diff --git a/mikrotik-tool/494-v6-apply.rsc b/mikrotik-tool/494-v6-apply.rsc
index 755ac83..da44f2f 100644
--- a/mikrotik-tool/494-v6-apply.rsc
+++ b/mikrotik-tool/494-v6-apply.rsc
@@ -20,23 +20,25 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 /routing ospf interface-template remove [find area=backbone-v3]
 /routing ospf area remove [find name=backbone-v3]
 /routing ospf instance remove [find name=default-v3]
 
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — BGP instance
 # -----------------------------------------------------------------------------
+/routing bgp template set [find name=default] disabled=no
+
 /routing bgp instance
 add name=bgp-instance-1 as=393837 router-id=10.254.254.111
 
@@ -48,7 +50,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.111
 /ipv6 address
 add address=2606:1c80:0:10::111/128 interface=lo               advertise=no  comment="loopback"
 add address=2606:1c80:0:17::2/64    interface=ether2-climax    advertise=no  comment="P2P 494<->climax"
-add address=2606:1c80:1A00::1/64    interface=mgmt             advertise=yes comment="494 mgmt LAN"
+add address=2606:1c80:1A00::1/64    interface=management             advertise=yes comment="494 mgmt LAN"
 
 # -----------------------------------------------------------------------------
 # APPLY — static routes
@@ -63,13 +65,13 @@ add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggr
 # APPLY — neighbour discovery on the mgmt LAN
 # -----------------------------------------------------------------------------
 /ipv6 nd
-add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
+add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
 
 /ipv6 nd prefix
-add interface=mgmt prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
+add interface=management prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes
 
 /ipv6 dhcp-server
-add interface=mgmt name=494-mgmt-stateless address-pool=static-only
+add interface=management name=494-mgmt-stateless address-pool=static-only
 
 /ipv6 dhcp-server option
 add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
@@ -81,7 +83,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56
 
 /ppp profile
-set [find name=pppoe] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
+set [find name=494] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1
 
 # -----------------------------------------------------------------------------
 # APPLY — firewall
diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc
index e8b484a..04acf64 100644
--- a/mikrotik-tool/494.rsc
+++ b/mikrotik-tool/494.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:11 by RouterOS 7.21.4
 # software id = K4QG-8NQV
 #
 # model = RB5009UG+S+
@@ -217,11 +217,16 @@ add add-arp=yes address-pool=mgmt interface=management lease-script="{\
     \n" lease-time=1h name=dhcp2
 /ip smb users
 set [ find default=yes ] disabled=yes
+/ipv6 dhcp-server option
+add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+/ipv6 pool
+add name=494-cust-pd-1 prefix=2606:1c80:1a01::/48 prefix-length=56
 /ppp profile
 set *0 dns-server=204.110.191.240,204.110.191.250 local-address=\
     204.110.188.94 remote-address=public use-upnp=no
-add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
-    local-address=100.64.175.254 name=494 on-down="{\
+add change-tcp-mss=yes dhcpv6-pd-pool=494-cust-pd-1 dns-server=\
+    204.110.191.240,204.110.191.20 local-address=100.64.175.254 name=494 \
+    on-down="{\
     \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
     uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
     7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@@ -329,7 +334,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
     \n  }\
     \n} while ( \$attempts < \$max )\
     \n}\
-    \n" remote-address=cgnat use-upnp=no
+    \n" remote-address=cgnat remote-ipv6-prefix-pool=494-cust-pd-1 use-upnp=\
+    no
 /queue type
 add kind=fq-codel name=fq-codel
 /queue interface
@@ -342,6 +348,9 @@ set ether6 queue=fq-codel
 set ether7 queue=fq-codel
 set ether8 queue=fq-codel
 set sfp-sfpplus1 queue=fq-codel
+/routing bgp instance
+add as=393837 name=bgp-instance-1 router-id=10.254.254.111
+add as=393837 name=bgp-instance-1 router-id=10.254.254.111
 /routing id
 add disabled=no id=10.254.254.111 name=id-1 select-dynamic-id=any \
     select-from-vrf=main
@@ -369,14 +378,20 @@ add bridge=management interface=vlan10_ether7 internal-path-cost=10 \
 add bridge=management interface=vlan10_ether8 internal-path-cost=10 \
     path-cost=10
 /ip firewall connection tracking
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
     tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
     tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
     tcp-time-wait-timeout=2m udp-stream-timeout=2m
 /ip neighbor discovery-settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set discover-interface-list=!dynamic
 /ip settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set tcp-syncookies=yes
+/ipv6 settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
+set accept-router-advertisements=no
 /interface pppoe-server server
 add default-profile=494 disabled=no interface=494 max-mru=1492 max-mtu=1492 \
     one-session-per-host=yes service-name=494
@@ -429,6 +444,15 @@ set port=43133
 add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
     10.250.1.70%ether2-climax pref-src="" routing-table=main scope=30 \
     target-scope=10
+/ipv6 route
+add comment="default via climax" distance=1 dst-address=::/0 gateway=\
+    2606:1c80:0:17::1
+add comment="core loopback (iBGP bootstrap, via climax)" distance=1 \
+    dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1
+add comment="edge loopback (via climax)" distance=1 dst-address=\
+    2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1
+add blackhole comment="494 /44 aggregate (iBGP origin)" distance=200 \
+    dst-address=2606:1c80:1a00::/44
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@@ -440,8 +464,38 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
 set api-ssl address=0.0.0.0/0 certificate=myCa
 /ip ssh
 set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
+/ipv6 address
+add address=2606:1c80:0:10::111/128 advertise=no comment=loopback interface=\
+    lo
+add address=2606:1c80:0:17::2 advertise=no comment="P2P 494<->climax" \
+    interface=ether2-climax
+add address=2606:1c80:1a00::1 comment="494 mgmt LAN" interface=management
+/ipv6 dhcp-server
+add interface=management name=494-mgmt-stateless
+/ipv6 firewall filter
+add action=accept chain=input comment=established connection-state=\
+    established,related
+add action=drop chain=input comment=invalid connection-state=invalid
+add action=accept chain=input comment=icmpv6 protocol=icmpv6
+add action=accept chain=input comment=link-local src-address=fe80::/10
+add action=accept chain=input comment=internal src-address=2606:1c80::/32
+add action=drop chain=input comment="default deny"
+add action=accept chain=forward comment=established connection-state=\
+    established,related
+add action=drop chain=forward comment=invalid connection-state=invalid
+add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
+    icmpv6
+add action=accept chain=forward comment=icmpv6 protocol=icmpv6
+add action=accept chain=forward comment=internal-to-internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment="v6 outbound from 494 customers" \
+    src-address=2606:1c80:1a00::/44
+add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
+add advertise-dns=yes interface=management other-configuration=yes
+/ipv6 nd prefix
+add interface=management prefix=2606:1c80:1a00::/64
 /mpls interface
 add interface=ether2-climax mpls-mtu=1508
 /mpls ldp
@@ -462,10 +516,22 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
 /routing bfd configuration
 add disabled=no interfaces=ether2-climax min-rx=200ms min-tx=200ms \
     multiplier=5 vrf=main
+/routing bgp connection
+add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
+    bgp-instance-1 local.address=2606:1c80:0:10::111 .role=ibgp multihop=yes \
+    name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
+    v6-ibgp-out .redistribute=connected,static remote.address=\
+    2606:1c80:0:10::253 .as=393837 templates=default
 /routing filter rule
 add chain=ospf-in disabled=no rule="accept;\r\
     \n"
 add chain=ospf-out disabled=no rule="accept;"
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
+    606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
+    ept; } else { reject; }"
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
+    606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
+    ept; } else { reject; }"
 /routing ospf interface-template
 add area=ospf-area-1 auth=sha512 auth-id=1 disabled=no interfaces=\
     ether2-climax type=ptp use-bfd=no
diff --git a/mikrotik-tool/982-v6-apply.rsc b/mikrotik-tool/982-v6-apply.rsc
index 8e226a1..70f2472 100644
--- a/mikrotik-tool/982-v6-apply.rsc
+++ b/mikrotik-tool/982-v6-apply.rsc
@@ -20,23 +20,25 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 /routing ospf interface-template remove [find area=backbone-v3]
 /routing ospf area remove [find name=backbone-v3]
 /routing ospf instance remove [find name=default-v3]
 
