Auteur Sujet: RECAP : IPv6 avec MikroTik & Mini4K mode bridge en ZMD 10G-EPON (Lu 23083 fois)

edouard_k · « **Réponse #60 le:** 02 avril 2025 à 14:08:06 »

Bonjour,

désolé de déterrer ce vieux sujet, mais je n'y arrive pas avec l'ipv6.

J'arrive bien à avoir une délégation pour un vlan, mais dès que j'en mets une deuxième, mon ordinateur se retrouve avec 2 ipv6 (une par délégation)

J'ai l'impression qu'il me manque un truc, mais je n'arrive pas à trouver ou Si vous avez une idée, je suis preneur.
Le post sur le forum mikrotik est ici : https://forum.mikrotik.com/viewtopic.php?t=215876

Je remets ma configuration

Code: [Sélectionner]

# 2025-03-31 13:57:43 by RouterOS 7.18.2
# software id = VL6J-0M77
#
# model = RB4011iGS+
# serial number = B8F30BFFDC65
/interface bridge
add admin-mac=C4:AD:34:73:D7:A1 auto-mac=no comment=bridge-lan frame-types=admit-only-vlan-tagged igmp-snooping=yes name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment=Freebox
set [ find default-name=ether2 ] comment=tac
set [ find default-name=ether3 ] comment=Mgmt
set [ find default-name=ether4 ] comment="Local Interface 192.168.4.1/24"
set [ find default-name=ether5 ] comment=Trunk
set [ find default-name=ether6 ] comment="Trunk (qnap) 1/2"
set [ find default-name=ether7 ] comment="Trunk (qnap) 2/2"
set [ find default-name=ether8 ] comment=Lan
set [ find default-name=ether9 ] comment="Trunk (hp2915) 1/2"
set [ find default-name=ether10 ] comment="Trunk (hp2915) 2/2"
/interface vlan
add interface=sfp-sfpplus1 name=vlan-internet vlan-id=666
add interface=bridge name=vlan10-lan vlan-id=10
add interface=bridge name=vlan20-iot vlan-id=20
add interface=bridge name=vlan30-cctv vlan-id=30
add interface=bridge name=vlan40-srv vlan-id=40
add interface=bridge name=vlan50-guest vlan-id=50
add interface=bridge name=vlan99-mgmt vlan-id=99
/interface bonding
add comment=hp2915 mode=802.3ad name=hp2915 slaves=ether9,ether10 transmit-hash-policy=layer-3-and-4
add comment=qnap mode=802.3ad name=qnap slaves=ether6,ether7 transmit-hash-policy=layer-3-and-4
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
add name=MGMT
/ip pool
add name=dhcp-mgmt ranges=192.168.99.10-192.168.99.254
add name=dhcp-lan ranges=192.168.10.50-192.168.10.99
add name=dhcp-iot ranges=192.168.20.50-192.168.20.99
add name=dhcp-guest ranges=192.168.50.50-192.168.50.99
add name=dhcp-cctv ranges=192.168.30.50-192.168.30.99
add name=dhcp-srv ranges=192.168.40.50-192.168.40.99
/ip dhcp-server
add address-pool=dhcp-lan interface=vlan10-lan lease-script=lease-script lease-time=1d name=dhcp-lan
add address-pool=dhcp-iot interface=vlan20-iot lease-script=lease-script lease-time=1d name=dhcp-iot
add address-pool=dhcp-guest interface=vlan50-guest lease-script=lease-script lease-time=1d name=dhcp-guest
add address-pool=dhcp-mgmt interface=vlan99-mgmt lease-script=lease-script lease-time=1d name=dhcp-mgmt
add address-pool=dhcp-cctv interface=vlan30-cctv lease-script=lease-script lease-time=1d name=dhcp-cctv
add address-pool=dhcp-srv interface=vlan40-srv lease-script=lease-script lease-time=1d name=dhcp-srv
/ipv6 pool
add name=lan-ipv6 prefix=2a01:XXX:XX:b6b1::/64 prefix-length=64
/system logging action
add name=logserver remote=192.168.40.50 remote-log-format=syslog remote-port=10514 syslog-facility=local6 syslog-severity=emergency target=remote
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=10
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=99
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged interface=ether5 pvid=100
add bridge=bridge comment=defconf frame-types=admit-only-untagged-and-priority-tagged interface=ether8 pvid=10
add bridge=bridge comment="qnap trunk" frame-types=admit-only-untagged-and-priority-tagged interface=qnap pvid=10
add bridge=bridge comment="hp2915 trunk" frame-types=admit-only-vlan-tagged interface=hp2915 pvid=100
add bridge=bridge comment=sfp frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 pvid=100
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/ipv6 settings
set accept-router-advertisements=no
/interface bridge vlan
add bridge=bridge comment=main-vlan tagged=bridge,ether5,hp2915 untagged=ether2,ether8,qnap vlan-ids=10
add bridge=bridge comment=mgmt-vlan tagged=bridge,ether5,qnap,hp2915,sfp-sfpplus1 untagged=ether3 vlan-ids=99
add bridge=bridge comment=guest-vlan tagged=bridge,ether5,hp2915,ether2,qnap vlan-ids=50
add bridge=bridge comment=iot-vlan tagged=bridge,ether5,hp2915,qnap,ether2 vlan-ids=20
add bridge=bridge comment=cctv-vlan tagged=bridge,hp2915 vlan-ids=30
add bridge=bridge comment=srv-vlan tagged=bridge,hp2915 vlan-ids=40
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=ether4 list=LAN
add interface=vlan10-lan list=LAN
add interface=vlan10-lan list=VLAN
add interface=vlan20-iot list=VLAN
add interface=vlan50-guest list=VLAN
add interface=vlan99-mgmt list=MGMT
add interface=vlan10-lan list=MGMT
add interface=vlan99-mgmt list=VLAN
add interface=vlan30-cctv list=VLAN
add interface=vlan40-srv list=VLAN
add interface=vlan-internet list=WAN
/ip address
add address=192.168.4.1/24 interface=ether4 network=192.168.4.0
add address=192.168.10.254/24 comment=vlan10-lan interface=vlan10-lan network=192.168.10.0
add address=192.168.20.254/24 comment=vlan20-iot interface=vlan20-iot network=192.168.20.0
add address=192.168.50.254/24 comment=vlan50-guest interface=vlan50-guest network=192.168.50.0
add address=192.168.99.254/24 comment=vlan99-mgmt interface=vlan99-mgmt network=192.168.99.0
