Chci rozjet IPv6 na routeru (RouterOS)

<h2>Pokud mám RouterOS 7, mohu si zjednodušit následující kroky pomocí tohoto <a class="confluence-link" href="/download/attachments/149193194/RouterOS_7_IPv6.rsc?version=3&amp;modificationDate=1704201551136&amp;api=v2" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" data-linked-resource-content-type="application/octet-stream" data-linked-resource-id="153059833" data-linked-resource-version="3" data-linked-resource-type="attachment" data-linked-resource-default-alias="RouterOS_7_IPv6.rsc" data-base-url="https://confluence.hkfree.org">skriptu</a>.</h2><ul><li>upravím si proměnné dle <a href="https://ripe.hkfree.org/">https://ripe.hkfree.org/</a></li><li>skript si zkopíruju a v termínálu vložím</li><li>zkontorluji, zda vše proběhlo bez chyby</li><li>zkopíruji si v ospf interfaces-template dle IPv4 a upravím (popis ve skriptu)</li></ul><p><br /></p><p><br /></p><h2>Zapnout IPv6 a forwarding</h2><table class="wrapped confluenceTable"><colgroup><col /><col /></colgroup><tbody><tr><th scope="col" class="confluenceTh">RouterOS 7</th><th scope="col" class="confluenceTh">RouterOS 6</th></tr><tr><td class="confluenceTd"><div class="content-wrapper"><p>/ipv6/settings/set disable-ipv6=no</p><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2021.11.18.png?version=1&amp;modificationDate=1701721177061&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2021.11.18.png?version=1&amp;modificationDate=1701721177061&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193191" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 21.11.18.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 21.11.18.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 21.11.18.png" data-image-height="824" data-image-width="1194"></p></div></td><td class="confluenceTd"><div class="content-wrapper"><p>/system package enable ipv6 </p><p>/system reboot</p><p><img class="confluence-embedded-image" draggable="false" height="400" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2021.18.57.png?version=1&amp;modificationDate=1701721177023&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2021.18.57.png?version=1&amp;modificationDate=1701721177023&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193193" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 21.18.57.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 21.18.57.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 21.18.57.png" data-image-height="1078" data-image-width="1160"></p><p><br /></p><p> /ipv6 settings set forward=yes </p><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2021.17.22.png?version=1&amp;modificationDate=1701721177045&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2021.17.22.png?version=1&amp;modificationDate=1701721177045&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193192" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 21.17.22.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 21.17.22.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 21.17.22.png" data-image-height="760" data-image-width="1174"></p></div></td></tr></tbody></table><p><br /></p><h2>Nastavit vlastní adresu pro router</h2><p>Ideální je IPv6 adresu pro management routeru posadit na interface <strong>lo</strong> tedy loopback, který je neustále dostupný.<br /><strong><br />Tip</strong>: V RouterOS meší než 7.14 se loopback <strong>lo</strong> nastavuje tak, že se vytvoří samotný bridge bez portů. Pozná se tak, že L2 MTU je 65535. Bridge s porty má L2 MTU 1514. Mikrotik od verze 7.14 lo již zviditelnil a lze s ním pracovat jako s jakýmkoliv jiným rozhraním přes menu Interfaces ... stejně tak ho můžete adresovat.<br /><br /><span style="color: rgb(0,0,255);">/interface bridge</span><br /><span style="color: rgb(0,0,255);">add name=loopback-ipv6 protocol-mode=none</span><br /><br />Na tento loopback si pak můžeme pověsit &quot;pěknou globální IPv6 adresu&quot;, která nám bude sloužit primárně pro správu routeru například a bude snadno zapamatovatelná.</p><p>Na interface routeru doporučuji vždy nasazovat IPv6 adresu s prefixem<span> </span><strong>/64</strong><span> </span>(pokud tam chcete adresovat více zařízení) nebo<span> </span><strong>/128</strong><span> </span>(pokud vám stačí jen jedna adresa pro management). Vyvarujte se adresovat velké prefixy<span> </span><strong>/40</strong>,<strong><span> </span>/44</strong><span> </span>a<strong><span> </span>/48</strong><span> </span>pokud vyloženě nevíte co děláte - přináší to problémy a nestandardní chování. Například nefunguje redistribute static apod.</p><p> <br /><span style="color: rgb(0,0,255);">/ipv6 address</span><br /><span style="color: rgb(153,51,0);"><span style="color: rgb(0,0,255);">add address=2a01:168:xxxx::1/64 advertise=no interface=loopback-ipv6</span><br /><br /><span style="color: rgb(153,51,0);"><span style="color: rgb(0,0,0);">RouterOS 7.14+ (tady si již nemusíme / nepotřebujeme vypomáhat přes bridge):</span><br /><span style="color: rgb(0,0,255);">/ipv6 address</span></span><br /><span style="color: rgb(0,0,255);">add address=2a01:168:xxxx::1/64 advertise=no interface=lo</span></span><br /><br /></p><table class="wrapped confluenceTable"><colgroup class=""><col class="" /></colgroup><tbody class=""><tr class=""><th class="confluenceTh">RouterOS 6 i 7</th></tr><tr class=""><td class="confluenceTd"><div class="content-wrapper"><p>/ipv6 address add address=2a01:168:5830::/64 interface=bridge1 no-dad=yes advertise=no</p><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2022.21.47.png?version=1&amp;modificationDate=1701724924200&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2022.21.47.png?version=1&amp;modificationDate=1701724924200&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193208" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 22.21.47.