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — BGP instance
 # -----------------------------------------------------------------------------
+/routing bgp template set [find name=default] disabled=no
+
 /routing bgp instance
 add name=bgp-instance-1 as=393837 router-id=10.254.254.110
 
@@ -81,7 +83,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
 
 /ppp profile
-set [find name=pppoe] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
+set [find name=982] remote-ipv6-prefix-pool=982-cust-pd-1 dhcpv6-pd-pool=982-cust-pd-1
 
 # -----------------------------------------------------------------------------
 # APPLY — firewall
diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc
index 186cbe7..c0f1626 100644
--- a/mikrotik-tool/982.rsc
+++ b/mikrotik-tool/982.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:11 by RouterOS 7.21.4
 # software id = FUVS-HCM5
 #
 # model = CCR1009-7G-1C-1S+
@@ -120,8 +120,13 @@ add address-pool=mgmt interface=mgmt lease-script="{\
     \n" lease-time=10m name=mgmt
 /ip smb users
 set [ find default=yes ] disabled=yes
+/ipv6 dhcp-server option
+add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+/ipv6 pool
+add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
 /ppp profile
-add local-address=100.64.63.253 name=982 on-down="{\
+add dhcpv6-pd-pool=982-cust-pd-1 local-address=100.64.63.253 name=982 \
+    on-down="{\
     \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
     uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
     7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@@ -229,7 +234,7 @@ add local-address=100.64.63.253 name=982 on-down="{\
     \n  }\
     \n} while ( \$attempts < \$max )\
     \n}\
-    \n" remote-address=cgnat
+    \n" remote-address=cgnat remote-ipv6-prefix-pool=982-cust-pd-1
 /queue type
 add kind=fq-codel name=fq-codel
 /queue interface
@@ -242,6 +247,8 @@ set ether5 queue=fq-codel
 set ether6 queue=fq-codel
 set ether7-380 queue=fq-codel
 set sfp-sfpplus1 queue=fq-codel
+/routing bgp instance
+add as=393837 name=bgp-instance-1 router-id=10.254.254.110
 /routing bgp template
 set default disabled=no
 /routing id
@@ -249,10 +256,8 @@ add disabled=no id=10.254.254.110 name=id-1 select-dynamic-id=""
 /routing ospf instance
 add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
     ospf-out redistribute=connected router-id=id-1
-add disabled=no name=default-v3 router-id=id-1 version=3
 /routing ospf area
 add disabled=no instance=default-v2 name=backbone-v2
-add disabled=no instance=default-v3 name=backbone-v3
 /snmp community
 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
     kdyyJrT0Mm
@@ -285,12 +290,17 @@ add bridge=mgmt ingress-filtering=no interface=vlan10_ether6 \
     internal-path-cost=10 path-cost=10
 add bridge=982 interface=combo1
 /ip firewall connection tracking
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
     tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
     tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
     tcp-time-wait-timeout=2m udp-stream-timeout=2m
 /ip settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set tcp-syncookies=yes
+/ipv6 settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
+set accept-router-advertisements=no
 /interface pppoe-server server
 add authentication=mschap2 default-profile=982 disabled=no interface=982 \
     one-session-per-host=yes service-name=982
@@ -376,6 +386,15 @@ set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
 set port=48348
 /ip route
 add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.38
+/ipv6 route
+add comment="default via core" distance=1 dst-address=::/0 gateway=\
+    2606:1c80:0:14::1
+add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
+    2606:1c80:0:10::253/128 gateway=2606:1c80:0:14::1
+add comment="edge loopback via core" distance=1 dst-address=\
+    2606:1c80:0:10::254/128 gateway=2606:1c80:0:14::1
+add blackhole comment="982 /44 aggregate (iBGP origin)" distance=200 \
+    dst-address=2606:1c80:1300::/44
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@@ -387,8 +406,38 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
 set api-ssl certificate=ca-template
 /ip ssh
 set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
+/ipv6 address
+add address=2606:1c80:0:10::110/128 advertise=no comment=loopback interface=\
+    lo
+add address=2606:1c80:0:14::2 advertise=no comment="P2P 982<->core (60GHz)" \
+    interface=ether7-380
+add address=2606:1c80:1300::1 comment="982 mgmt LAN" interface=mgmt
+/ipv6 dhcp-server
+add interface=mgmt name=982-mgmt-stateless
+/ipv6 firewall filter
+add action=accept chain=input comment=established connection-state=\
+    established,related
+add action=drop chain=input comment=invalid connection-state=invalid
+add action=accept chain=input comment=icmpv6 protocol=icmpv6
+add action=accept chain=input comment=link-local src-address=fe80::/10
+add action=accept chain=input comment=internal src-address=2606:1c80::/32
+add action=drop chain=input comment="default deny"
+add action=accept chain=forward comment=established connection-state=\
+    established,related
+add action=drop chain=forward comment=invalid connection-state=invalid
+add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
+    icmpv6
+add action=accept chain=forward comment=icmpv6 protocol=icmpv6
+add action=accept chain=forward comment=internal-to-internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment="v6 outbound from 982 customers" \
+    src-address=2606:1c80:1300::/44
+add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
+add advertise-dns=yes interface=mgmt other-configuration=yes
+/ipv6 nd prefix
+add interface=mgmt prefix=2606:1c80:1300::/64
 /mpls interface
 add interface=ether7-380 mpls-mtu=1508
 /mpls ldp
@@ -408,14 +457,22 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
     300ms
 /routing bfd configuration
 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
+/routing bgp connection
+add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
+    bgp-instance-1 local.address=2606:1c80:0:10::110 .role=ibgp multihop=yes \
+    name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
+    v6-ibgp-out .redistribute=connected,static remote.address=\
+    2606:1c80:0:10::253 .as=393837 templates=default
 /routing filter rule
 add chain=ospf-in disabled=no rule="accept;"
 add chain=ospf-out disabled=no rule="accept;"
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1300::/44 || dst==2\
+    606:1c80:0:10::110/128 || (dst-len==64 && dst==2606:1c80:0:14::/64)) { acc\
+    ept; } else { reject; }"
 /routing ospf interface-template
 add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether7-380 \
     networks=10.250.1.32/29 priority=1 type=ptp use-bfd=no
 add area=backbone-v2 disabled=no passive
-add area=backbone-v3 disabled=no passive
 /snmp
 set contact=graham@vntx.net enabled=yes location="33.148902, -96.495811"
 /system clock
diff --git a/mikrotik-tool/climax-v6-apply.rsc b/mikrotik-tool/climax-v6-apply.rsc
index 1ffa4cf..5aa0db9 100644
--- a/mikrotik-tool/climax-v6-apply.rsc
+++ b/mikrotik-tool/climax-v6-apply.rsc
@@ -27,13 +27,13 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 # OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
 # (currently lives under area=backbone-v3) all get removed.
@@ -42,7 +42,7 @@
 /routing ospf instance remove [find name=default-v3]
 