add address=192.168.30.254/24 comment=vlan30-cctv interface=vlan30-cctv network=192.168.30.0
add address=192.168.40.254/24 comment=vlan40-srv interface=vlan40-srv network=192.168.40.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=10m
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no use-peer-ntp=no
add disabled=yes interface=vlan-internet use-peer-dns=no
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=10.0.10.254 gateway=10.0.10.254 netmask=24
add address=192.168.10.0/24 dns-server=192.168.10.200,192.168.10.201 domain=mk.lan gateway=192.168.10.254 netmask=24
add address=192.168.20.0/24 dns-server=192.168.10.200,192.168.10.201 domain=iot.mk.lan gateway=192.168.20.254 netmask=24
add address=192.168.30.0/24 dns-server=192.168.10.200,192.168.10.201 domain=cctv.mk.lan gateway=192.168.30.254 netmask=24
add address=192.168.40.0/24 dns-server=192.168.10.200,192.168.10.201 domain=srv.mk.lan gateway=192.168.40.254 netmask=24
add address=192.168.50.0/24 dns-server=8.8.8.8,9.9.9.9 domain=guest.mk.lan gateway=192.168.50.254 netmask=24
add address=192.168.99.0/24 dns-server=192.168.99.254 domain=mgmt.mk.lan gateway=192.168.99.254 netmask=24
/ip dns
set allow-remote-requests=yes cache-size=81920KiB doh-max-concurrent-queries=100 doh-max-server-connections=10 doh-timeout=6s mdns-repeat-ifaces=vlan10-lan,vlan20-iot servers=9.9.9.9,149.112.112.112
/ip dns static
add address=192.168.10.1 comment="redirect for local plex" regexp=*.plex.direct type=A
/ip firewall address-list
add address=192.168.20.74 list=SonosDevices
add address=192.168.20.75 list=SonosDevices
add address=192.168.99.10 comment="Proxmox servers" list=pve
add address=192.168.10.200 list=dns
add address=192.168.10.201 list=dns
add address=192.168.40.50 list=dns
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="allow wireguard" dst-port=13231 protocol=udp
add action=accept chain=input comment="Allow main-vlan/MGMT access to all router services" in-interface-list=MGMT
add action=accept chain=input comment="Allow VLAN DHCP" dst-port=67 in-interface-list=VLAN protocol=udp
add action=accept chain=input comment="Allow VLAN DNS UDP" dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=input comment="Allow VLAN DNS TCP" dst-port=53 in-interface-list=VLAN protocol=tcp
add action=accept chain=input comment="Allow VLAN ICMP Ping" in-interface-list=VLAN protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="Drop all other traffic" log-prefix=FW
add action=drop chain=forward comment="Block Internet access" log=yes out-interface=ether1 src-address-list=no-internet
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="VLAN Internet Access Only" connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="VLAN Allow LAN to MGMT" connection-state=new in-interface=vlan10-lan out-interface=vlan99-mgmt
add action=accept chain=forward comment="VLAN Allow LAN to IOT" connection-state=new in-interface=vlan10-lan out-interface=vlan20-iot
add action=accept chain=forward comment="VLAN Allow LAN to Guest" connection-state=new in-interface=vlan10-lan out-interface=vlan50-guest
add action=accept chain=forward comment="VLAN Allow LAN to SRV" connection-state=new in-interface=vlan10-lan out-interface=vlan40-srv
add action=accept chain=forward comment="VLAN Allow LAN to CCTV" connection-state=new in-interface=vlan10-lan out-interface=vlan30-cctv
add action=accept chain=forward comment="Allow VLANS to DNS udp" dst-address-list=dns dst-port=53 in-interface-list=VLAN protocol=udp
add action=accept chain=forward comment="Allow VLANS to DNS TCP" dst-address-list=dns dst-port=53 in-interface-list=VLAN protocol=tcp
add action=accept chain=forward comment="Allow Port Forwarding - DSTNAT - enable if need server" connection-nat-state=dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop all other traffic"
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=redirect chain=dstnat comment=internetprotection disabled=yes dst-port=53 protocol=udp to-ports=53
add action=redirect chain=dstnat comment=internetprotection disabled=yes dst-port=53 protocol=tcp to-ports=53
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masquerade Allow V-IOT (needed for HA - xiaomi_miio)" ipsec-policy=out,none out-interface=vlan20-iot
/ipv6 route
add disabled=no distance=1 dst-address=::/0 gateway=fe80::3a07:16ff:fe0b:d9d%ether1 routing-table=main scope=30 target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.0.0/16
set ssh address=192.168.0.0/16
set www-ssl certificate=webfig
set api address=192.168.0.0/16
set winbox address=192.168.0.0/16
set api-ssl disabled=yes
/ip traffic-flow
set enabled=yes interfaces=ether1,bridge
/ip traffic-flow target
add dst-address=162.159.65.1 version=5
add dst-address=192.168.40.50 version=ipfix
/ipv6 address
add address=2a01:XXX:XX:b6b1::254 interface=vlan10-lan
add address=2a01:XXX:XX:b6b2::254 interface=vlan20-iot
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=drop chain=input comment="crowdsec input drop rules" in-interface=ether1 src-address-list=crowdsec
add action=drop chain=forward comment="crowdsec forward drop rules" in-interface=ether1 src-address-list=crowdsec
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/ipv6 nd
set [ find default=yes ] advertise-dns=no hop-limit=64 interface=vlan10-lan managed-address-configuration=yes ra-interval=20s-1m
add advertise-dns=no hop-limit=64 interface=vlan20-iot ra-interval=20s-1m
/ipv6 nd prefix default
set preferred-lifetime=30m valid-lifetime=12h
/routing igmp-proxy interface
add interface=vlan10-lan upstream=yes
add interface=vlan20-iot

