Mikrotik IPv6 σε PPPoE client με modem σε bridge mode

[Gordon`s]

Δεν παίρνει καν prefix.

[deniSun]

Σβήσε τα όλα και κάνε το με τα παρακάτω:

System > Package List > ipv6 (enable)
PPP > Profiles > default-encryption 
	General
		Change TCP MSS:	yes
	Protocols
		Use IPv6: yes
		Use MPLS: no
		Use Compression: default
		Use Encryption: yes
IPv6 > DHCPv6 Client > (+)
	Interface: pppoe-out1
	Request: prefix
	Pool Name: ipv6-pool
	Pool Prefix Length: 64 
	(X) Use Peer DNS
	(X) Rapid Commit
	(x) Add Default Route
IPv6 > ND > Interfaces 
	(default)
	Interface: bridge1	
	RA Interval: 10-30 
	RA Delay: 3
	RA Lifetime: 1800
	Advertise MAC Address		
IPv6 > ND > Prefixes
	Default:
		Autonomous
		Valid Lifetime: 0d 00:05:00 
		Preferred Lifetime: 0d 00:02:00 
IPv6 > Addresses > (+)	
	Address: ::/64
	From Pool: ipv6-pool
	Interface: bridge1
	Advertise

Στην κορυφή του fw:

/ipv6 firewall mangle
add action=change-mss chain=forward comment="Change MSS" new-mss=\
    clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn

Βάλε επάνω το ρούτερ του παρόχου και δες αν παίρνει ν6.
Μπορεί να έχει κάποιο τοπικό πρόβλημα ο πάροχος.

[Gordon`s]

Καλημέρα ευχαριστώ. Τελικά έφταιγε ο παρακάτω:

add action=drop chain=input comment="Input drop all not from LAN" \
    in-interface=PPPoE

Δεν καταλαβαίνω γιατί δούλευε και μετά σταμάτησε αλλά σίγουρα αυτός ήταν (και τώρα που το ξαναβλέπω, λογικό είναι)..

[jasonpap]

Σε vodafone vdsl με h300s που δεν έχει bridge mode παίζει να πάρει ipv6 το mikrotik? Σαν ένα απλό device δηλαδή χωρίς να μοιράζει αυτό διευθύνσεις κλπ

[deniSun]

Σε vodafone vdsl με h300s που δεν έχει bridge mode παίζει να πάρει ipv6 το mikrotik? Σαν ένα απλό device δηλαδή χωρίς να μοιράζει αυτό διευθύνσεις κλπ

Με passthrough παίζεις;
Μπορείς να βάλεις τον client απλά να πάρει ν6 για τον ΜΤ χωρίς να το κάνει advertise στις άλλες συσκευές.

[jasonpap]

Με passthrough παίζεις;
Μπορείς να βάλεις τον client απλά να πάρει ν6 για τον ΜΤ χωρίς να το κάνει advertise στις άλλες συσκευές.

Δεν υπάρχει τρόπος σε αυτό το modem να σηκώσεις αλλού το pppoe.. Έκανα μια βιαστική δοκιμή αλλά δεν παίρνει ipv6.

[leasedline]

να προσπαθήσω για IPV6 με το ΜΤ --->pppoe--->835--> ΟΝΤ ή όχι;

[leasedline]

να προσπαθήσω για IPV6 με το ΜΤ --->pppoe--->835--> ΟΝΤ ή όχι;

θα πρέπει να τα στήσω όλα από την αρχή...
IPv6 παίρνει αλλά όχι από τον dhcp client στο PPPoE με αποτέλεσμα και το Pc να παίρνει διεύθυνση αλλα όχι GW.... ping o ρούτερ κάνει...αλλα τα pc όχι παραμόνο στην εξωτερική ΙΡ του ΜΚ, τι μπερδεμα!

[deniSun]

θα πρέπει να τα στήσω όλα από την αρχή...
IPv6 παίρνει αλλά όχι από τον dhcp client στο PPPoE με αποτέλεσμα και το Pc να παίρνει διεύθυνση αλλα όχι GW.... ping o ρούτερ κάνει...αλλα τα pc όχι παραμόνο στην εξωτερική ΙΡ του ΜΚ, τι μπερδεμα!

