Skip to content
MikroTik RouterOS Docs

MikroTik RouterOS IPv6 Address Configuration: The Complete Guide

MikroTik RouterOS IPv6 Address Configuration: The Complete Guide

Section titled “MikroTik RouterOS IPv6 Address Configuration: The Complete Guide”

RouterOS Version: 7.x+ (v7 has completely new IPv6 stack) Difficulty: Beginner to Intermediate Estimated Time: 30 minutes

Overview

Section titled “Overview”

IPv6 addresses are the foundation of next-generation networking in RouterOS. Unlike IPv4’s 32-bit addresses, IPv6 uses 128-bit addresses written in hexadecimal, providing a virtually unlimited address space. This guide covers how to configure, manage, and troubleshoot IPv6 addresses on your MikroTik router.

RouterOS supports multiple IPv6 address types: link-local addresses (automatically generated for every active interface), global unicast addresses (for internet connectivity), and unique local addresses (ULA, equivalent to IPv4 private ranges). Each serves a specific purpose in your network design.

The key difference from IPv4: link-local addresses are always present on every active interface and are essential for IPv6 operation. You cannot remove them while the interface is active.

Prerequisites

Section titled “Prerequisites”

Before configuring IPv6 addresses, ensure the IPv6 package is enabled:

# Check if IPv6 package is available
/system package print where name=ipv6


# If disabled, enable it
/system package enable ipv6


# Reboot to activate
/system reboot

After reboot, verify IPv6 is available:

/ipv6 address print

If you see “bad command name address”, the IPv6 package is not enabled.

Understanding IPv6 Address Types

Section titled “Understanding IPv6 Address Types”
TypePrefixPurposeRoutable
Link-localfe80::/10Communication on local link onlyNo
Global unicast2000::/3Internet-routable addressesYes
Unique Local (ULA)fd00::/8Private networks (like RFC1918)No*
Loopback::1/128Local loopbackNo
Multicastff00::/8One-to-many communicationDepends

*ULA addresses are technically routable within your organization but not on the public internet.

Configuration Steps

Section titled “Configuration Steps”

Step 1: Assign a Static IPv6 Address

Section titled “Step 1: Assign a Static IPv6 Address”

The most basic configuration - assign a global IPv6 address to an interface:

/ipv6 address add address=2001:db8:1::1/64 interface=ether2 comment="LAN Gateway"

Key points:

  • Always include the prefix length (e.g., /64)
  • The /64 prefix is standard for LAN segments
  • A connected route is automatically created for the prefix

Step 2: Verify the Address

Section titled “Step 2: Verify the Address”
/ipv6 address print

Expected Output:

Flags: D - DYNAMIC; G - GLOBAL; L - LINK-LOCAL
 #    ADDRESS                                     INTERFACE
 0  G 2001:db8:1::1/64                            ether2
 1 DL fe80::6e3b:6bff:fefd:7ebc/64                ether2

Flags explained:

  • G = Global (routable)
  • L = Link-local
  • D = Dynamic (auto-generated)
  • I = Invalid (problem with address)

Step 3: Enable SLAAC for LAN Clients

Section titled “Step 3: Enable SLAAC for LAN Clients”

To allow LAN devices to auto-configure their IPv6 addresses via Stateless Address Autoconfiguration (SLAAC):

/ipv6 address add address=2001:db8:1::1/64 interface=bridge-lan advertise=yes

The advertise=yes parameter tells RouterOS to include this prefix in Router Advertisements. LAN clients will generate their own addresses within the same /64 prefix.

Verify advertising is enabled:

/ipv6 address print detail where interface=bridge-lan

Look for advertise=yes in the output.

Step 4: Configure Address with EUI-64

Section titled “Step 4: Configure Address with EUI-64”

EUI-64 automatically generates the host portion of the address from the interface’s MAC address:

/ipv6 address add address=2001:db8:2::/64 interface=ether3 eui-64=yes

Important: When using eui-64=yes, the address must have zero host bits. Use 2001:db8:2::/64, not 2001:db8:2::1/64.

The resulting address will look like: 2001:db8:2::6e3b:6bff:fefd:7ebc/64

How EUI-64 works:

  1. Takes the 48-bit MAC address (e.g., 6c:3b:6b:fd:7e:bc)
  2. Inserts ff:fe in the middle
  3. Flips the 7th bit (universal/local bit)
  4. Result: 6e3b:6bff:fefd:7ebc

Using DHCPv6 Prefix Delegation

Section titled “Using DHCPv6 Prefix Delegation”

Most ISPs provide IPv6 via DHCPv6 Prefix Delegation (PD). Here’s how to configure it:

Step 1: Configure DHCPv6 Client on WAN

Section titled “Step 1: Configure DHCPv6 Client on WAN”
/ipv6 dhcp-client add interface=ether1-wan request=prefix pool-name=isp-prefix pool-prefix-length=64 add-default-route=yes

This requests a prefix from your ISP and stores it in a pool named isp-prefix.