FiberDude · « **Réponse #61 le:** 04 avril 2025 à 21:30:11 »

Hello edouard_k,

Ne soit pas désolé: le forum est là pour ça

=> Je viens de consulter ton lien vers le forum MKT que je n'ai pas pu voir hier soir lorsque j'ai rédigé ma réponse (site down) mais je vois qu'on te suggère la même chose sans succès apparemment: bon je poste quand même ma réponse même si, à priori, l'intuition que j'ai eu ne semble pas la bonne...

Concernant ton pb, j'ai parcouru vite fait ta conf, et j'avoue ne pas avoir fait mumuse avec le vlan tagging et les trunks et je ne suis donc pas le plus averti sur ce sujet.
Si je compare avec ma conf où j'utilise plusieurs préfixes que Free m'a attribué c-à-d un pour la partie "Trusted", un pour la partie "Guest" (IOT, etc...) et d'autres pour du wireguard, je remarque que comme toi j'ai:

attribué une IP statique à chaque bridge (Trusted & Guest) et chaque interface Wireguard portant ces domaines
ajouté une conf "ND" (= Neighbor Discovery) pour chaque interface portant un préfixe IPv6

En effet, je pense que cette partie ND correspond aux "router advertissments" (= RA) qu'utilisent les interfaces IPv6 pour s'attribuer une adresse sur le préfixe correspondant.

NOTE: chez moi, interfaces & réseaux wifi sont rattachés directement au bridge correspondant (Trusted/Guest) alors que pour la partie Wireguard c'est directement les interfaces qui portent le préfixe IPv6 (conf peut être à revoir/optimiser).