Για δώσε τις ρυθμίσεις όλου του ν6 να δούμε.

[leasedline]

/ipv6 dhcp-server
add address-pool=localPool6 dhcp-option="" disabled=no interface=bridge-local lease-time=3d name=server1 preference=\
    255 rapid-commit=yes route-distance=1 use-radius=no
/ipv6 pool
add name=localPool6 prefix=2000:0:0:1::/64 prefix-length=64
/ipv6 dhcp-client
add add-default-route=yes default-route-distance=1 dhcp-options="" dhcp-options="" disabled=no interface=\
    FTTH-Out-PPPoE pool-name=VF pool-prefix-length=64 prefix-hint=::/0 request=address,prefix use-peer-dns=yes

/ipv6 firewall filter
add action=accept chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state \
    !connection-rate connection-state=established,related,new !connection-type !content disabled=no !dscp \
    !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port !headers !hop-limit !icmp-options \
    !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !limit log=\
    no log-prefix="" !out-bridge-port !out-bridge-port-list !out-interface !out-interface-list !packet-mark \
    !packet-size !per-connection-classifier !port !priority !protocol !random !routing-mark !src-address \
    !src-address-list !src-address-type !src-mac-address !src-port !tcp-flags !tcp-mss !time !tls-host
/ipv6 firewall mangle
add action=change-mss chain=forward !connection-bytes !connection-limit !connection-mark !connection-nat-state \
    !connection-rate !connection-state !connection-type !content disabled=no !dscp !dst-address !dst-address-list \
    !dst-address-type !dst-limit !dst-port dst-prefix=::/0 !headers !hop-limit !icmp-options !in-bridge-port \
    !in-bridge-port-list !in-interface !in-interface-list !ingress-priority !ipsec-policy !limit log=yes log-prefix=\
    "" new-mss=clamp-to-pmtu !out-bridge-port !out-bridge-port-list out-interface=FTTH-Out-PPPoE !out-interface-list \
    !packet-mark !packet-size passthrough=yes !per-connection-classifier !port !priority protocol=tcp !random \
    !routing-mark !src-address !src-address-list !src-address-type !src-mac-address !src-port src-prefix=::/0 \
    tcp-flags=syn !tcp-mss !time !tls-host
/ipv6 firewall nat
add action=masquerade chain=srcnat !connection-bytes !connection-limit !connection-mark !connection-rate \
    !connection-type !content disabled=no !dscp !dst-address !dst-address-list !dst-address-type !dst-limit !dst-port \
    !headers !hop-limit !icmp-options !in-bridge-port !in-bridge-port-list !in-interface !in-interface-list \
    !ingress-priority !ipsec-policy !limit log=yes log-prefix="" !out-bridge-port !out-bridge-port-list \
    out-interface=FTTH-Out-PPPoE !out-interface-list !packet-mark !packet-size !per-connection-classifier !port \
    !priority !protocol !random !routing-mark !src-address !src-address-list !src-address-type !src-mac-address \
    !src-port !tcp-mss !time !to-address !to-ports
/ipv6 nd
set [ find default=yes ] advertise-dns=no advertise-mac-address=yes disabled=yes dns="" hop-limit=unspecified \
    interface=all managed-address-configuration=no mtu=unspecified other-configuration=no pref64="" ra-delay=3s \
    ra-interval=3m20s-10m ra-lifetime=30m ra-preference=medium reachable-time=unspecified retransmit-interval=\
    unspecified
add advertise-dns=yes advertise-mac-address=yes disabled=no dns="" hop-limit=64 interface=FTTH-Out-PPPoE \
    managed-address-configuration=no mtu=unspecified other-configuration=no pref64="" ra-delay=3s ra-interval=10s-30s \
    ra-lifetime=30m ra-preference=medium reachable-time=unspecified retransmit-interval=unspecified
add advertise-dns=yes advertise-mac-address=yes disabled=no dns="" hop-limit=64 interface=bridge-local \
    managed-address-configuration=no mtu=unspecified other-configuration=no pref64="" ra-delay=3s ra-interval=10s-30s \
    ra-lifetime=30m ra-preference=medium reachable-time=unspecified retransmit-interval=unspecified
/ipv6 nd prefix
add 6to4-interface=none autonomous=yes disabled=no interface=FTTH-Out-PPPoE on-link=yes preferred-lifetime=1w prefix=\
    ::/64 valid-lifetime=4w2d
/ipv6 nd prefix default
set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d
/ipv6 settings
set accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes disable-ipv6=no forward=yes \
    max-neighbor-entries=8192

