is assigned to bridge_ipv6 and patches directly into a dedicated Hyper-V virtual switch isolated from hypervisor management.
2. Requesting the Prefix
Configure the IPv6 client to request an IPv6 prefix on the WAN interface:/ipv6 dhcp-client:
add interface=ether1_untrust \
request=prefix \
pool-name=att_pd \
pool-prefix-length=64 \
add-default-route=yes \
accept-prefix-without-address=yesIPv6 Client Breakdown
request=prefix: Requests DHCPv6 Prefix Delegation (IA_PD).pool-name=att_pd: Populates a dynamic IPv6 address pool in RouterOS named att_pd.pool-prefix-length=64: Controls the subnet block size RouterOS carves out of the pool for downstream interfaces (it does not control what size the ISP gives you).accept-prefix-without-address=yes: Accepts a delegated prefix even if AT&T doesn't hand out an IA_NA non-temporary address on WAN.add-default-route=yes: Installs an IPv6 default route via the DHCPv6 client mechanism.Verifying the Binding
Run the print command to check client state:
/ipv6 dhcp-client print detailExpected bound output:
interface=ether1_untrust status=bound dhcp-server-v6=fe80::3aa0:67ff:fe81:d662
request=prefix pool-name=att_pd pool-prefix-length=64
prefix=2600:1700:1335:452f::/64Note: /64 is the smallest routable subnet. This limits our options:
Note, ULAs are not used for this lab exercise.
3. Assign the PD to the LAN Bridge
Bind the /64 to the bridge interface:
/ipv6 address
add interface=bridge_ipv6 \
from-pool=att_pd \
advertise=yesThis process keeps service running in the even the ISP changes the dynamic prefix assignment. It does not interfere with specific LAN configuration.
Verify the binding:
/ipv6 address print2600:1700:1335:452f::/64 FROM-POOL=att_pd INTERFACE=bridge_ipv6 ADVERTISE=yesCaution: RouterOS displays the network address default (without an explicit EUI-64 or interface ID suffix) for pool assignments. If you want to ping the router's interface directly (e.g., :: 1), explicitly bind that ID to an interface:
/ipv6 address add interface=bridge-lan pool=att pd eui-64 =:: 1
It's like a dynamic and static address, all rolled into one!
4. Router Advertisements (RA) & SLAAC
Unlike IPv4, IPv6 clients can auto-configure using Stateless Address Autoconfiguration (SLAAC). The router advertises the prefix via Neighbor Discovery, and downstream endpoints build their own interface addresses.
Configure ipv6 nd for the bridge:
/ipv6 nd
add interface=bridge_ipv6 \
advertise-dns=yes \
managed-address-configuration=no \
other-configuration=noCheck your existing ND settings first (/ipv6 nd print detail). RouterOS includes a default *all entry. Always verify your effective ND configuration so you don't accidentally spit Router Advertisements back out ether1_untrust toward the AT&T RG.
DNS Advertisements (RDNSS)
Windows natively supports DNS advertisement learned from RAs. Configure RDNSS options to your preferred resolvers:
/ipv6 nd
set [find where interface=bridge_ipv6] \
dns=2001:4860:4860::8888,2001:4860:4860::8844 \
advertise-dns=yes
Note: All devices do not natively support RDNSS. For example Android or Xbox devices may require
dual-stack and use IPv4 DNS servers for their IPv6 name resolution. Plan accordingly.
5. Neighbor Discovery Mechanics: A Quick Refresher
IPv4 discover neighbors using network broadcasts (e.g., ARP). IPv6 changes the traditional model. Instead, it uses multicast and ICMPv6-based Neighbor Discovery Protocol (NDP).
