Greek ISPs are handing out IPv6 whether you asked for it or not, and the dangerous state is "half on" — enabled, addressed, and completely unfirewalled, because there's no NAT hiding your hosts anymore. This is IPv6 on RouterOS done deliberately: get a prefix from the ISP, hand it to the LAN, and firewall it properly. The Cisco IPv6 post, in RouterOS.
IPv6 isn't "IPv4 with longer addresses" — the operational model differs in ways that matter on day one. There's normally no NAT: every host gets a globally routable address, so the accidental firewall that IPv4 NAT provided is gone. Addressing is usually automatic via SLAAC (hosts build their own address from a router-advertised prefix) rather than DHCP. And you don't get a single address from your ISP — you get a prefix via DHCPv6 Prefix Delegation (PD) that you subnet across your own VLANs.
The build is four steps: enable IPv6, request a delegated prefix from the ISP, advertise a /64 from it to the LAN, and — the step that's not optional — write an IPv6 firewall, because without it every internal host is directly reachable from the internet. Mirrors Cisco IOS: IPv6 Fundamentals; the firewall discipline builds on the RouterOS firewall.
01
RouterOS 7 ships IPv6 but leaves it disabled. Enable it and forwarding before anything else works.
> /ipv6 settings set disable-ipv6=no forward=yes # On RouterOS 6 it's a package instead: /system package enable ipv6, reboot. > /ipv6 settings print
02
Ask the ISP for a delegated prefix rather than a single address. RouterOS stores it in a pool you then carve /64s out of for each internal network.
> /ipv6 dhcp-client add interface=ether1 request=prefix \ pool-name=isp-pd pool-prefix-length=64 add-default-route=yes > /ipv6 dhcp-client print status: bound prefix: 2a02:...:1200::/56 # the delegated block # A /56 gives you 256 /64s — one per VLAN, with room to spare.
03
Assign an address to the LAN from the pool, and RouterOS advertises the prefix so hosts autoconfigure via SLAAC. No DHCP required for basic connectivity.
# Take a /64 out of the pool for the LAN bridge (::1 is the router). > /ipv6 address add interface=bridge from-pool=isp-pd address=::1 advertise=yes # Neighbour Discovery advertises the prefix; hosts SLAAC themselves. # advertise=yes on the address already triggers RAs on that interface. > /ipv6 nd print # Want DNS to hosts too? Advertise it via RA (RDNSS): > /ipv6 nd set [find] dns=2606:4700:4700::1111
04
The single most important section. With global addresses and no NAT, every internal host is directly reachable from the internet the moment IPv6 comes up. You must build an IPv6 firewall — and you must allow ICMPv6, or the protocol breaks.
# FORWARD: allow established/related out and back; drop new inbound. > /ipv6 firewall filter add chain=forward connection-state=established,related action=accept add chain=forward connection-state=invalid action=drop add chain=forward connection-state=new in-interface=ether1 action=drop \ comment="no unsolicited inbound from WAN" # INPUT: protect the router. CRUCIALLY allow ICMPv6 BEFORE the drop — # NDP, PMTUD and address config ride on it; block it and IPv6 falls apart. add chain=input connection-state=established,related action=accept add chain=input protocol=icmpv6 action=accept comment="ICMPv6 is mandatory" add chain=input src-address-list=MGMT action=accept add chain=input action=drop
IPv4 muscle memory says "drop ICMP, it's just ping." In IPv6, ICMPv6 carries Neighbour Discovery (the ARP replacement), Router Advertisements, and Path MTU Discovery. Block it wholesale and hosts can't resolve neighbours, can't autoconfigure, and large packets silently vanish — a maddening "half the internet loads" failure. Always accept protocol=icmpv6 above your drop rule. This is the number-one IPv6 firewall mistake, on every platform.
Takeaways
NOCTIS deploys and firewalls IPv6 correctly on MikroTik and Cisco across Crete — prefix delegation, clean per-VLAN addressing, and a ruleset that closes the doors NAT used to hide.
Book a Discovery Call →