[deniSun]

Γιατί βάζεις dhcp server και nat.
Δες αυτό:

Spoiler:

/ipv6 dhcp-client
add interface=pppoe-out1 pool-name=ipv6-pool rapid-commit=no request=prefix \
    use-peer-dns=no

/ipv6 nd
set [ find default=yes ] advertise-dns=no interface=bridge1 ra-interval=\
    10s-30s

/ipv6 nd prefix default
set preferred-lifetime=2m valid-lifetime=5m

/ipv6 settings
set max-neighbor-entries=8192

ipv6 address
add address=::/64 from-pool=ipv6-pool interface=bridge1

Spoiler:

/ipv6 firewall address-list
add address=::/96 comment="IPv4 Compatible" list=BadIP
add address=::1/128 comment=Loopback list=BadIP
add address=::127.0.0.0/104 comment=Loopback list=BadIP
add address=::224.0.0.0/100 comment=Multicast list=BadIP
add address=::255.0.0.0/104 comment="Limited broadcast" list=BadIP
add address=::ffff:0.0.0.0/96 comment="IPv4 translated" list=BadIP
add address=2001:db8::/32 comment="Documentation prefix" list=BadIP
add address=2001:20::/28 comment=ORCHIDv2 list=BadIP
add address=2001:10::/28 comment=ORCHID list=BadIP
add address=100::/64 comment="Discard prefix" list=NotGlobalIP
add address=2001::/32 comment="Teredo tunneling" list=NotGlobalIP
add address=fc00::/7 comment="Unique local" list=NotGlobalIP
add address=ff00::/8 comment=Multicast list=NotGlobalIP
add address=::/128 comment=Unspecified list=BadSrcIP
add address=ff00::/8 comment=Multicast list=BadSrcIP
add address=::/128 comment=Unspecified list=BadDstIP
add address=fe80::/10 comment="Link local" list=NoForwardIP
add address=3ffe::/16 comment=6bone list=BadIP
add address=ff00::/8 comment=Multicast list=NoForwardIP

Spoiler:

/ipv6 firewall filter
add action=accept chain=input comment=\
    "Input accept established, related, untracked connections" \
    connection-state=established,related,untracked
add action=drop chain=input comment="Input drop invalid connections" \
    connection-state=invalid
add action=accept chain=input comment="Input accept ICMP" protocol=icmpv6
add action=accept chain=input comment="Input accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment="Input accept DHCPv6 client" dst-port=\
    546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="Input accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="Input accept IPSec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="Input accept IPSec ESP" protocol=\
    ipsec-esp
add action=drop chain=input comment="Input drop all not from LAN" \
    in-interface-list=WAN
add action=accept chain=forward comment=\
    "Forward accept established, related, untracked connections" \
    connection-state=established,related,untracked
add action=drop chain=forward comment="Forward  drop invalid connections" \
    connection-state=invalid
add action=drop chain=forward comment="Forward drop bad ICMP" hop-limit=\
    equal:1 protocol=icmpv6
add action=accept chain=forward comment="Forward accept ICMP" protocol=icmpv6
add action=accept chain=forward comment="Forward accept HIP" protocol=139
add action=accept chain=forward comment="Forward accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="Forward accept IPSec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="Forward accept IPSec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "Forward accept all that matches IPSec" ipsec-policy=in,ipsec
add action=drop chain=forward comment="Drop no forward IP" src-address-list=\
    NoForwardIP
add action=drop chain=forward comment="Drop no forward IP" dst-address-list=\
    NoForwardIP
add action=drop chain=forward comment="Forward drop all not from LAN" \
    in-interface-list=WAN