+-----------------------------------------------------------------------+
| ROUTER DISCOVERY |
| |
| [ Windows VM ] --- (Type 133: Router Solicitation) ---> [ ff02::2 ] |
| [ Windows VM ] <--- (Type 134: Router Advertisement) -- [ MikroTik ]|
+-----------------------------------------------------------------------+
| ADDRESS RESOLUTION |
| |
| [ Windows VM ] --- (Type 135: Neighbor Solicitation) -> [ Sol-Node ]|
| [ Windows VM ] <--- (Type 136: Neighbor Advertisement) -- [ Target ]|
+-----------------------------------------------------------------------+ff02::2 (all-routers). The router replies with a Router Advertisement (RA) to ff02::1 (all-nodes) containing default routes, MTU, lifetimes, and prefixes.ff02::1:ffXX:XXXX) derived from the target IP, drastically cutting broadcast noise across the switch fabric.The CCR handles WAN-side NDP to the AT&T gateway automatically over link-local addresses (fe80 :: /10). You do not need manual static neighbor entries on WAN.
6. Hardening IPv6
IPv6 GUAs expose all devices directly to the Internet. At minimum, stateful firewall policies on the WAN interface are absolutely critical:
Input Chain (Protecting RouterOS)
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related comment="Accept established/related"
add chain=input action=drop connection-state=invalid comment="Drop invalid"
add chain=input action=accept protocol=icmpv6 comment="Accept essential ICMPv6"
add chain=input action=accept in-interface=ether1_untrust protocol=udp src-port=547 dst-port=546 comment="Allow DHCPv6 reply from RG"
add chain=input action=accept in-interface-list=trust comment="Allow trusted management"
add chain=input action=drop in-interface=ether1_untrust comment="Drop all other unsolicited WAN input"Forward Chain (Protecting the LAN)
/ipv6 firewall filter
add chain=forward action=accept connection-state=established,related comment="Accept established/related"
add chain=forward action=drop connection-state=invalid comment="Drop invalid"
add chain=forward action=accept protocol=icmpv6 comment="Allow ICMPv6 pass-through"
add chain=forward action=accept in-interface=bridge_ipv6 out-interface=ether1_untrust comment="Allow test LAN outbound"
add chain=forward action=drop in-interface=ether1_untrust out-interface=bridge_ipv6 comment="Block unsolicited WAN to LAN"Note: Allow Link-Local Traffic on the WAN. It sounds risky. Consider what this RAW rule does:
# DO NOT USE THIS RULE
/ipv6 firewall raw
add chain=prerouting action=drop in-interface=ether1_untrust src-address=fe80::/10Result: Protocol collapse.
Legitimate IPv6 control traffic (e.g., RAs, Neighbor Discovery, DHCPv6-PD, etc.) relies entirely on fe80:: /10 source addresses. IPv6 traffic between the WAN interface and the upstream AT&T gateway breaks without link-local communication.
7. Validate
From the Windows test VM, confirm full auto-configuration:
ipconfig /allCheck for:
fe80:: link-local address./64.Run diagnostics:
:: Test ICMP Reachabilityping -6 2001:4860:4860::8888:: Test DNS Resolutionnslookup google.com 2001:4860:4860::8888:: Trace Routetracert -6 2001:4860:4860::8888
9. Troubleshooting
During testing, I ran into an intermittent service disruption:
ether1_untrust.action=accept across all chains did not resolve the issue.The Fix
Manually renewing the DHCPv6 client in RouterOS (/ipv6 dhcp-client renew 0) immediately restored outbound connectivity. RouterOS re-bound to the exact same prefix, but the AT&T RG instantly resumed forwarding outbound/inbound traffic across its backplane.
I could not determine if the issue was hardware or software based. The short-term band-aid requires scheduling that command to run no less than every six hours. If it seems ridiculous it's because it is. That said, I could not detect any change in service from the client side, so it does seem to work. The long-term solution requires coordinating assistance with AT&T. I would recommend they swap their router at minimum.
Root Cause Analysis
This issue points to a stale routing table or NDP state inside the AT&T gateway. The gateway maintained the DHCPv6 lease, but it dropped the underlying dynamic route or neighbor entry pointing to the CCR, until a fresh DHCPv6 exchange forced its forwarding plane to update.