Voici ma conf:
(NOTE: eth1 est mon interface WAN connectée à la Freebox en mode bridge)

L'attribution d'adresses:

Code: [Sélectionner]

/ipv6/address/export
# 2025-04-04 20:53:19 by RouterOS 7.18.2
# software id = 44MB-GI12
#
# model = C52iG-5HaxD2HaxD
# serial number = XXXXXXXXXX
/ipv6 address
add address=2a01:XXX0::2 interface=ether1
add address=2a01:XXX1::1 interface="Trusted bridge"
add address=2a01:XXX2::1 interface="Guest bridge"
add address=2a01:XXX3::1 interface=Wireguard_XXX
add address=2a01:XXX4::1 interface=Wireguard_YYY
add address=2a01:XXX5::1 interface=Wireguard_ZZZ

La partie "ND":

Code: [Sélectionner]

/ipv6/nd/export
# 2025-04-04 20:33:49 by RouterOS 7.18.2
# software id = 44MB-GI12
#
# model = C52iG-5HaxD2HaxD
# serial number = XXXXXXXXXX
/ipv6 nd
set [ find default=yes ] disabled=yes
add advertise-dns=no interface=ether1 managed-address-configuration=yes
add dns=2a01:XXX::1 interface="Guest bridge" managed-address-configuration=yes \
    other-configuration=yes
add dns=2a01:XXX::1 interface="Trusted bridge" managed-address-configuration=yes \
    other-configuration=yes
add dns=2a01:XXX::1 interface=Wireguard_XXX managed-address-configuration=yes \
    other-configuration=yes
add dns=2a01:XXX::1 interface=Wireguard_YYY managed-address-configuration=yes \
    other-configuration=yes
add dns=2a01:XXX::1 interface=Wireguard_ZZZ managed-address-configuration=yes \
    other-configuration=yes

Et voici les entrées dynamiques que j'ai dans la partie "prefixes" du "ND":

Code: [Sélectionner]

/ipv6/nd/prefix/print
Flags: X - disabled, I - invalid; D - dynamic
 0  D prefix=2a01:XXX1::/64 6to4-interface=none interface=Trusted bridge on-link=yes
      autonomous=yes valid-lifetime=4w2d preferred-lifetime=1w
 1  D prefix=2a01:XXX2::/64 6to4-interface=none interface=Guest bridge on-link=yes
      autonomous=yes valid-lifetime=4w2d preferred-lifetime=1w
 2  D prefix=2a01:XXX0::/64 6to4-interface=none interface=ether1 on-link=yes autonomous=yes
      valid-lifetime=4w2d preferred-lifetime=1w
 3  D prefix=2a01:XXX3::/64 6to4-interface=none interface=Wireguard_XXX on-link=yes
      autonomous=yes valid-lifetime=4w2d preferred-lifetime=1w
 4  D prefix=2a01:XXX4::/64 6to4-interface=none interface=Wireguard_YYY on-link=yes
      autonomous=yes valid-lifetime=4w2d preferred-lifetime=1w
 5  D prefix=2a01:XXX5::/64 6to4-interface=none interface=Wireguard_ZZZ on-link=yes
      autonomous=yes valid-lifetime=4w2d preferred-lifetime=1w

Ceci dit je suis pas le seul à avoir eu cette intuition sur la conf ND: essaie de creuser dans cette direction..
Peut être que la partie VLAN/Trunk ne tagge pas les RA et du coup ils ne seraient pas poussés vers tes hosts ?
(= capture réseau coté hosts pour voir si tu vois bien des RA arriver pour confirmer/infirmer cela)

+ Même chose sur la remarque concernant l'usage du ":254" dans ta conf

... Je vais peut être faire pareil au lieu de mes ":1" trop prévisibles !

edouard_k · « **Réponse #62 le:** 07 avril 2025 à 09:01:05 »

Bonjour,

j'ai trouvé mon problème et il n'était pas où je le pensais.

Ma configuration Mikrotik est bonne et fonctionnelle. (On peut sûrement l'améliorer, changer le ::254, mais pas bloquante pour le fonctionnement d'une stack ipv6)

Mon problème venait de mes bornes Wifi Grandstream (GWN7660).

Afin de segmenter mon réseau, j'utilise des vlans, et pour le côté wifi, je suis tombé il y a quelques mois sur la notion de PPSK (Private Pre-Shared Key).

En ipv4, ça marche bien et je n'ai jamais eu de problème. Par contre, et je pense que c'est un bug que je vais remonter au constructeur, en IPv6, je me retrouve à avoir des fuites d'IP entre les vlans.

Je suis repassé en 1 vlan = 1 réseau wifi, et là, plus aucun problème.

Merci beaucoup pour votre aide

Auteur Sujet: RECAP : IPv6 avec MikroTik & Mini4K mode bridge en ZMD 10G-EPON (Lu 23083 fois)

edouard_k

RECAP : IPv6 avec MikroTik & Mini4K mode bridge en ZMD 10G-EPON

FiberDude

RECAP : IPv6 avec MikroTik & Mini4K mode bridge en ZMD 10G-EPON

edouard_k

RECAP : IPv6 avec MikroTik & Mini4K mode bridge en ZMD 10G-EPON