Spoiler:

/ipv6 firewall mangle
add action=change-mss chain=forward comment="Change MSS" dst-prefix=::/0 \
    new-mss=clamp-to-pmtu passthrough=yes protocol=tcp src-prefix=::/0 \
    tcp-flags=syn

Spoiler:

/ipv6 firewall raw
add action=drop chain=prerouting comment="Drop bad IP" src-address-list=BadIP
add action=drop chain=prerouting comment="Drop bad IP" dst-address-list=BadIP
add action=drop chain=prerouting comment="Drop bad src IP" src-address-list=\
    BadSrcIP
add action=drop chain=prerouting comment="Drop bad dst IP" dst-address-list=\
    BadDstIP
add action=drop chain=prerouting comment="Drop non global IP" \
    in-interface-list=WAN src-address-list=NotGlobalIP
add action=accept chain=prerouting comment="Accept local multicast" \
    dst-address=ff02::/16
add action=drop chain=prerouting comment="Drop other multicast" dst-address=\
    ff00::/8
add action=jump chain=prerouting comment="Check TCP SYN, ACK" \
    in-interface-list=WAN jump-target=ddos protocol=tcp src-address-list=\
    !BlockedDDoSAttacker tcp-flags=syn,ack
add action=return chain=ddos comment="______Check for SYN, SYN-ACK flood" \
    dst-limit=64,64,src-and-dst-addresses/10s
add action=add-src-to-address-list address-list=BlockedDDoSAttacker \
    address-list-timeout=10m chain=ddos comment="______Block DDoS attacker" \
    log=yes
add action=drop chain=prerouting comment="Drop DDoS" in-interface-list=WAN \
    src-address-list=BlockedDDoSAttacker
add action=jump chain=prerouting comment="Check TCP" in-interface-list=WAN \
    jump-target=tcp protocol=tcp src-address-list=!BlockedAddress
add action=add-src-to-address-list address-list=BlockedAddress \
    address-list-timeout=10m chain=tcp comment=\
    "______Block NMAP FIN Stealth scan" log=yes protocol=tcp tcp-flags=\
    fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=BlockedAddress \
    address-list-timeout=10m chain=tcp comment="______Block SYN/FIN scan" \
    log=yes protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=BlockedAddress \
    address-list-timeout=10m chain=tcp comment="______Block SYN/RST scan" \
    log=yes protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=BlockedAddress \
    address-list-timeout=10m chain=tcp comment="______Block FIN/PSH/URG scan" \
    log=yes protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=BlockedAddress \
    address-list-timeout=10m chain=tcp comment="______Block ALL/ALL scan" \
    log=yes protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=BlockedAddress \
    address-list-timeout=10m chain=tcp comment="______Block NMAP NULL scan" \
    log=yes protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=prerouting comment="Drop Blocked Address" \
    in-interface-list=WAN src-address-list=BlockedAddress
add action=accept chain=prerouting comment="Accept all from WAN" \
    in-interface-list=WAN
add action=accept chain=prerouting comment="Accept all from LAN" \
    in-interface-list=!WAN
add action=drop chain=prerouting comment="Drop all others"

[leasedline]

Yess!
Ευχαριστώ για το χρόνο σου!

- - - Updated - - -

αλλά έχω ένα μικρό θεματάκι το 951G-2ΗνD δε σηκώνει όλους αυτούς τους κανόνες στο firewall...

στα 80Mbps τερματίζω CPU....

[deniSun]

Yess!
Ευχαριστώ για το χρόνο σου!

- - - Updated - - -

αλλά έχω ένα μικρό θεματάκι το 951G-2ΗνD δε σηκώνει όλους αυτούς τους κανόνες στο firewall...

στα 80Mbps τερματίζω CPU....

Πότε σου την τερματίζει;
Όταν κατεβάζεις στο full;

[leasedline]

Πότε σου την τερματίζει;
Όταν κατεβάζεις στο full;

ναι στο speedtest! το IPv4 το έχω με fasttrack για να δω τα 300!

[deniSun]

Με ένα core μια χαρά τα πάει.