Advanced DHCPv6 Client Tweaks
I tested two specific client parameters under /ipv6 dhcp-client:
use-interface-duid=yes: Forces RouterOS to generate its DUID from the WAN interface's MAC address (ether1_untrust) rather than the global router-wide base DUID. This ensures identity stability if system configuration alters internal interface numbering.allow-reconfigure=yes: Allows the DHCPv6 client to accept server-initiated reconfigure requests (RFC 3315) to trigger out-of-band renewal cycles if the upstream gateway requests it.10. Summary
Setting up IPv6 on RouterOS v7 behind AT&T Business Internet works smoothly once the core control mechanisms are dialed in:
forward and input chains. Never drop fe80::/10 link-local traffic on WAN.from-pool) with static ULAs (fdfd::/48) to maintain internal address stability across ISP rebinds.That's all folks!
Configure a MikroTik router as an IKEv2 VPN server for mobile and remote clients, including Windows, Android, and Apple iOS/iPadOS.
Clients authenticate using X.509 certificates and receive an address from a dedicated VPN address pool.
IKEv2 provides a standards-based IPsec VPN that is well suited to mobile clients. It is supported natively by Windows and Apple operating systems and is widely supported by Android VPN clients.
Compared with older VPN protocols, IKEv2 provides strong cryptography, certificate-based authentication, NAT traversal, and reliable reconnection when a mobile device changes networks.
The configuration consists of four basic components:
IKEv2 certificate authentication requires three certificate types:
The CA signs both the server and client certificates, establishing the chain of trust used during IKEv2 authentication.
Create the CA certificate that will sign the server and client certificates.
/certificateadd name=Domain_CA common-name=Domain_CA key-usage=key-cert-sign,crl-sign
Specify the public address from which the Certificate Revocation List can be retrieved.
/certificateset Domain_CA ca-crl-host=8.x.x.x
Use the router's public IP address or a DNS name reachable by VPN clients.
The CRL location is published through the CA certificate. It does not need to be configured separately on the server or client certificates.
/certificatesign Domain_CA
Create a certificate identifying the VPN server and sign it with Domain_CA.
The server certificate should contain the VPN server's DNS name in both the Common Name and Subject Alternative Name.
CN: ikev2.example.comSAN: DNS:ikev2.example.com
The certificate should include the tls-server key usage. After creating it, sign it with Domain_CA and mark the CA and server certificates as trusted.
Create an individual certificate for each VPN client or user.
For maximum client compatibility, use the same identity in the Common Name and Subject Alternative Name.
CN: stevenSAN: DNS:steven
The certificate should include the tls-client key usage.
Sign the certificate with Domain_CA, mark it as trusted, and export the certificate and private key as PKCS#12 (.p12) for installation on the client.
Using individual certificates allows a single client to be revoked without affecting every other VPN user.
Dedicate a subnet or address range to remote VPN clients.
/ip pooladd name=ikev2-pool ranges=10.168.88.100-10.168.88.110
This address space should not overlap existing LAN or remote networks.
The pool may be shared with other remote-access VPN services when appropriate, although separate pools can simplify firewall policy and troubleshooting.
Mode Config supplies network configuration to connecting VPN clients.
/ip ipsec mode-configadd name=ikev2-modecfg \ address-pool=ikev2-pool \ address-prefix-length=32 \ system-dns=no \ static-dns=192.168.88.10
The client receives an address from ikev2-pool, a /32 client address, and 192.168.88.10 as its DNS server.
For a split-tunnel VPN, internal networks may also be advertised using split-include.
/ip ipsec mode-configset ikev2-modecfg split-include=192.168.88.0/24
Mode Config determines what routes the client is asked to install. Firewall policy still determines what the client is actually permitted to access.
The IPsec profile defines the cryptographic parameters used during IKE negotiation.
/ip ipsec profileadd name=ikev2-profile \ dh-group=modp2048 \ enc-algorithm=aes-256,aes-128 \ hash-algorithm=sha256
Create a dedicated proposal for IKEv2 traffic.
/ip ipsec proposaladd name=ikev2-proposal \ auth-algorithms=sha256 \ enc-algorithms=aes-256-cbc,aes-128-cbc \ pfs-group=none
A dedicated proposal is preferable to modifying the RouterOS default because unrelated IPsec tunnels will not inherit the remote-access VPN configuration.
Create a policy group for dynamically generated IKEv2 client policies.
/ip ipsec policy groupadd name=ikev2-policies
Create the corresponding policy template.
