firewallipv6routerossecurity

IPv6 Default Firewall for RouterOS v6 and v7

Address List — Bad IPv6 Addresses

Blocks reserved and problematic IPv6 ranges:

RangeDescription
::/128Unspecified
::1Loopback
fec0::/10Site-local
::ffff:0:0/96IPv4-mapped
::/96IPv4-compatible
100::/64Discard-only prefix
2001:db8::/32Documentation
2001:10::/28ORCHID
3ffe::/166bone

Input Chain Rules

Accepts:

  • Established and related connections
  • ICMPv6 traffic
  • UDP traceroute (ports 33434-33534)
  • DHCPv6 prefix delegation
  • IKE and IPsec protocols

Non-LAN traffic dropped by default.

Forward Chain Rules

  • Drops packets with bad source/destination IPv6 addresses
  • Enforces IPsec policies
  • Permits ICMPv6 and established connections

Purpose

This configuration provides sensible defaults to secure IPv6 traffic on RouterOS installations, filtering malicious and reserved address ranges while maintaining necessary protocol functionality.