Dobry den,
technicka podpora na UVT pokulhava a uz nejakych par mesicu se snazim nastavit
IPv6 na MikroTik Routeru hEX S | RB760iGS co mam pripojeny k Terminatoru od UVT.
Psal, jsem tam, volal, ale nikdo u nich neni schopny poradit jak to nastavit.
Odkazuji mne na stranky MikroTiku .....
https://wiki.mikrotik.com/wiki/Manual:IPv6/DHCP_ClientTady je postup co jsem nastavil.
#1
!interface=pppoe-out
!pool-prefix-length=64
/ipv6 dhcp-client add add-default-route=yes request=prefix pool-name="ipv6" pool-prefix-length=64 interface=pppoe-out
Dostal jsem 2a03:c20:803:xxxx::/56 site prefix/subnet ID/56 ktery mi UVT pridelili.
#2
!interface=bridge
!from-pool="ipv6"
/ipv6 address add address=::1 from-pool="ipv6" interface=bridge eui-64=no advertise=yes
Ted se u vsech PC pripojenych k routeru hEX S | RB760iGS nabehli IPv6 adresy 2a03:c20:803:xxxx::/64
#3
Vygeneroval jsem si ULA z teto stranky
https://www.ultratools.com/tools/rangeGeneratorGlobal ID: 2a03c20803
Subnet ID: xxxx
/ipv6 address add address=fdxx:xxxx:xxx:xxx::/64 interface=bridge eui-64=no advertise=yes
Vsechny PC pripojene k routeru hEX S | RB760iGS dostaly lokalni IPv6 fdxx ....
#4
/ipv6 route add dst-address=::/0 gateway=pppoe-out
ping6 na IPv6 adresu funguje na zarizenich, ktere jsou k routeru pripojene (RaspberyPi/Windows 10),
ale WWW weby ktere jsou na IPv6 ne (Windwows 10). test-ipv6.cz tu IPv6 adresu nezobrazuje (0/10) score.
SSH z RaspberryPi ven funguje vsude pres IPv6, ale dovnitr na tu samou adresu se nedostanu
Na router se pres IPv6 pripojem pres SSH,WinBox bez problemu.
#5 - Jeste sem prikladam firewall nastaveni, jestli nahodou neni chyba tam:
/ipv6 firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related log=no log-prefix=""
1 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid
2 ;;; defconf: accept ICMPv6
chain=input action=accept protocol=icmpv6
3 ;;; defconf: accept UDP traceroute
chain=input action=accept protocol=udp port=33434-33534
4 ;;; defconf: accept DHCPv6-Client prefix delegation.
chain=input action=accept protocol=udp src-address=fe80::/10 dst-port=546
5 ;;; defconf: accept IKE
chain=input action=accept protocol=udp dst-port=500,4500
6 ;;; defconf: accept ipsec AH
chain=input action=accept protocol=ipsec-ah
7 ;;; defconf: accept ipsec ESP
chain=input action=accept protocol=ipsec-esp
8 ;;; allow SSH
chain=input action=accept protocol=tcp src-address-list=allow-to-router dst-port=22 log=yes log-prefix=""
9 ;;; allow WinBOX
chain=input action=accept protocol=tcp src-address-list=allow-to-router dst-port=8291 log=yes log-prefix=""
10 ;;; defconf: accept all that matches ipsec policy
chain=input action=accept ipsec-policy=in,ipsec
11 ;;; defconf: drop everything else not coming from LAN
chain=input action=drop in-interface-list=!LAN
12 ;;; defconf: accept established,related,untracked
chain=forward action=accept connection-state=established,related log=no log-prefix=""
13 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid
14 ;;; defconf: drop packets with bad src ipv6
chain=forward action=drop src-address-list=bad_ipv6
15 ;;; defconf: drop packets with bad dst ipv6
chain=forward action=drop dst-address-list=bad_ipv6
16 ;;; defconf: rfc4890 drop hop-limit=1
chain=forward action=drop protocol=icmpv6 hop-limit=equal:1
17 ;;; defconf: accept ICMPv6
chain=forward action=accept protocol=icmpv6
18 ;;; defconf: accept HIP
chain=forward action=accept protocol=139
19 ;;; defconf: accept IKE
chain=forward action=accept protocol=udp dst-port=500,4500
20 ;;; defconf: accept ipsec AH
chain=forward action=accept protocol=ipsec-ah
21 ;;; defconf: accept ipsec ESP
chain=forward action=accept protocol=ipsec-esp
22 ;;; defconf: accept all that matches ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
23 ;;; allow SSH
chain=forward action=accept protocol=tcp dst-address=2a03:c20:803:xxxx:xxxx:xxxx:xxxx:afc/128 src-address-list=allow-to-router dst-port=22 log=yes log-prefix=""
24 ;;; allow SSH
chain=forward action=accept protocol=tcp dst-address=2a03:c20:803:xxxx:xxxx:xxxx:xxxx:c3f8/128 src-address-list=allow-to-router dst-port=22 log=yes log-prefix=""
25 ;;; defconf: drop everything else not coming from LAN
chain=forward action=drop in-interface-list=!LAN
Vidi tady nekdo nekde nejkou chybu?
9 Odpovědí
3348 Zhlédnutí