/ip ipsec policyadd group=ikev2-policies \ proposal=ikev2-proposal \ template=yes
RouterOS uses this template to generate IPsec policies dynamically as clients connect.
Create a passive IKEv2 peer that listens for incoming client connections.
/ip ipsec peeradd name=ikev2-peer \ exchange-mode=ike2 \ passive=yes \ profile=ikev2-profile \ send-initial-contact=no
Because the MikroTik is acting as the VPN server, remote clients initiate the connection.
Associate certificate authentication, Mode Config, and dynamic policy generation with the IKEv2 peer.
/ip ipsec identityadd peer=ikev2-peer \ auth-method=digital-signature \ certificate=IKEv2_Server \ generate-policy=port-strict \ mode-config=ikev2-modecfg \ policy-template-group=ikev2-policies
The router verifies that each connecting client presents a certificate signed by a trusted CA.
A specific remote-certificate is deliberately not configured. Specifying one would bind the identity to a particular client certificate. Leaving certificate matching generic allows multiple clients signed by the trusted CA to authenticate.
The firewall performs two separate functions: permitting establishment of the IKEv2/IPsec tunnel and controlling what authenticated VPN clients may access after the tunnel is established.
At minimum, the router must accept IKE and NAT Traversal from the Internet.
/ip firewall filteradd chain=input action=accept protocol=udp dst-port=500,4500 \ comment="Allow IKEv2 / IPsec NAT-T"
If native ESP must be accepted separately:
/ip firewall filteradd chain=input action=accept protocol=ipsec-esp \ comment="Allow IPsec ESP"
These rules must appear before the router's general WAN input-drop rule.
Access from authenticated VPN clients into internal networks should be explicitly permitted according to policy.
/ip firewall filteradd chain=forward action=accept \ src-address=10.168.88.0/24 \ dst-address=192.168.88.0/24 \ ipsec-policy=in,ipsec \ comment="IKEv2 clients to LAN"
Traffic not specifically authorized should remain blocked by the normal firewall policy.
Existing masquerade rules should not accidentally NAT traffic between VPN clients and internal networks.
Where necessary, place an IPsec NAT-bypass rule before the Internet masquerade rule.
/ip firewall natadd chain=srcnat action=accept \ src-address=10.168.88.0/24 \ dst-address=192.168.88.0/24 \ comment="Do not NAT IKEv2 clients to LAN"
The exact firewall and NAT configuration depends on whether the VPN is LAN-only split tunnel, includes multiple internal networks, or provides full-tunnel Internet access through the MikroTik.
Mode Config provides addressing and routing information. The firewall determines authorization.
That's It!
The NPS Azure AD Extension creates a self-signed certificate that’s only valid for two years. If you forget to renew it, authentication will eventually start failing when that certificate expires.
Renewing the certificate is simple. Just rerun the Azure MFA NPS Extension configuration script:
C:\Program Files\Microsoft\AzureMfa\Config\AzureMfaNpsExtnConfigSetup.ps1This will generate a new certificate and update the extension to use it.
When you run the script, you might see an error like:
The package source https://www.powershellgallery.com/api/v2 is not reachable or resolved.
This usually means PowerShell isn’t using a modern TLS version when it tries to connect to the PowerShell Gallery.
Windows Server 2016, 2019, and newer support TLS 1.2, but PowerShell may still default to older protocols, depending on .NET and cryptography settings.
The quickest fix is to force TLS 1.2 in your PowerShell session and then rerun the script:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Once TLS 1.2 is enabled, the script can reach the PowerShell Gallery and the NPS Azure AD Extension certificate is renewed without further issues.
Hey Steven, I wish it was April fools haha.
We were acquired by a PE firm at the start of last year.
They've made it a completely different model.
You are not the only one this has happened to.
We were a Subscription First, before we got purchased. They moved to Subscription only. Which is why you are seeing that ridiculous almost out of control uplift.
But it is what it is. ... Thanks, and sorry Steven. Have a good day man!
I appreciate the candid reply. I hope things work out for you.
A practical guide to DHCPv6 Prefix Delegation, SLAAC, router advertisements, and dynamic IPv6 routing across multiple routers.
The Low-Down
Got Spectrum? Want IPv6? Want to route those prefixes? We can build that.