Step 2: Verify Prefix Received

Section titled “Step 2: Verify Prefix Received”
/ipv6 dhcp-client print detail

Look for status=bound and a prefix in the output.

Step 3: Assign Address from Pool to LAN

Section titled “Step 3: Assign Address from Pool to LAN”
/ipv6 address add address=::1/64 from-pool=isp-prefix interface=bridge-lan advertise=yes

The ::1 becomes the host portion, combined with the prefix from the pool. If your ISP assigns 2001:db8:abcd:1::/64, your LAN gateway becomes 2001:db8:abcd:1::1/64.

Step 4: Verify Dynamic Address

Section titled “Step 4: Verify Dynamic Address”
/ipv6 address print where from-pool=isp-prefix

The address will have the D (dynamic) flag and update automatically if the ISP changes your prefix.

Configuring Unique Local Addresses (ULA)

Section titled “Configuring Unique Local Addresses (ULA)”

For internal networks that don’t need internet connectivity, use ULA addresses:

/ipv6 address add address=fd00:1234:5678::1/64 interface=bridge-lan advertise=yes comment="ULA Internal"

ULA guidelines:

  • Use the fd00::/8 prefix
  • Generate a random 40-bit global ID (the 1234:5678 portion)
  • Each subnet gets its own 16-bit subnet ID
  • Host portion follows standard /64 conventions

Accepting Router Advertisements (Client Mode)

Section titled “Accepting Router Advertisements (Client Mode)”

If your router should receive IPv6 configuration from an upstream router:

/ipv6 settings set accept-router-advertisements=yes

This enables:

  • Automatic address assignment via SLAAC
  • Default route from Router Advertisements

Verify:

/ipv6 address print where dynamic
/ipv6 route print where dst-address="::/0"

Working with Bridges

Section titled “Working with Bridges”

When assigning IPv6 to a bridge, add the address to the bridge interface directly, not to member ports:

# Create bridge
/interface bridge add name=bridge-lan


# Add ports
/interface bridge port add bridge=bridge-lan interface=ether2
/interface bridge port add bridge=bridge-lan interface=ether3


# Add IPv6 to bridge (not to ether2 or ether3)
/ipv6 address add address=2001:db8:1::1/64 interface=bridge-lan advertise=yes

If you add an address to an interface that later becomes a bridge port, the actual-interface property will show the bridge:

/ipv6 address print detail

Static Default Route

Section titled “Static Default Route”

For environments without Router Advertisements, add a static default route:

# Using global address as gateway
/ipv6 route add dst-address=::/0 gateway=2001:db8:0:1::1


# Using link-local address (must specify interface)
/ipv6 route add dst-address=::/0 gateway=fe80::1%ether1-wan

Important: Link-local gateways require the %interface suffix because link-local addresses exist on every interface.

Verification

Section titled “Verification”

Check 1: Verify IPv6 Addresses

Section titled “Check 1: Verify IPv6 Addresses”
/ipv6 address print

Expected Output:

Flags: D - DYNAMIC; G - GLOBAL; L - LINK-LOCAL
 #    ADDRESS                                     INTERFACE
 0  G 2001:db8:1::1/64                            bridge-lan
 1 DL fe80::6e3b:6bff:fefd:7ebc/64                bridge-lan
 2 DL fe80::1234:5678:90ab:cdef/64                ether1-wan

Check 2: Verify No Invalid Addresses

Section titled “Check 2: Verify No Invalid Addresses”
/ipv6 address print where invalid

Expected Output: Empty list (no invalid addresses).

Check 3: Verify Connected Routes

Section titled “Check 3: Verify Connected Routes”
/ipv6 route print where connect

Expected Output: Routes with DAc flags for each configured prefix.

Check 4: Test Connectivity

Section titled “Check 4: Test Connectivity”
# Local loopback
/ping ::1 count=3


# Google IPv6 DNS (if internet connected)
/ping 2001:4860:4860::8888 count=3

Check 5: Verify SLAAC Advertising

Section titled “Check 5: Verify SLAAC Advertising”
/ipv6 nd print

Expected Output: ND entries for interfaces with advertise=yes addresses.

