IPv6 Static Routes
IPv6 Static Routes
Section titled “IPv6 Static Routes”TL;DR (Quick Start)
Section titled “TL;DR (Quick Start)”For the impatient: add a default IPv6 route to your ISP gateway.
/ipv6 route add dst-address=::/0 gateway=2001:db8::1For link-local gateway (common with ISPs):
/ipv6 route add dst-address=::/0 gateway=fe80::1%ether1Verify with:
/ipv6 route print where dst-address="::/0"Overview
Section titled “Overview”What this does: IPv6 static routes define paths for IPv6 traffic to reach destination networks. The routing principles are identical to IPv4, but IPv6 introduces link-local addresses as gateways, requiring interface specification.
When to use this:
- Configuring default gateway for IPv6 internet access
- Routing traffic to specific IPv6 networks
- Creating blackhole routes for unwanted traffic
- Setting up policy routing with multiple routing tables
- ECMP load balancing across multiple gateways
Prerequisites:
- IPv6 enabled (default in RouterOS v7)
- At least one IPv6 address configured on an interface
- Knowledge of your ISP’s gateway address (global or link-local)
Configuration Steps
Section titled “Configuration Steps”Step 1: Add Default Route with Global Gateway
Section titled “Step 1: Add Default Route with Global Gateway”Add a default route using a global unicast gateway address.
/ipv6 route add dst-address=::/0 gateway=2001:db8::1 comment="ISP Gateway"Step 2: Verify Route is Active
Section titled “Step 2: Verify Route is Active”Check that the route is active and has a resolved gateway.
/ipv6 route print detail where dst-address="::/0"Expected output:
Flags: D - dynamic, X - disabled, A - active, c - connect, s - static 0 As dst-address=::/0 gateway=2001:db8::1 immediate-gw=2001:db8::1%ether1 distance=1 scope=30 target-scope=10The A flag indicates active, and immediate-gw shows the resolved gateway with interface.
Step 3: Test Connectivity
Section titled “Step 3: Test Connectivity”Verify IPv6 connectivity through the gateway.
/ping 2001:4860:4860::8888 count=3Expected output:
SEQ HOST SIZE TTL TIME STATUS 0 2001:4860:4860::8888 56 57 12ms 1 2001:4860:4860::8888 56 57 11ms 2 2001:4860:4860::8888 56 57 12ms sent=3 received=3 packet-loss=0%Common Scenarios
Section titled “Common Scenarios”Scenario: Link-Local Gateway
Section titled “Scenario: Link-Local Gateway”Many ISPs provide a link-local address (fe80::/10) as the gateway. You must include the interface:
# First, find ISP's link-local address/ipv6 neighbor print where interface=ether1
# Add route with interface specification/ipv6 route add dst-address=::/0 gateway=fe80::1%ether1Important: Without %interface, RouterOS returns “Invalid route” error because link-local addresses are only valid within a specific interface’s scope.
Scenario: Static Route to Remote Network
Section titled “Scenario: Static Route to Remote Network”Add a route to reach a specific IPv6 network:
/ipv6 route add dst-address=2001:db8:100::/48 gateway=2001:db8::2 distance=10Scenario: Blackhole Route
Section titled “Scenario: Blackhole Route”Silently discard traffic to unwanted networks:
/ipv6 route add dst-address=2001:db8:bad::/48 type=blackholeOther discard types:
# Return ICMPv6 prohibited/ipv6 route add dst-address=2001:db8:blocked::/48 type=prohibit
# Return ICMPv6 unreachable/ipv6 route add dst-address=2001:db8:gone::/48 type=unreachableScenario: ECMP Load Balancing
Section titled “Scenario: ECMP Load Balancing”Distribute traffic across multiple gateways:
/ipv6 route add dst-address=::/0 gateway=2001:db8::1,2001:db8::2 distance=1Traffic is distributed per-flow (same source/destination uses same path). ECMP for IPv6 hashes: source IP, destination IP, flow label, and protocol.
Scenario: Route with Preferred Source
Section titled “Scenario: Route with Preferred Source”Specify which source address to use for traffic matching this route:
/ipv6 route add dst-address=::/0 gateway=2001:db8::1 pref-src=2001:db8::100Scenario: Multiple Routing Tables (v7)
Section titled “Scenario: Multiple Routing Tables (v7)”Use policy routing with separate tables:
# Create routing table/routing table add name=upstream2 fib
# Add route to specific table/ipv6 route add dst-address=::/0 gateway=2001:db8:2::1 routing-table=upstream2Mark traffic for specific table using mangle:
/ipv6 firewall mangle add chain=prerouting src-address=2001:db8:10::/64 \ action=mark-routing new-routing-mark=upstream2Scenario: Backup Gateway with Higher Distance
Section titled “Scenario: Backup Gateway with Higher Distance”Configure failover with route distances:
# Primary gateway (distance=1, preferred)/ipv6 route add dst-address=::/0 gateway=2001:db8::1 distance=1 comment="Primary"
# Backup gateway (distance=2, used when primary fails)/ipv6 route add dst-address=::/0 gateway=2001:db8:2::1 distance=2 comment="Backup"Verification
Section titled “Verification”Check 1: View All IPv6 Routes
Section titled “Check 1: View All IPv6 Routes”/ipv6 route printExpected: List of routes with flags (A=active, D=dynamic, c=connected, s=static).