Why route IPv6 prefixes on something as ordinary as a home network? Because a flat network isn't a requirement. Conventional wisdom suggests we bridge a single Layer 2 network straight to the AP. That works. You can also go your own way.
A single broadcast domain has two problems: security and noise. Cheap and beefy firewalls (hello, MikroTik) changed the math entirely. Each routed segment is its own security zone. Policy becomes intuitive: this interface talks to that one, this zone to that zone, and everything else is a rule.
The other win is isolation. Chatty Wi-Fi clients throw broadcasts and multicast at everyone on the same domain. That noise is not stuck on the wireless side. It hits the wired LAN too. Ever try a wireless printer from your phone? The rest of the network feels broken. Not that I would know. 🤣
Routed segments fix that. Client isolation and private VLANs help, but they still live in one broadcast domain. Routing adds a real boundary.
Our Spectrum deployment demonstrates this architecture using two MikroTik routers:
/56./58 from Martha and distributing /64 networks to its clients.The result is a routed IPv6 network with automatic prefix assignment and routing, without NAT66 or static routes for the delegated global prefixes.
This article examines how that architecture works and why Router Advertisements, DHCPv6-PD, and Unique Local Addresses each have distinct roles.
Network topology
Spectrum provides a dynamically delegated /56 IPv6 prefix.
The primary firewall receives that prefix and manages its distribution.
The AP receives a /58 from the primary firewall and uses that delegated block to assign /64 prefixes to its internal networks.
Three distinct functions:
1. Prefix delegation: Determines which router owns which IPv6 prefix.Ask and you shall receive. They delegate a /56 prefix through DHCPv6-PD -as long as you ask nicely!
For illistration, Spectrum assigns:
2001:db8:1234:5600::/56Note: 2001:db8::
/32is reserved for documentation. This is not the actual Spectrum prefix.
A /56 contains 256 individual /64 networks. For example:
2001:db8:1234:5600::/642001:db8:1234:5601::/642001:db8:1234:5602::/64...2001:db8:1234:56ff::/64
This provides considerably more flexibility than a single /64.
Each /64 can be assigned to a separate routed LAN, VLAN, wireless network, or other Layer 3 segment. A /64 is also SLAAC friendly.
How many networks can we delegate?
A /56 contains:
/64 networks/58 networks/60 networksOur design delegates one /58 to the AP.
That /58 contains 64 separate /64 networks. 🤯
The remaining address space can support other internal segments or downstream routers, provided the allocations do not overlap. That's exactly what we want -options.
Configure prefix delegation on the primary firewall
The edge firewall runs a DHCPv6 client on its Spectrum-facing WAN interface.
The client requests a prefix and places the delegation into a RouterOS IPv6 pool:
/ipv6 dhcp-client
add interface=<spectrum-wan> \
request=prefix \
pool-name=spectrum_ipv6 \
pool-prefix-length=56 \
add-default-route=noReplace
The important settings are:
| Setting | Function |
|---|---|
request=prefix | Requests IPv6 Prefix Delegation |
pool-name=spectrum_ipv6 | Creates a dynamic pool from Spectrum's delegation |
pool-prefix-length=56 | Allocates /56 networks from that pool |
add-default-route=no | Leaves default-route discovery to Router Advertisements |
The actual Spectrum configuration uses Router Advertisements for default-route discovery.
Verify the prefix
/ipv6 dhcp-client print detail
/ipv6 pool print detailWe expect the DHCPv6 client to report status=bound and a delegated prefix of length /56.
The pool should contain the dynamically delegated address space.
Why not hardcode the prefix?
Spectrum's delegation is dynamic.
Although an ISP may consistently assign the same prefix, there is no guarantee it will remain unchanged.
Hardcoding the global prefix into downstream interfaces would create additional maintenance work if Spectrum renumbers the connection.
Using a dynamic pool allows RouterOS to update the assigned global prefixes when the upstream delegation changes.
IPv6 default routes: Router Advertisements versus DHCPv6
An important architectural distinction is that DHCPv6 Prefix Delegation does not inherently supply a default gateway.
In IPv6, Router Advertisements are the standard mechanism for discovering default routers.