Troubleshooting

Section titled “Troubleshooting”

Problem: “bad command name address”

Section titled “Problem: “bad command name address””

Cause: IPv6 package not enabled.

Solution:

/system package enable ipv6
/system reboot
Section titled “Problem: Only link-local addresses, no global”

Cause: DHCPv6-PD not configured or ISP not providing prefix.

Solution:

  1. Verify DHCPv6 client is configured: /ipv6 dhcp-client print
  2. Check status is bound
  3. Verify ISP provides IPv6 prefix delegation
  4. Alternatively, add static global address if you have one assigned

Problem: Address shows “I” (invalid) flag

Section titled “Problem: Address shows “I” (invalid) flag”

Cause: Interface down, DAD failed, or VRF misconfiguration.

Solution:

  1. Check interface status: /interface print where name=INTERFACE
  2. Verify no duplicate addresses on the link
  3. Try disabling and re-enabling the address:
/ipv6 address disable [find address~"2001:db8"]
/ipv6 address enable [find address~"2001:db8"]

Problem: LAN clients not getting IPv6 addresses

Section titled “Problem: LAN clients not getting IPv6 addresses”

Cause: advertise=no on the IPv6 address.

Solution:

/ipv6 address set [find interface=bridge-lan] advertise=yes

Verify ND is working:

/ipv6 nd print

Problem: No default route after DHCPv6

Section titled “Problem: No default route after DHCPv6”

Cause: accept-router-advertisements=no (default).

Solution:

/ipv6 settings set accept-router-advertisements=yes

Or ensure DHCPv6 client has add-default-route=yes (though RAs are preferred).

Problem: “no route to host” for IPv6 destinations

Section titled “Problem: “no route to host” for IPv6 destinations”

Cause: Missing default route.

Solution:

  1. Check for default route: /ipv6 route print where dst-address="::/0"
  2. If missing, enable accept-router-advertisements=yes
  3. Or add static route: /ipv6 route add dst-address=::/0 gateway=UPSTREAM_IP

Problem: IPv6 not working after reboot

Section titled “Problem: IPv6 not working after reboot”

Cause: Known bug in some RouterOS versions.

Solution:

  1. Upgrade to latest stable RouterOS
  2. Workaround: Create scheduler script to disable/enable addresses after boot:
/system scheduler add name=fix-ipv6 on-event="/ipv6 address disable [find]; :delay 2s; /ipv6 address enable [find]" start-time=startup

Common Pitfalls

Section titled “Common Pitfalls”

1. EUI-64 with Non-Zero Host Bits

Section titled “1. EUI-64 with Non-Zero Host Bits”

Wrong:

/ipv6 address add address=2001:db8:1::1/64 interface=ether2 eui-64=yes

Right:

/ipv6 address add address=2001:db8:1::/64 interface=ether2 eui-64=yes
Section titled “2. Link-Local Gateway Without Interface”

Wrong:

/ipv6 route add dst-address=::/0 gateway=fe80::1

Right:

/ipv6 route add dst-address=::/0 gateway=fe80::1%ether1-wan

3. Adding Address to Bridge Port Instead of Bridge

Section titled “3. Adding Address to Bridge Port Instead of Bridge”

Wrong:

/ipv6 address add address=2001:db8:1::1/64 interface=ether2  # ether2 is bridge port

Right:

/ipv6 address add address=2001:db8:1::1/64 interface=bridge-lan

4. Forgetting to Advertise for SLAAC

Section titled “4. Forgetting to Advertise for SLAAC”

Wrong:

/ipv6 address add address=2001:db8:1::1/64 interface=bridge-lan
# advertise=no by default, LAN clients won't auto-configure

Right:

/ipv6 address add address=2001:db8:1::1/64 interface=bridge-lan advertise=yes

Best Practices

Section titled “Best Practices”
  1. Use /64 for LAN segments - This is required for SLAAC and is the standard practice
  2. Always enable SLAAC - Set advertise=yes on LAN-facing addresses
  3. Use pools for dynamic prefixes - The from-pool feature handles ISP prefix changes automatically
  4. Don’t remove link-local addresses - They’re essential for IPv6 operation
  5. Configure IPv6 firewall - Unlike IPv4/NAT, IPv6 clients are directly reachable (see IPv6 Firewall guide)
  6. Monitor for invalid addresses - Regularly check /ipv6 address print where invalid
Section titled “Related Topics”

IPv6 Services

Section titled “IPv6 Services”

IPv4 Equivalent

Section titled “IPv4 Equivalent”
Section titled “Related Topics”

References

Section titled “References”