IPv6 works differently from IPv4: there is no NAT. Every device gets an address that simply exists from the outside, and what comes in is held back by the firewall alone. That makes IPv6 easier to route and less forgiving when you forget the firewall.
Where it sits
The IPv6 section is off by default. Switch it on and the wizard asks how IPv6 arrives on WAN and whether you want the firewall; the rest lives in advanced.
Prefix delegation
Most ISPs hand you a /48 or /56 over DHCPv6. Pick DHCPv6 prefix delegation, point at the WAN interface and leave the requested prefix length at /56 unless you know you get something else. It is a hint: your ISP decides. The tool writes an /ipv6 dhcp-client with request=prefix, a pool called ipv6-pool and pool-prefix-length=64.
If you also want the router itself to get an address on WAN, switch on also request a WAN address. Many ISPs hand out address and prefix together, others deliver only the prefix and use link-local for the rest. If you have agreed a fixed prefix, choose static prefix and fill in prefix, WAN address and gateway.
Addresses on your networks
With assign addresses on LAN and VLANs, every interface gets a ::1/64 from the pool, with advertise=yes. So each network gets its own /64 out of the same delegation. A /56 gives you 256 pieces of /64, plenty for office, guests, IoT and management. If you only get a /64, there is one network to serve and you have to choose.
Clients get their address through router advertisements (SLAAC): the tool sets managed-address-configuration and other-configuration to no. No DHCPv6 server for clients is generated. With advertise router as DNS the router is announced as RDNSS in those advertisements, so clients use it for DNS as well.
The IPv6 firewall
The IPv6 firewall switch lays down MikroTik's default rules: accept established and related, drop invalid, accept ICMPv6 (not a luxury, IPv6 cannot work without it), accept DHCPv6 and IPsec, and drop everything not coming from the LAN. Next to that an address list bad_ipv6 with ranges that never need to pass your router.
Because there is no NAT, opening a port here is not a forward but an accept rule. In the extra allowed from the internet (IPv6) list you leave the address field empty for the router itself, or fill in the IPv6 address of a device inside; in that case the rule goes into the forward chain. That device does have to keep an address that does not change, and bear in mind that one rule hangs that device straight on the internet. The VLAN isolation and the matrix from the Firewall section apply to IPv6 too.
Switch IPv6 on without a firewall and the tool gives you an error. Every device on your LAN is then directly reachable from the internet.
If you choose MikroTik's literal default rules in the firewall section, the IPv6 rules are already in there and this section does not add them a second time. If you do not use IPv6 at all, the firewall section still writes the IPv6 baseline rules: a device without IPv6 rules only becomes unsafe at the moment the stack comes up after an update.
Switching IPv6 off properly
The IPv6 switched off completely choice does more than disable the stack, because that alone is not enough. The script sets disable-ipv6=yes, no forwarding, no accepting router advertisements, plus drop rules in the IPv6 firewall for input and forward. Those drop rules stay in place for the day an update turns the stack back on.
With also block IPv6 passing through the bridge and the switch chip on, bridge filter rules on mac-protocol=ipv6 are added, and rules for the switch chip: one per port on chips with switch rules, or an ingress and an egress rule on chips with an ACL table. Both sit inside a :do ... on-error in the script, so a chip that does not know them skips them and writes a line to the log instead of breaking the script. Without that option only the router stops speaking IPv6, while your devices carry on among themselves and with any modem that offers it.
What you can check
/ipv6 address printshows the address per interface. You are looking for an address starting with2or3on your LAN interfaces, not onlyfe80::./ipv6 dhcp-client printshows whether the status is bound and which prefix you were given./ipv6 route printfor the default route,/ipv6 nd printfor the advertisements./ipv6 firewall filter print statsto see that rules exist and that they count.- On a client: does it have a global address, and does
ping6get out. No address usually means the advertisements are not arriving, because the VLAN interface never got a prefix from the pool for instance.
What people run into
A delegated prefix is not forever. When it changes, your static AAAA records and your accept rules by address suddenly point nowhere. Ask your ISP whether your prefix is fixed; if it is not, use names and accept that you have to update things now and then.
Further reading: Firewall and NAT, WAN and internet and VLANs.