On the Spectrum WAN, the edge firewall receives an RA from the upstream router.
The RA identifies the default router through its link-local address.
The resulting route conceptually resembles:
::/0
gateway=fe80::xxxx%<spectrum-wan>The %interface notation identifies the interface associated with the link-local next hop.
This is necessary because link-local IPv6 addresses are scoped to a particular link.
Why link-local next hops?
IPv6 routers do not need globally routable addresses to communicate with directly connected neighbors.
A link-local address is sufficient for forwarding traffic to the next router. This is normal behavior.
The edge firewall receives a global /56 through PD. It independently learns its default route through an RA.
These are separate control-plane functions.
RouterOS consideration
RouterOS must be configured to accept Router Advertisements to learn its IPv6 default route.
For example:
/ipv6 settings
set accept-router-advertisements=yesEnabling RA acceptance does not replace DHCPv6-PD.
6. Delegating a /58 to the AP
This is where the architecture becomes interesting.
The AP is simultaneously:
The AP requests a prefix from the edge firewall.
The AP allocates a /58 from Spectrum's delegated /56.
Using our documentation prefix, one possible allocation is:
Spectrum delegates:
2001:db8:1234:5600::/56
Edge firewall delegates to AP:
2001:db8:1234:5640::/58That /58 contains the /64 networks beginning at 5640 through 567f.
The exact allocation is determined by the pool and client configuration.
Configure a delegation pool
The Spectrum-facing DHCPv6 client creates the upstream dynamic pool spectrum_ipv6.
To delegate /58s, the AP must have a suitable nonoverlapping allocation mechanism that makes /58 prefixes available to its downstream DHCPv6 server.
A RouterOS dynamic pool created with pool-prefix-length=64 is intended to allocate /64s, not /58s. The pool arrangement must therefore support the /58 request.
For example, the upstream client could be configured to create /58 allocations:
/ipv6 dhcp-client
set [find where pool-name=spectrum_ipv6] \
pool-prefix-length=58Changing the pool prefix length on a running network can affect existing assignments.
Configure the DHCPv6 server
The DHCPv6 server on the edge firewall serves the link towards the AP:
/ipv6 dhcp-server
add name=dhcpv6_to_ap \
interface=<ap-facing-interface> \
address-pool=<pd-pool>The selected pool must provide the /58 delegations.
The server receives a prefix request from the AP, allocates the prefix, and associates that delegation with the downstream router.
This is not the same as assigning an IPv6 address to the AP's WAN interface.
A delegated prefix represents address space. It is not the same an IPv6 address.
Configure the AP as a DHCPv6-PD client
The AP runs a DHCPv6 client toward the edge firewall.
The client requests a prefix and places it into a local pool:
/ipv6 dhcp-client
add interface=<edge-uplink> \
request=prefix \
pool-name=spectrum_pool \
pool-prefix-length=64 \
add-default-route=noThe /64 allocation size is intentional. The AP receives a /58 but subdivides that prefix into /64s for its internal networks.
The hierarchy is:
Spectrum
|
Edge Firewall /56
|
Access Point /58
|
Wireless Clients /64This is routing. It's not address translation.
Every global IPv6 address and subnet belongs to the original Spectrum /56.
Assign /64 networks to internal interfaces
The AP can assign /64 networks from its delegated pool to internal interfaces:
/ipv6 address
add interface=bridge_wifi \
from-pool=spectrum_pool \
advertise=yesRouterOS selects an available /64 from the delegated pool and assigns it to bridge_wifi.
The interface then advertises that prefix to wireless clients.
What about bridge_lan?
The existing topology distinguishes between two networks:
bridge_lan
Receives a global /64 advertised by the edge firewall through SLAAC.
bridge_wifi
Receives a global /64 from the AP's delegated /58.
This is a useful distinction.
On the bridge_lan, the AP participates as a host on the upstream link, receiving a global address through SLAAC.
On the bridge_wifi, the AP acts as the router advertising a delegated /64 to downstream clients.
The two interfaces therefore have different addressing and routing.
Router Advertisements and SLAAC
The AP provides Router Advertisements on the wireless bridge.