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 22.21.47.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 22.21.47.png" data-image-height="700" data-image-width="1170"></p></div></td></tr></tbody></table><p><br /></p><p><br /></p><h2>Firewall: úplně základní zabezpečení</h2><table class="wrapped confluenceTable"><colgroup><col /></colgroup><tbody><tr><th scope="col" class="confluenceTh">RouterOS 6 i 7</th></tr><tr><td class="confluenceTd"><p>/ipv6 firewall filter</p><p>add action=accept chain=input comment=&quot;link-local traffic OK&quot; src-address=fe80::/10</p><p>add action=reject chain=input comment=&quot;No new ex-hkfree incoming connections on IPv6 (this router)&quot; connection-state=new protocol=!icmpv6 reject-with=icmp-admin-prohibited src-address=!2a01:168::/29<br /><br /></p><p><strong>Tip</strong>: Alternativa pokud na routeru zbytečně nechci stavový firewall (connection-state) viz. výše, ale čistý bezstavový: <br /><br />/ipv6 firewall address-list<br />add address=2a01:168::/29 comment=hkfree list=allowed<br />add address=fe80::/16 comment=link-local list=allowed<br />add address=ff02::/16 comment=multicast list=allowed<br /><br />/ipv6 firewall filter<br />add action=accept chain=input comment=&quot;allow ospfv3&quot; protocol=ospf<br />add action=accept chain=input comment=&quot;accept ICMPv6&quot; protocol=icmpv6<br />add action=accept chain=input comment=&quot;accept UDP traceroute&quot; port=33434-33534 protocol=udp<br />add action=accept chain=input comment=&quot;allow allowed addresses&quot; src-address-list=allowed<br />add action=drop chain=input comment=&quot;drop all&quot;</p></td></tr></tbody></table><p><br /></p><p><br /></p><h2>Routování - OSPFv3</h2><p>Nahodit OSPFv3 (IPv6) instance. Vše nastavit stejně jako v OSPFv2 (IPv4) instanci, kromě <strong>redistribute static</strong> = <strong>as type 1</strong>.</p><table class="wrapped confluenceTable"><colgroup><col /><col /></colgroup><tbody><tr><th scope="col" class="confluenceTh">RouterOS 7</th><th scope="col" class="confluenceTh">RouterOS 6</th></tr><tr><td class="confluenceTd"><br /></td><td class="confluenceTd"><div class="content-wrapper"><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2022.47.10.png?version=2&amp;modificationDate=1701729112341&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2022.47.10.png?version=2&amp;modificationDate=1701729112341&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193214" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 22.47.10.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 22.47.10.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 22.47.10.png" data-image-height="1298" data-image-width="1918"></p></div></td></tr></tbody></table><p><br /></p><p>Nastavit uplink interface</p><table class="wrapped confluenceTable"><colgroup class=""><col class="" /><col class="" /></colgroup><tbody class=""><tr class=""><th class="confluenceTh">RouterOS 7</th><th class="confluenceTh">RouterOS 6</th></tr><tr class=""><td class="confluenceTd"><br /></td><td class="confluenceTd"><div class="content-wrapper"><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.05.14.png?version=1&amp;modificationDate=1701728144598&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.05.14.png?version=1&amp;modificationDate=1701728144598&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193215" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 23.05.14.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.05.14.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.05.14.png" data-image-height="1598" data-image-width="1926"></p></div></td></tr></tbody></table><p><br /></p><p>Kontrola: vidíme 1x neighbor</p><table class="wrapped confluenceTable"><colgroup class=""><col class="" /><col class="" /></colgroup><tbody class=""><tr class=""><th class="confluenceTh">RouterOS 7</th><th class="confluenceTh">RouterOS 6</th></tr><tr class=""><td class="confluenceTd"><br /></td><td class="confluenceTd"><div class="content-wrapper"><p><img class="confluence-embedded-image" draggable="false" height="150" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.16.52.png?version=1&amp;modificationDate=1701728280981&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.16.52.png?version=1&amp;modificationDate=1701728280981&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193216" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 23.16.52.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.16.52.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.16.52.png" data-image-height="366" data-image-width="1542"><img class="confluence-embedded-image" draggable="false" height="150" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.17.27.png?version=1&amp;modificationDate=1701728281070&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.17.27.png?version=1&amp;modificationDate=1701728281070&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193217" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 23.17.27.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.17.27.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.17.27.png" data-image-height="346" data-image-width="1524"></p></div></td></tr></tbody></table><p><br /></p><h2>Routování - co budeme šířit ven?</h2><p>Zadat 1x agregovanou routu pro tento router. Velikost bude mezi /40 - /48, <a href="https://wiki.hkfree.org/IPv6#pods.C3.AD.C5.A5_v_oblasti_.2F48.2C_tzn._pp_.3D_00_-_ff_.28256_s.C3.ADt.C3.AD_v_oblasti.29.">záleží na správci</a>. Doporučuju /44.</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="cb27ce71-a438-41c0-9614-24945039ceff" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>/ipv6 route
add comment="Souhrnna agregovana routa" distance=1 dst-address=2a01:168:5800::/44 type=unreachable