 # Drop any stale internal v6 iBGP peers (none present, but defensive).
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — BGP instance (climax has none today)
@@ -75,6 +75,16 @@ add dst-address=::/0                    gateway=2606:1c80:0:12::1 distance=1 com
 # entry helps iBGP control plane converge quickly on first bring-up).
 add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
 
+# 494 sits one hop further out via the climax<->494 P2P; climax is the
+# only neighbour that can deliver to its loopback. Without this, return
+# traffic for 494's /128 from core/edge loops at climax.
+add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2 distance=1 comment="494 loopback via P2P"
+
+# verona's loopback is reachable through verona's own P2P side. Adding
+# this static beats the BGP-learned next-hop during convergence and
+# avoids the stale-next-hop loop we hit on 2026-05-09.
+add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 distance=1 comment="verona loopback via P2P"
+
 # Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
 add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
 
diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc
index dea138b..2c71419 100644
--- a/mikrotik-tool/climax.rsc
+++ b/mikrotik-tool/climax.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:10 by RouterOS 7.21.4
 # software id = UETF-WF31
 #
 # model = CCR2004-16G-2S+
@@ -405,6 +405,8 @@ add comment="core loopback via core P2P" dst-address=2606:1c80:0:10::253/128 \
     gateway=2606:1c80:0:12::1
 add comment="verona loopback (bootstrap, beats stale BGP)" distance=1 \
     dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1
+add comment="494 loopback via P2P" distance=1 dst-address=\
+    2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
diff --git a/mikrotik-tool/core-v6-apply.rsc b/mikrotik-tool/core-v6-apply.rsc
index e0d7764..c5709ce 100644
--- a/mikrotik-tool/core-v6-apply.rsc
+++ b/mikrotik-tool/core-v6-apply.rsc
@@ -34,13 +34,13 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 /routing ospf interface-template remove [find area=backbone-v3]
 /routing ospf area remove [find name=backbone-v3]
@@ -91,6 +91,21 @@ add dst-address=::/0                  gateway=2606:1c80:0:11::1   distance=2 com
 add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
 add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1   distance=2 comment="edge loopback via direct"
 
+# Per-tower /128 bootstrap statics. Every iBGP RR client needs core to be
+# able to reach its loopback BEFORE the iBGP session is up — chicken/egg
+# otherwise. distance=1 wins until BGP comes up; once it does, the session
+# itself reflects the same /128 with the same forwarding outcome, so these
+# statics stay harmlessly more-specific. Towers reached *through* climax
+# (494) or *through* newhope (lowry) take the long way; directly-attached
+# towers (982, culleoka, newhope) use the matching P2P.
+add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:12::2 distance=1 comment="verona loopback (via climax)"
+add dst-address=2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2 distance=1 comment="climax loopback"
+add dst-address=2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2 distance=1 comment="culleoka loopback"
+add dst-address=2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2 distance=1 comment="newhope loopback"
+add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2 distance=1 comment="lowry loopback (via newhope)"
+add dst-address=2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2 distance=1 comment="982 loopback"
+add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2 distance=1 comment="494 loopback (via climax)"
+
 # Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
 add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
 
diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc
index 9d47dcf..fe1289f 100644
--- a/mikrotik-tool/core.rsc
+++ b/mikrotik-tool/core.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:11 by RouterOS 7.21.4
 # software id = XS5B-41QR
 #
 # model = CCR1009-7G-1C-1S+
@@ -488,6 +488,16 @@ add comment="verona loopback via climax" dst-address=2606:1c80:0:10::101/128 \
     gateway=2606:1c80:0:12::2
 add comment="climax loopback via climax P2P" dst-address=\
     2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2
+add comment="494 loopback (iBGP bootstrap, via climax)" distance=1 \
+    dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2
+add comment="982 loopback (iBGP bootstrap)" distance=1 dst-address=\
+    2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2
+add comment="culleoka loopback (iBGP bootstrap)" distance=1 dst-address=\
+    2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2
+add comment="newhope loopback (iBGP bootstrap)" distance=1 dst-address=\
+    2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2
+add comment="lowry loopback (via newhope)" distance=1 dst-address=\
+    2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2
 /ip service
 set ftp disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
diff --git a/mikrotik-tool/culleoka-v6-apply.rsc b/mikrotik-tool/culleoka-v6-apply.rsc
index 3199dd6..387efb3 100644
--- a/mikrotik-tool/culleoka-v6-apply.rsc
+++ b/mikrotik-tool/culleoka-v6-apply.rsc
@@ -27,23 +27,25 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 /routing ospf interface-template remove [find area=backbone-v3]
 /routing ospf area remove [find name=backbone-v3]
 /routing ospf instance remove [find name=default-v3]
 
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — BGP instance
 # -----------------------------------------------------------------------------
+/routing bgp template set [find name=default] disabled=no
+
 /routing bgp instance
 add name=bgp-instance-1 as=393837 router-id=10.254.254.104
 
diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc
index 41036c4..652c8c3 100644
--- a/mikrotik-tool/culleoka.rsc
+++ b/mikrotik-tool/culleoka.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:11 by RouterOS 7.21.4
 # software id = HVP9-3G0K
 #
 # model = CCR1009-7G-1C-1S+
@@ -212,11 +212,14 @@ add address-pool=clayton disabled=yes interface=vlan_30_clayton lease-time=\
     10m name=clayton
 /ip smb users
 set [ find default=yes ] disabled=yes
+/ipv6 dhcp-server option
+add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 /ipv6 pool
-add name=climax-v6 prefix=2606:1c80:1:4000::/52 prefix-length=64
+add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
 /ppp profile
-add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
-    local-address=100.64.27.253 name=pppoe on-down="{\
+add change-tcp-mss=yes dhcpv6-pd-pool=culleoka-cust-pd-1 dns-server=\
+    204.110.191.240,204.110.191.20 local-address=100.64.27.253 name=pppoe \
+    on-down="{\
     \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
     uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
     7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@@ -324,8 +327,9 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
     \n  }\
     \n} while ( \$attempts < \$max )\
     \n}\
-    \n" only-one=no remote-address=culleoka-cgnat use-compression=no \
-    use-encryption=no use-ipv6=no use-mpls=no use-upnp=no
+    \n" only-one=no remote-address=culleoka-cgnat remote-ipv6-prefix-pool=\
+    culleoka-cust-pd-1 use-compression=no use-encryption=no use-ipv6=no \
+    use-mpls=no use-upnp=no
 /queue simple
 add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s limit-at=1/1 \
     max-limit=1/1 name=Inactive packet-marks=Inactive priority=2/2 target=""
@@ -343,19 +347,17 @@ set "ether7-maybe-bad\?" queue=fq-codel
 set sfp-sfpplus1-10g-switch queue=fq-codel
 /routing bgp instance
 add as=393837 name=bgp-instance-1 router-id=10.254.254.104
+add as=393837 name=bgp-instance-1 router-id=10.254.254.104
 /routing bgp template
-set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\
+set default as=393837 disabled=no output.network=bgp-networks .redistribute=\
     connected
 /routing id
 add disabled=no id=10.254.254.104 name=id-1 select-dynamic-id=""
 /routing ospf instance
 add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
     ospf-out redistribute=connected router-id=id-1
-add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
-    ospf-out redistribute=connected router-id=id-1 version=3
 /routing ospf area
 add disabled=no instance=default-v2 name=backbone-v2
-add disabled=no instance=default-v3 name=backbone-v3
 /snmp community
 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
     kdyyJrT0Mm
@@ -373,12 +375,17 @@ add bridge=culleoka disabled=yes ingress-filtering=no interface=*10 \
 add bridge=mgmt ingress-filtering=no interface=vlan10_ether2 \
     internal-path-cost=10 path-cost=10
 /ip firewall connection tracking
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
     tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
     tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
     tcp-time-wait-timeout=2m udp-stream-timeout=2m
 /ip settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set tcp-syncookies=yes
+/ipv6 settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
+set accept-router-advertisements=no
 /interface pppoe-server server
 add accept-empty-service=no authentication=chap,mschap2 default-profile=pppoe \
     disabled=no interface=ether2-netonix max-mtu=1492 service-name=culleoka
@@ -580,6 +587,17 @@ add src-address=100.64.0.0/10
 add action=deny
 /ip route
 add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.54
+/ipv6 route
+add comment="default via core (primary)" distance=1 dst-address=::/0 gateway=\
+    2606:1c80:0:15::1
+add comment="default via climax (backup, radio down)" distance=100 \
+    dst-address=::/0 gateway=2606:1c80:0:21::1
+add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
+    2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1
+add comment="edge loopback via core" distance=1 dst-address=\
+    2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1
+add blackhole comment="culleoka /44 aggregate (iBGP origin)" distance=200 \
+    dst-address=2606:1c80:1600::/44
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@@ -594,11 +612,38 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
 /ip traffic-flow
 set cache-entries=256k enabled=yes
 /ipv6 address
-add address=2606:1c80::4/128 advertise=no interface=*D
-add address=2606:1c80:1:4000::/52 advertise=no interface=culleoka
-add address=2606:1c80:0:10::2 interface=ether1-climax-11ghz
+add address=2606:1c80:0:10::104/128 advertise=no comment=loopback interface=\
+    lo
+add address=2606:1c80:0:15::2 advertise=no comment="P2P culleoka<->core" \
+    interface=ether6-380-11ghz
+add address=2606:1c80:0:21::2 advertise=no comment=\
+    "P2P culleoka<->climax (radio DOWN)" interface=ether1-climax-11ghz
+add address=2606:1c80:1600::1 comment="culleoka mgmt LAN" interface=mgmt
 /ipv6 dhcp-server
-add interface=culleoka name=server1 prefix-pool=climax-v6
+add interface=mgmt name=culleoka-mgmt-stateless
+/ipv6 firewall filter
+add action=accept chain=input comment=established connection-state=\
+    established,related
+add action=drop chain=input comment=invalid connection-state=invalid
+add action=accept chain=input comment=icmpv6 protocol=icmpv6
+add action=accept chain=input comment=link-local src-address=fe80::/10
+add action=accept chain=input comment=internal src-address=2606:1c80::/32
+add action=drop chain=input comment="default deny"
+add action=accept chain=forward comment=established connection-state=\
+    established,related
+add action=drop chain=forward comment=invalid connection-state=invalid
+add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
+    icmpv6
+add action=accept chain=forward comment=icmpv6 protocol=icmpv6
+add action=accept chain=forward comment=internal-to-internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment="v6 outbound from culleoka customers" \
+    src-address=2606:1c80:1600::/44
+add action=drop chain=forward comment="default deny"
+/ipv6 nd
+add advertise-dns=yes interface=mgmt other-configuration=yes
+/ipv6 nd prefix
+add interface=mgmt prefix=2606:1c80:1600::/64
 /mpls interface
 add interface=ether6-380-11ghz mpls-mtu=1508
 /mpls ldp
@@ -619,24 +664,23 @@ add accounting-backup=yes address=45.76.56.5 disabled=yes \
 /routing bfd configuration
 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
 /routing bgp connection
-add afi=ip,ipv6 cisco-vpls-nlri-len-fmt=auto-bits connect=yes instance=\
-    bgp-instance-1 listen=yes local.role=ibgp name=culleoka_climax \
-    nexthop-choice=force-self remote.address=10.250.1.14 .as=393837 .port=179 \
-    templates=default
+add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
+    bgp-instance-1 local.address=2606:1c80:0:10::104 .role=ibgp multihop=yes \
+    name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
+    v6-ibgp-out .redistribute=connected,static remote.address=\
+    2606:1c80:0:10::253 .as=393837 templates=default
 /routing filter rule
 add chain=ospf-in disabled=no rule="accept;"
 add chain=ospf-out disabled=no rule="accept;"
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2\
+    606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst\
+    ==2606:1c80:0:21::/64))) { accept; } else { reject; }"
 /routing ospf interface-template
 add area=backbone-v2 auth=sha512 auth-id=1 cost=20 disabled=no interfaces=\
     ether1-climax-11ghz priority=1 type=ptp use-bfd=yes
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether6-380-11ghz priority=1 type=ptp use-bfd=yes
-add area=backbone-v3 cost=10 disabled=no passive priority=1 use-bfd=no
 add area=backbone-v2 disabled=no passive
-add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
-    ether1-climax-11ghz type=ptp
-add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
-    ether6-380-11ghz type=ptp
 /routing ospf static-neighbor
 add address=10.250.1.14%ether1-climax-11ghz area=backbone-v2 comment=climax \
     disabled=no poll-interval=10s
diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc
index 3da967d..dabfa24 100644
--- a/mikrotik-tool/edge.rsc
+++ b/mikrotik-tool/edge.rsc
@@ -1,4 +1,4 @@
-# may/09/2026 11:21:08 by RouterOS 6.49.18
+# may/09/2026 12:15:10 by RouterOS 6.49.18
 # software id = 8XZE-R7EJ
 #
 # model = CCR2004-1G-12S+2XS
diff --git a/mikrotik-tool/home-v6-apply.rsc b/mikrotik-tool/home-v6-apply.rsc
index 46adc74..db90c3e 100644
--- a/mikrotik-tool/home-v6-apply.rsc
+++ b/mikrotik-tool/home-v6-apply.rsc
@@ -22,14 +22,14 @@
 # WIPE — clean prior v6 config (preserve auto-link-local + Starlink ULA)
 # -----------------------------------------------------------------------------
 /ipv6 firewall filter remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 nd prefix remove [find]
 /ipv6 dhcp-server remove [find]
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 pool remove [find name=home-pd]
 /ipv6 route remove [find static=yes]
-/ipv6 address remove [find !dynamic and !disabled]
+/ipv6 address remove [find dynamic=no and disabled=no]
 