Check 2: Verify Default Route
Section titled “Check 2: Verify Default Route”/ipv6 route print where dst-address="::/0"Expected: Active default route with resolved gateway.
Check 3: Check Gateway Reachability
Section titled “Check 3: Check Gateway Reachability”/ping 2001:db8::1 count=3Expected: Replies from gateway.
Check 4: Verify Neighbor Table
Section titled “Check 4: Verify Neighbor Table”/ipv6 neighbor print where interface=ether1Expected: Gateway address appears with reachable status.
Check 5: View Unified Routing Table (v7)
Section titled “Check 5: View Unified Routing Table (v7)”/routing route print where afi=ip6Expected: All IPv6 routes with detailed attributes.
Troubleshooting
Section titled “Troubleshooting”| Symptom | Cause | Solution |
|---|---|---|
| ”Invalid route” error | Link-local gateway without interface | Add %interface: gateway=fe80::1%ether1 |
| Route shows inactive | Gateway not reachable | Verify gateway connectivity; check neighbor table |
| Route disappears after minutes | Gateway becomes unreachable | Check gateway; verify ICMPv6 not blocked |
| Route shows “filtered” (v7) | Routing filter or next-hop resolution failed | Check /routing route print detail for reason |
| ECMP uses only one gateway | Per-flow hashing expected behavior | Normal; ECMP balances flows, not packets |
| No connected route | No IPv6 address on interface | Add IPv6 address to create connected route |
| Route not preferred | Higher distance than competing route | Lower the distance value |
Common Mistakes
- Don’t forget
%interfacefor link-local gateways - Link-local addresses require interface specification - Don’t confuse
::/0with0.0.0.0/0- IPv6 default is::/0; IPv4 default is0.0.0.0/0 - Don’t expect packet-level ECMP - RouterOS uses per-flow load balancing
- Don’t block ICMPv6 on WAN - Neighbor Discovery requires ICMPv6; blocking it breaks IPv6 routing
- Don’t assume gateway is global unicast - Many ISPs use link-local addresses
Route Types Reference
Section titled “Route Types Reference”| Type | Description |
|---|---|
unicast | Standard forwarding route (default) |
blackhole | Silently discard matching packets |
prohibit | Discard and return ICMPv6 administratively prohibited |
unreachable | Discard and return ICMPv6 destination unreachable |
Route Flags Reference
Section titled “Route Flags Reference”| Flag | Meaning |
|---|---|
A | Active - route is in use |
D | Dynamic - created by protocol |
c | Connected - from IPv6 address |
s | Static - manually configured |
+ | ECMP route |
X | Disabled |
Related Topics
Section titled “Related Topics”IPv6 Configuration
Section titled “IPv6 Configuration”- IPv6 Addresses - IPv6 address configuration
- IPv6 Neighbor Discovery - SLAAC and router advertisements
- DHCPv6 Client - dynamic IPv6 address and route acquisition
Security
Section titled “Security”- IPv6 Firewall - securing IPv6 traffic
- Firewall Basics - IPv4 firewall concepts
Routing
Section titled “Routing”- Static Routes - IPv4 static routes comparison
- Routing Filters - filter routes (v7)
- Routing Tables - multiple routing tables
Reference
Section titled “Reference”Properties Reference
Section titled “Properties Reference”| Property | Type | Default | Description |
|---|---|---|---|
dst-address | IPv6 prefix | - | Destination network (e.g., ::/0, 2001:db8::/32) |
gateway | IPv6/interface | - | Next-hop address or interface |
distance | 1-255 | 1 | Administrative distance (lower = preferred) |
scope | 0-255 | 30 | Scope for next-hop lookup |
target-scope | 0-255 | 10 | Target scope for recursive lookup |
routing-table | string | main | Routing table name |
pref-src | IPv6 address | - | Preferred source address |
type | unicast/blackhole/prohibit/unreachable | unicast | Route type |
comment | string | - | Descriptive comment |
disabled | yes/no | no | Whether route is disabled |
Command Reference
Section titled “Command Reference”| Command | Description |
|---|---|
/ipv6 route add | Add static IPv6 route |
/ipv6 route print | Show IPv6 routes |
/ipv6 route print detail | Show routes with all properties |
/ipv6 route remove | Remove IPv6 route |
/ipv6 route set | Modify existing route |
/routing route print where afi=ip6 | Unified view of IPv6 routes (v7) |
/ipv6 neighbor print | Show IPv6 neighbor table |