/ipv6 nd
add interface=bridge_wifi \
advertise-dns=yes \
managed-address-configuration=no \
other-configuration=noND advertises its /64 to clients. Clients receiving these advertisements can automatically configure global IPv6 addresses using SLAAC.
RAs can provide:
DHCPv6 IA_NA and SLAAC
The design also incorporates DHCPv6 IA_NA service on bridge_wifi.
Note the distinction between PD, DHCPv6, and SLAAC.
Why incorporate both SLAAC and DHCPv6 service? It's all about the clients. Some only support SLAAC, some only DHCPv6, some only support SLAAC but do not accept RDNSS 🤣. If you want to support Windows, and Mac IOS, and Android, and Xbox... It's best to support SLAAC and provide DHCPv6.
To advertise that stateful DHCPv6 addressing is available, the RA Managed flag can be enabled:
/ipv6 nd
set [find where interface=bridge_wifi] \
managed-address-configuration=yesThe DHCPv6 server and address pool must also be configured. The Managed flag alone does not create a DHCPv6 server.
Return routing
The major advantage for this design is that the edge firewall does require a static route for every delegated /64.
When It delegates a /58 to the AP, the DHCPv6-PD server can install a route for that delegated prefix through its DHCPv6 client.
Conceptually:
Destination:
2001:db8:1234:5640::/58
Next hop:
APThe actual next hop may use the AP's link-local address. This is a critical feature of routed prefix delegation.
IPv6 firewall considerations
Globally routable IPv6 addresses, without controls, provide unrestricted two-way Internet access.
A stateful firewall policy is the primary tool that makes IPv6 functionally secure. It should block all unsolicited traffic on both the inbound and forward chains. It should permit defined control traffic on the inbound chain and permit outbound traffic on the forward chain. It should drop everything else.
It's conceptually similar to a solid IPv4 firewall filter. Review an example of IPv6 firewall configuration here.
The AP should apply equivalent principles to traffic entering its own routed networks.
17. Conclusion
My Spectrum IPv6 deployment demonstrates a clean approach to routing using RouterOS.
Spectrum delegates a /56 to my edge firewall.
My edge firewall allocates a /58 to my AP.
My AP subdivides that /58 into /64 networks for its internal interfaces.
Router Advertisements provide default-router discovery and host configuration, while DHCPv6-PD manages the delegation hierarchy and associated routes.
The resulting architecture supports globally routable IPv6 addresses throughout the network without NAT66.
More importantly, it establishes a foundation for expansion.
Additional VLANs, wireless networks, downstream routers, and branch segments can be incorporated without changing the architecture.
The underlying principle is simple: delegate prefixes to routers, advertise prefixes to hosts, and route between networks.
That's it!
Before:
 |
After:
 |
You need to move the FSMO roles, and you would rather do it in PowerShell than click through the old MMC snap-ins.
Use the Active Directory PowerShell module. If it is not already loaded, import it first.
Import-Module ActiveDirectory
Get-ADForest contoso.com | ft DomainNamingMaster, SchemaMaster
Get-ADDomain contoso.com | ft InfrastructureMaster, PDCEmulator, RIDMaster
This hands the PDC Emulator role to the domain controller named DCX.
Move-ADDirectoryServerOperationMasterRole -Identity "DCX" PDCEmulator
PowerShell also accepts the role as a number:
Move-ADDirectoryServerOperationMasterRole -Identity "DCX" -OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster
Move-ADDirectoryServerOperationMasterRole "DCX" -OperationMasterRole 0,1,2,3,4
That's it. Same command either way. Name the destination domain controller, then list the roles you want it to take.
 |
| GPOs don't work on the VPN? |
Get-NetConnectionProfile
Name : domain.com
InterfaceAlias : Ethernet (Domain)
InterfaceIndex : 1
NetworkCategory : DomainAuthenticated
IPv4Connectivity : Internet
IPv6Connectivity : NoTraffic
Name : Unidentified network
InterfaceAlias : RDMA
InterfaceIndex : 2
NetworkCategory : Public
IPv4Connectivity : NoTraffic
IPv6Connectivity : NoTraffic
Set-NetConnectionProfile -InterfaceIndex 13 -NetworkCategory Private