 # -----------------------------------------------------------------------------
 # APPLY — settings
diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc
index ff179d9..1cc40c5 100644
--- a/mikrotik-tool/home.rsc
+++ b/mikrotik-tool/home.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.22.3
+# 2026-05-09 12:15:10 by RouterOS 7.22.3
 # software id = ZGNY-ZJW7
 #
 # model = RB5009UG+S+
diff --git a/mikrotik-tool/lowry-v6-apply.rsc b/mikrotik-tool/lowry-v6-apply.rsc
index 1b16ba7..b79a132 100644
--- a/mikrotik-tool/lowry-v6-apply.rsc
+++ b/mikrotik-tool/lowry-v6-apply.rsc
@@ -20,23 +20,25 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 /routing ospf interface-template remove [find area=backbone-v3]
 /routing ospf area remove [find name=backbone-v3]
 /routing ospf instance remove [find name=default-v3]
 
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — BGP instance
 # -----------------------------------------------------------------------------
+/routing bgp template set [find name=default] disabled=no
+
 /routing bgp instance
 add name=bgp-instance-1 as=393837 router-id=10.254.254.109
 
@@ -48,7 +50,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.109
 /ipv6 address
 add address=2606:1c80:0:10::109/128 interface=lo                advertise=no  comment="loopback"
 add address=2606:1c80:0:18::2/64    interface=ether1-newhope    advertise=no  comment="P2P lowry<->newhope"
-add address=2606:1c80:1900::1/64    interface=mgmt              advertise=yes comment="lowry mgmt LAN"
+add address=2606:1c80:1900::1/64    interface=management              advertise=yes comment="lowry mgmt LAN"
 