# RouterOS 7.xx
/ipv6 route
add blackhole comment="Souhrnna agregovana routa" disabled=no distance=1 dst-address=2a01:168:5800::/44</pre></td></tr></table><p><br /></p><p>Zadat filtr na odchozí routy šířené přes OSPF ven. Žádný subnet menší než /48 nesmí ven. </p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="1f3c8e62-9d7a-4b69-959c-7b183cdcf8d9" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>/routing filter
add action=discard chain=ospf-out prefix-length=49-128

# RouterOS 7.xx
/routing filter rule
add chain=OSPFv3-out disabled=no rule="if (dst-len&lt;=48) { accept }"</pre></td></tr></table><p><img class="confluence-embedded-image" draggable="false" height="400" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.38.02.png?version=1&amp;modificationDate=1701729538306&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.38.02.png?version=1&amp;modificationDate=1701729538306&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193221" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 23.38.02.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.38.02.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.38.02.png" data-image-height="1104" data-image-width="1166"></p><p>Důležitý je zadat <strong>type</strong> = <strong>discard</strong> a distance = 1. Tím vznikne tzv. &quot;blackhole&quot; routa.</p><p><br /></p><h2>Kontrola</h2><p>Máme default routu (<code>2000::/3</code>) v routovací tabulce a vede do interface, kde máme uplink (<code>ether1</code>) .</p><p>Máme tam &quot;hodně&quot; 90+ rout z celé hkfree sítě.</p><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.44.37.png?version=1&amp;modificationDate=1701729929178&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-04%20at%2023.44.37.png?version=1&amp;modificationDate=1701729929178&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193225" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-04 at 23.44.37.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.44.37.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-04 at 23.44.37.png" data-image-height="348" data-image-width="1168"></p><p><br /></p><p>Dopingáme se na DNS</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="2c8959c8-b9be-47c6-bdc4-cef3e1dd43f7" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>[Praskacka3 router] > ping 2a01:168:0:10::f:2
  SEQ HOST                                     SIZE TTL TIME  STATUS             
    0 2a01:168:0:10::f:2                         56  62 1ms   echo reply         
    1 2a01:168:0:10::f:2                         56  62 0ms   echo reply         
    2 2a01:168:0:10::f:2                         56  62 0ms   echo reply         
    3 2a01:168:0:10::f:2                         56  62 0ms   echo reply         
    4 2a01:168:0:10::f:2                         56  62 1ms   echo reply         
    sent=5 received=5 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=1ms

</pre></td></tr></table><p><br /></p><h2>Nastavit DHCP v6</h2><p>Budeme nastavovat co připojenec to statický /56 příděl. Dynamický pool (poslední 4 z 256 přídělů) je pro snazší práci se zjišťováním DUID.</p><table class="wysiwyg-macro" data-macro-name="code" data-macro-id="df06f331-46a2-443a-ade6-c2967429afbd" aria-label="code macro" data-macro-schema-version="1" style="background-image: url(https://confluence.hkfree.org/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGV9&amp;locale=cs_CZ&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>/ipv6 pool add name=pool-5830-last4 prefix=2a01:168:5830:fc00::/54 prefix-length=56 comment="Odsud se prideluji /56 subnety pripojencum"

/ipv6 dhcp-server add name=server1 interface=bridge1 address-pool=pool-5830-last4 lease-time=24:00:00</pre></td></tr></table><p><img class="confluence-embedded-image" draggable="false" height="250" src="/download/attachments/149193194/Screen%20Shot%202023-12-05%20at%2000.11.08.png?version=1&amp;modificationDate=1701731514845&amp;api=v2" data-image-src="/download/attachments/149193194/Screen%20Shot%202023-12-05%20at%2000.11.08.png?version=1&amp;modificationDate=1701731514845&amp;api=v2" data-unresolved-comment-count="0" data-linked-resource-id="149193230" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Screen Shot 2023-12-05 at 00.11.08.png" data-base-url="https://confluence.hkfree.org" data-linked-resource-content-type="image/png" data-linked-resource-container-id="149193194" data-linked-resource-container-version="15" title="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-05 at 00.11.08.png" data-location="IPv6 > Chci rozjet IPv6 na routeru (RouterOS) > Screen Shot 2023-12-05 at 00.11.08.png" data-image-height="858" data-image-width="1892"></p><p><br /></p><p><br /></p><p><br /></p>