Mikrotik IPv6 configuration

In this topic, it is described how to configure Mikrotik router to act as PPPoE server with IPv6 enabled. The configuration of IPv6 in general is described in article – https://splynx.com/5665/splynx-ipv6-support/ and IPv6 Home routers configuration you can find here – https://splynx.com/5747/ipv6-cpe-and-home-routers-support/

The first tests were started with ROUTER OS Version 6.42.6, however, unfortunately, version prior to 6.43 doesn’t support Radius Delegated IPv6 attribute at all, in 6.43 it doesn’t support DHCPv6 accounting, so please upgrade at least to 6.46.1 or later RouterOS version.

When the router is upgraded, we can work on PPPoE server configuration.

As the first step, Mikrotik PPPoE server with Radius authentication should be created. Below is the screenshot of PPPoE server configuration on RouterOS.

Please note, that IPv6 pool should be selected and this is important. It is an IPv6 network that we use on PPPoE server. Customers should receive IPv6 delegated prefixes from this pool. At the moment (version 6.46 of Mikrotik), Radius server is not able to assign Delegated-IPv6 network to the PPPoE customer.
That’s why it’s needed to define the pool in IPv6 pool and then, when the customer is online, Splynx grabs used IPv6 network from Radius accounting packets and stores information in own database.

Below is a link to petition that asks Mikrotik to support Delegated-IPv6-Prefix correctly.
Currently, the attribute can be sent from Radius to Mikrotik PPPoE server in the Access accept message, but it is ignored by the router.
In case, when IPv6 prefix is delegated by the IP pool inside Mikrotik PPPoE settings, then attribute Delegated-IPv6-Prefix is sent back to Radius in Accounting packets, informing that customer got certain IPv6 delegated pool.

https://www.change.org/p/wisp-the-implementation-of-radius-delegated-ipv6-prefix-for-mikrotik-pppoe-servers

Unfortunately, there is no way to assign public IPv6 to WAN PPPoE interface of the customer via Radius server. Lack of this feature is not that crucial, because PPPoE works well on local link addresses, but we think that it should be also available on Mikrotik Radius implementation.

Regarding Splynx configuration – the Internet service of customer should be configured with empty IPv6 and Delegated IPv6 fields. The IPv6 appears in online session of customers and is stored to the logs and statistics. Radius based simple queues are applied to the pppoe tunnel and there is no additional queue needed for IPv6 traffic. Below is a screenshot of such sessions

 

 

Another option how to check IPv6 prefixes that were assigned to CPE devices – check the DHCPv6 server leases in Mikrotik.
Below is an example of DHCPv6 active leases

Next question is – how to block IPv6 traffic? Usually, IPv4 traffic is blocked when customer’s IP address is put to the address list and traffic is redirected. The other option is to assign to customer the IP address from special pool for blocked subscribers. This configuration cannot be achieved with IPv6, because currently Radius cannot assign the special pool or manipulate anyhow with IPv6 of the end user.

The only possible option is to have several Profiles configured in Mikrotik PPPoE server. Profile can be sent from Radius to Mikrotik PPPoE router via attribute Mikrotik-Group. Here is a description of the attribute from Mikrotik website :
Mikrotik-Group – Router local user group name (defines in /user group) for local users; HotSpot default profile for HotSpot users; PPP default profile name for PPP users.

In this case, we will define two profiles – default and block, with two different IPv6 pools. Default profile is used for authenticated users and block profile we assign to locked or non-authenticated customers.
These two profiles should be defined in Splynx Radius blocking attributes, please follow the screenshot below.

Second option how to block customers, is to use Mikrotik-Delegated-IPv6-Pool attribute, instead of choosing and configuring the different profiles, it’s possible to set name of Pool that should be used for blocked customer. For example, customer that is active will get IP from pool “default” and in case of blocking – he will get IPv6 from pool “blocked”

 

Mikrotik as CPE or home router with IPv6
Mikrotik can act as a home router or CPE with IPv6 support enabled. First of all, we need to activate IPv6 package that is always disabled by default.

Let’s imagine that we have one WAN interface with pppoe-client and Bridge configured for LAN interfaces.
After the activation of pppoe interface and setting user/password there, we should enable DHCPv6 client on pppoe-client interface. DHCPv6 client should receive the delegated prefix from PPPoE router (yes, it sounds weird, but there is a DHCP client running over PPPOE client for IPv6, because natively there is no way to provide to home router delegated prefix).
Please don’t forget to configure the pool name and then create IP address assignment with SLAAC on LAN interface. Better is just to copy and paste configuration shown on the screenshot below 🙂

 

Should you have any questions related to IPv6 configuration or you want to try Splynx in action, feel free to contact us.