 # -----------------------------------------------------------------------------
 # APPLY — static routes
@@ -63,13 +65,13 @@ add dst-address=2606:1c80:1900::/44 blackhole distance=200 comment="lowry /44 ag
 # APPLY — neighbour discovery on the mgmt LAN
 # -----------------------------------------------------------------------------
 /ipv6 nd
-add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
+add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
 
 /ipv6 nd prefix
-add interface=mgmt prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
+add interface=management prefix=2606:1c80:1900::/64 autonomous=yes on-link=yes
 
 /ipv6 dhcp-server
-add interface=mgmt name=lowry-mgmt-stateless address-pool=static-only
+add interface=management name=lowry-mgmt-stateless address-pool=static-only
 
 /ipv6 dhcp-server option
 add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc
index 0943f47..d6afaed 100644
--- a/mikrotik-tool/lowry.rsc
+++ b/mikrotik-tool/lowry.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:11 by RouterOS 7.21.4
 # software id = 2I9X-PQZP
 #
 # model = CCR1009-7G-1C-1S+
@@ -143,11 +143,14 @@ add address-pool=mgmt interface=management lease-script="{\
     \n" lease-time=1h name=mgmt
 /ip smb users
 set [ find default=yes ] disabled=yes
+/ipv6 dhcp-server option
+add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 /ipv6 pool
-add name=lowrycrossing-v6 prefix=2606:1c80:1:6000::/52 prefix-length=64
+add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
 /ppp profile
-add change-tcp-mss=yes dns-server=204.110.191.20,204.110.191.240 \
-    local-address=100.64.159.254 name=pppoe on-down="{\
+add change-tcp-mss=yes dhcpv6-pd-pool=lowry-cust-pd-1 dns-server=\
+    204.110.191.20,204.110.191.240 local-address=100.64.159.254 name=pppoe \
+    on-down="{\
     \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
     uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
     7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@@ -255,8 +258,9 @@ add change-tcp-mss=yes dns-server=204.110.191.20,204.110.191.240 \
     \n  }\
     \n} while ( \$attempts < \$max )\
     \n}\
-    \n" only-one=yes remote-address=cgnat use-compression=no use-encryption=\
-    no use-ipv6=no use-upnp=no
+    \n" only-one=yes remote-address=cgnat remote-ipv6-prefix-pool=\
+    lowry-cust-pd-1 use-compression=no use-encryption=no use-ipv6=no \
+    use-upnp=no
 /queue type
 add kind=pcq name=delinquent_download pcq-classifier=dst-address \
     pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
@@ -312,18 +316,17 @@ set ether5 queue=fq-codel
 set ether6 queue=fq-codel
 set ether7 queue=fq-codel
 set sfp-sfpplus1 queue=fq-codel
+/routing bgp instance
+add as=393837 name=bgp-instance-1 router-id=10.254.254.109
 /routing bgp template
-set default disabled=yes output.network=bgp-networks
+set default disabled=no output.network=bgp-networks
 /routing id
 add disabled=no id=10.254.254.109 name=id-1 select-dynamic-id=""
 /routing ospf instance
 add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
     ospf-out redistribute=connected router-id=id-1
-add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
-    ospf-out redistribute=connected router-id=id-1 version=3
 /routing ospf area
 add disabled=no instance=default-v2 name=backbone-v2
-add disabled=no instance=default-v3 name=backbone-v3
 /snmp community
 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
     kdyyJrT0Mm
@@ -362,12 +365,17 @@ add bridge=management ingress-filtering=no interface=vlan_10_ether6 \
 add bridge=management ingress-filtering=no interface=vlan_10_ether7 \
     internal-path-cost=10 path-cost=10
 /ip firewall connection tracking
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
     tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
     tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
     tcp-time-wait-timeout=2m udp-stream-timeout=2m
 /ip settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set tcp-syncookies=yes
+/ipv6 settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
+set accept-router-advertisements=no
 /interface pppoe-server server
 add default-profile=pppoe disabled=no interface=lowrycrossing max-mtu=1492 \
     mrru=1600 one-session-per-host=yes service-name=lowrycrossing
@@ -1256,6 +1264,15 @@ set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
 set cache-path=web-proxy1 port=34133
 /ip route
 add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.110
+/ipv6 route
+add comment="default via newhope" distance=1 dst-address=::/0 gateway=\
+    2606:1c80:0:18::1
+add comment="core loopback (iBGP bootstrap, via newhope)" distance=1 \
+    dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:18::1
+add comment="edge loopback (via newhope)" distance=1 dst-address=\
+    2606:1c80:0:10::254/128 gateway=2606:1c80:0:18::1
+add blackhole comment="lowry /44 aggregate (iBGP origin)" distance=200 \
+    dst-address=2606:1c80:1900::/44
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@@ -1268,11 +1285,34 @@ set api-ssl certificate=vntx.net.pem_0
 /ip ssh
 set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
 /ipv6 address
-add address=2606:1c80:1:6000::/52 advertise=no disabled=yes interface=\
-    lowrycrossing
-add address=2606:1c80:0:9::2 disabled=yes interface=vlan_20_sfpplus1_newhope
+add address=2606:1c80:0:10::109/128 advertise=no comment=loopback interface=\
+    lo
+add address=2606:1c80:0:18::2 advertise=no comment="P2P lowry<->newhope" \
+    interface=ether1-newhope
+add address=2606:1c80:1900::1 comment="lowry mgmt LAN" interface=management
 /ipv6 dhcp-server
-add interface=lowrycrossing name=server1 prefix-pool=lowrycrossing-v6
+add interface=management name=lowry-mgmt-stateless
+/ipv6 firewall filter
+add action=accept chain=input comment=established connection-state=\
+    established,related
+add action=drop chain=input comment=invalid connection-state=invalid
+add action=accept chain=input comment=icmpv6 protocol=icmpv6
+add action=accept chain=input comment=link-local src-address=fe80::/10
+add action=accept chain=input comment=internal src-address=2606:1c80::/32
+add action=drop chain=input comment="default deny"
+add action=accept chain=forward comment=established connection-state=\
+    established,related
+add action=drop chain=forward comment=invalid connection-state=invalid
+add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
+    icmpv6
+add action=accept chain=forward comment=icmpv6 protocol=icmpv6
+add action=accept chain=forward comment=internal-to-internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment="v6 outbound from lowry customers" \
+    src-address=2606:1c80:1900::/44
+add action=drop chain=forward comment="default deny"
+/ipv6 nd
+add advertise-dns=yes interface=management other-configuration=yes
 /lcd
 set time-interval=hour
 /mpls interface
@@ -1295,15 +1335,21 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
 set accept=yes
 /routing bfd configuration
 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
+/routing bgp connection
+add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
+    bgp-instance-1 local.address=2606:1c80:0:10::109 .role=ibgp multihop=yes \
+    name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
+    v6-ibgp-out .redistribute=connected,static remote.address=\
+    2606:1c80:0:10::253 .as=393837 templates=default
 /routing filter rule
 add chain=ospf-in disabled=no rule="accept;"
 add chain=ospf-out disabled=no rule="accept;"
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1900::/44 || dst==2\
+    606:1c80:0:10::109/128 || (dst-len==64 && dst==2606:1c80:0:18::/64)) { acc\
+    ept; } else { reject; }"
 /routing ospf interface-template
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether1-newhope priority=1 type=ptp use-bfd=yes
-add area=backbone-v3 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
-    ether1-newhope passive priority=1 type=ptp use-bfd=no
-add area=backbone-v3 cost=10 disabled=no use-bfd=no
 add area=backbone-v2 disabled=no passive
 /snmp
 set contact=graham@vntx.net enabled=yes location="33.160873, -96.540479"
diff --git a/mikrotik-tool/main.go b/mikrotik-tool/main.go
index 2d6e64a..f02aee1 100644
--- a/mikrotik-tool/main.go
+++ b/mikrotik-tool/main.go
@@ -245,11 +245,102 @@ func runOverSSH(r Router, sshPort int, cmd string) ([]byte, error) {
 	return stdout.Bytes(), nil
 }
 
