Manual

IPv4 works, IPv6 does not

Everything works, but the IPv6 test gives you nought out of ten. Where the chain breaks and how to see it.

Your internet works, websites load, everything is fine, and then you run an IPv6 test and it scores nothing. Or your laptop only has an fe80: address and nothing that looks like a real one. Nothing is broken, half an internet stack is simply missing.

If nothing goes out at all, this is not the chapter: see No internet after applying. If addresses work and names do not, see Names are not resolved.

The quick checks, in order

Work from the outside in: the prefix first, then the addresses, then the clients.

  1. Is the stack on? /ipv6 settings print. A good answer is disable-ipv6: no and forward: yes. If it says disable-ipv6: yes, you set IPv6 to switched off completely in the tool and the rest of this chapter does not apply.
  2. Are you getting a prefix from your ISP? /ipv6 dhcp-client print. A good answer is status: bound with a prefix like 2a02:a44f:1234::/56. If it says searching..., your ISP is delegating nothing on that interface and there is no point checking the rest.
  3. Is the prefix in the pool? /ipv6 pool print. A good answer is ipv6-pool with that same prefix behind it.
  4. Do your networks have addresses? /ipv6 address print. A good answer is one global address from the pool per LAN and per VLAN, with the G flag, next to the link-local fe80: addresses. Only fe80: means nothing was handed out from the pool.
  5. Is there a default route? /ipv6 route print. A good answer is an active ::/0.
  6. Can the router itself get out? /ping 2606:4700:4700::1111. If that works and your laptop does not, the problem sits between router and client.
  7. What does the client see? ipconfig or ip -6 addr. A good answer is an address starting with 2 or 3. If the client has an address but nothing works, check which DNS server it was given.
  8. Is something being dropped? /ipv6 firewall filter print stats. A drop rule whose counter moves while you test tells you exactly enough.

The usual causes, most common first

The IPv6 section was off

IPv6 is off by default in the configurator. The script then contains no addresses, no DHCPv6 client and no router advertisements, only the firewall (more on that below). This is by far the most common cause: you did not switch IPv6 on.

The DHCPv6 client is on the wrong interface

With PPPoE the client belongs on the PPPoE interface, so on pppoe-out1 and not on ether1. With a tagged uplink it belongs on the VLAN interface, not on the port. The tool fills in the first WAN interface with exactly those names, but if you rearranged the uplinks afterwards the old choice stays.

The requested prefix length is wrong

You ask for a /48 and your ISP hands out a /56. Some ISPs then give you the smaller one anyway, others do not answer at all. Set the hint to what you actually get.

Addresses yes, DNS no

Clients get an address through router advertisements but resolve names through a DNS server they do not have. The tool advertises the router itself as DNS (RDNSS), and that only works if the router accepts DNS requests. If Router as DNS server for the LAN is off, the tool warns you about it while generating.

The ISP delivers IPv6 later, or differently

Some lines only deliver IPv6 after a successful PPPoE session, some only on a separate VLAN, and a few not at all. Restart the DHCPv6 client once the IPv4 connection is up.

What the configurator does about it

The IPv6 section has four modes: DHCPv6 prefix delegation (the normal case), static prefix, firewall only and switched off completely.

With prefix delegation the script writes an /ipv6 dhcp-client with request=prefix, pool-name=ipv6-pool, pool-prefix-length=64 and a prefix-hint you choose yourself. Every LAN and every VLAN with an address then gets a ::1/64 out of that pool with advertise=yes, and /ipv6 nd is set with advertise-dns=self. Note that use-peer-dns=no is set: the router keeps using the upstream DNS you picked in the DNS section, for IPv6 names too. That is deliberate, but it explains why no ISP addresses appear in /ip dns.

The IPv6 firewall is always included, even when you do not use IPv6. The tool says so as well: a device with no IPv6 rules only becomes unsafe at the moment the stack comes up anyway, after an update for instance, and then everything is open. If you set IPv6 to switched off completely, the tool goes further than disabling the stack: drop rules are added, the bridge stops passing IPv6 frames, and where the model supports it IPv6 is dropped in the switch chip as well. A chip that does not know those rules skips them and writes that to the log.

Not checked: what prefix length your ISP really gives, whether it delivers IPv6 at all, and whether the prefix changes after a reconnect. There is no field for a 6in4 tunnel, no static IPv6 route in this section, and nothing is tested after you paste.

When it is not your router

The modem or ONT in front can hold IPv6 back, certainly while it is still acting as a router: see Two routers behind each other. Some ISPs only deliver IPv6 on their own equipment, and some business lines have to have it switched on by request. You recognise it by one thing: the DHCPv6 client keeps searching while everything above it is in order.

Read on: IPv6, Firewall and NAT and Provider presets.

Want to try it right away? Open the configurator