+// flattenRSC converts a .rsc-style script (with sticky section paths and
+// backslash continuations) into a stream of self-contained ROS commands,
+// one per line. ROS's non-interactive SSH shell treats each line
+// independently — it does NOT remember the most recent section path the
+// way /import or the interactive prompt do — so a script like
+//
+//	/ipv6 address
+//	add address=... interface=...
+//	add address=... interface=...
+//
+// fails with "bad command name add" unless we rewrite it as
+//
+//	/ipv6 address add address=... interface=...
+//	/ipv6 address add address=... interface=...
+//
+// before piping it in. This function does that rewrite and also: drops
+// `#` comments, drops blank lines, and joins lines ending in `\`.
+func flattenRSC(script []byte) []byte {
+	lines := strings.Split(string(script), "\n")
+
+	// Collapse "\" line-continuations first so we can reason per logical line.
+	var joined []string
+	var carry strings.Builder
+	for _, line := range lines {
+		s := strings.TrimRight(line, "\r")
+		if strings.HasSuffix(s, "\\") {
+			carry.WriteString(strings.TrimSuffix(s, "\\"))
+			carry.WriteString(" ")
+			continue
+		}
+		if carry.Len() > 0 {
+			carry.WriteString(s)
+			joined = append(joined, carry.String())
+			carry.Reset()
+			continue
+		}
+		joined = append(joined, s)
+	}
+	if carry.Len() > 0 {
+		joined = append(joined, carry.String())
+	}
+
+	var out strings.Builder
+	section := ""
+	for _, raw := range joined {
+		s := strings.TrimSpace(raw)
+		if s == "" || strings.HasPrefix(s, "#") {
+			continue
+		}
+		if strings.HasPrefix(s, "/") {
+			// A line starting with `/` is either a section header
+			// (e.g. `/ipv6 address`) or an already-flat command
+			// (e.g. `/ipv6 settings set forward=yes`). We detect a
+			// flat command by the presence of a verb token after
+			// the path words. Heuristic: if the line contains
+			// ` add ` / ` set ` / ` remove ` / ` print ` / ` get`,
+			// it's a flat command — emit as-is and don't change
+			// the section. Otherwise treat the whole line as a
+			// new section path.
+			rest := s
+			isFlat := false
+			for _, verb := range []string{" add ", " add\t", " set ", " set\t", " remove ", " remove\t", " print", " get", " import "} {
+				if strings.Contains(rest, verb) || strings.HasSuffix(rest, " add") || strings.HasSuffix(rest, " set") || strings.HasSuffix(rest, " remove") || strings.HasSuffix(rest, " print") || strings.HasSuffix(rest, " get") {
+					isFlat = true
+					break
+				}
+			}
+			if isFlat {
+				out.WriteString(s)
+				out.WriteByte('\n')
+				continue
+			}
+			section = s
+			continue
+		}
+		if section == "" {
+			// Defensive: command with no preceding section. Send
+			// as-is and let RouterOS report the error.
+			out.WriteString(s)
+			out.WriteByte('\n')
+			continue
+		}
+		out.WriteString(section)
+		out.WriteByte(' ')
+		out.WriteString(s)
+		out.WriteByte('\n')
+	}
+	return []byte(out.String())
+}
+
 // runScriptOverSSH pipes a multi-line .rsc script through an SSH session as
-// if the user had typed it. Each line is parsed by RouterOS's CLI, exactly
-// like /import does — section paths persist across lines, errors print but
-// don't abort the rest of the script. A trailing "/quit\n" is appended so
-// the shell exits cleanly when the file ends.
+// if the user had typed it. The script is first flattened (section paths
+// inlined, comments stripped, `\` continuations joined) because ROS's
+// non-interactive SSH shell forgets the section path between lines.
+// Per-line errors print but don't abort the rest of the script. A trailing
+// "/quit\n" is appended so the shell exits when the file ends.
 func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
 	client, err := dialSSH(r, sshPort)
 	if err != nil {
@@ -267,7 +358,7 @@ func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
 	session.Stdout = &stdout
 	session.Stderr = &stderr
 
-	body := append([]byte{}, script...)
+	body := flattenRSC(script)
 	if len(body) == 0 || body[len(body)-1] != '\n' {
 		body = append(body, '\n')
 	}
@@ -279,11 +370,15 @@ func runScriptOverSSH(r Router, sshPort int, script []byte) ([]byte, error) {
 	}
 
 	if err := session.Wait(); err != nil {
-		// Wait returns *ssh.ExitMissingError if the server didn't send an
-		// exit status — common for ROS shells that close the channel
-		// without one. Treat as success if we got output.
+		// ROS shells exit with status 1 on /quit (they don't distinguish
+		// "session ended normally" from "command failed"), and sometimes
+		// close the channel without any exit status at all. Both look
+		// like errors to ssh.Session.Wait(); treat them as success.
+		// Real per-line failures show up in the captured stdout where
+		// the user can see them.
+		var exitErr *ssh.ExitError
 		var exitMissing *ssh.ExitMissingError
-		if !errors.As(err, &exitMissing) {
+		if !errors.As(err, &exitErr) && !errors.As(err, &exitMissing) {
 			return stdout.Bytes(), fmt.Errorf("ssh wait: %w (stderr: %s)", err, stderr.String())
 		}
 	}
@@ -568,7 +663,10 @@ commands:
             (e.g. mikrotik-tool api verona /ip/route/print)
   schema    show parameter names accepted under an API path on one router,
             plus matching examples from local .rsc exports
-            (e.g. mikrotik-tool schema verona /routing/bgp/connection)`)
+            (e.g. mikrotik-tool schema verona /routing/bgp/connection)
+  script    push a local .rsc file to one router and run it via SSH; output
+            from the router (errors, /export prints, etc.) is mirrored to
+            stdout (e.g. mikrotik-tool script 494 494-v6-apply.rsc)`)
 	os.Exit(2)
 }
 
@@ -623,6 +721,12 @@ func main() {
 			os.Exit(2)
 		}
 		runSchema(cfg, args[1], args[2])
+	case "script":
+		if len(args) < 3 {
+			fmt.Fprintln(os.Stderr, "usage: mikrotik-tool script <router> <file.rsc>")
+			os.Exit(2)
+		}
+		runScript(cfg, args[1], args[2])
 	default:
 		fmt.Fprintf(os.Stderr, "unknown command: %s\n", args[0])
 		usage()
diff --git a/mikrotik-tool/mikrotik-tool b/mikrotik-tool/mikrotik-tool
index 03f8758..8ab4b43 100755
Binary files a/mikrotik-tool/mikrotik-tool and b/mikrotik-tool/mikrotik-tool differ
diff --git a/mikrotik-tool/newhope-v6-apply.rsc b/mikrotik-tool/newhope-v6-apply.rsc
index 18299b3..55e5a2e 100644
--- a/mikrotik-tool/newhope-v6-apply.rsc
+++ b/mikrotik-tool/newhope-v6-apply.rsc
@@ -24,23 +24,25 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 /routing ospf interface-template remove [find area=backbone-v3]
 /routing ospf area remove [find name=backbone-v3]
 /routing ospf instance remove [find name=default-v3]
 
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — BGP instance
 # -----------------------------------------------------------------------------
+/routing bgp template set [find name=default] disabled=no
+
 /routing bgp instance
 add name=bgp-instance-1 as=393837 router-id=10.254.254.108
 
@@ -53,7 +55,7 @@ add name=bgp-instance-1 as=393837 router-id=10.254.254.108
 add address=2606:1c80:0:10::108/128 interface=lo                       advertise=no  comment="loopback"
 add address=2606:1c80:0:13::2/64    interface=ether2-380               advertise=no  comment="P2P newhope<->core"
 add address=2606:1c80:0:18::1/64    interface=ether6-lowrycrossing     advertise=no  comment="P2P newhope<->lowry"
-add address=2606:1c80:1800::1/64    interface=mgmt                     advertise=yes comment="newhope mgmt LAN"
+add address=2606:1c80:1800::1/64    interface=bridge_cpe_mgmt                     advertise=yes comment="newhope mgmt LAN"
 
 # -----------------------------------------------------------------------------
 # APPLY — static routes
@@ -62,19 +64,26 @@ add address=2606:1c80:1800::1/64    interface=mgmt                     advertise
 add dst-address=::/0                    gateway=2606:1c80:0:13::1 distance=1   comment="default via core"
 add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1 distance=1   comment="core loopback (iBGP bootstrap)"
 add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1 distance=1   comment="edge loopback via core"
+
+# Lowry sits one hop further out via the newhope<->lowry P2P. newhope is
+# the only neighbour that can deliver to lowry's loopback, so we hold a
+# static for it; without this, traffic for :10::109 from core/edge loops
+# at newhope until iBGP fully converges.
+add dst-address=2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2 distance=1   comment="lowry loopback via P2P"
+
 add dst-address=2606:1c80:1800::/44 blackhole distance=200 comment="newhope /44 aggregate (iBGP origin)"
 
 # -----------------------------------------------------------------------------
 # APPLY — neighbour discovery on the mgmt LAN
 # -----------------------------------------------------------------------------
 /ipv6 nd
-add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
+add interface=bridge_cpe_mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
 
 /ipv6 nd prefix
-add interface=mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
+add interface=bridge_cpe_mgmt prefix=2606:1c80:1800::/64 autonomous=yes on-link=yes
 
 /ipv6 dhcp-server
-add interface=mgmt name=newhope-mgmt-stateless address-pool=static-only
+add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless address-pool=static-only
 
 /ipv6 dhcp-server option
 add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
@@ -86,7 +95,7 @@ add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
 
 /ppp profile
-set [find name=pppoe] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
+set [find name=newhope] remote-ipv6-prefix-pool=newhope-cust-pd-1 dhcpv6-pd-pool=newhope-cust-pd-1
 
 # -----------------------------------------------------------------------------
 # APPLY — firewall
diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc
index b173d41..67dd138 100644
--- a/mikrotik-tool/newhope.rsc
+++ b/mikrotik-tool/newhope.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:11 by RouterOS 7.21.4
 # software id = 5HTF-YFWV
 #
 # model = CCR1009-7G-1C-1S+
@@ -150,12 +150,15 @@ add address-pool=dhcp_pool6 interface=ether7-tower lease-time=1h name=\
     newhope-tower
 /ip smb users
 set [ find default=yes ] disabled=yes
+/ipv6 dhcp-server option
+add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 /ipv6 pool
-add name=newhope-v6 prefix=2606:1c80:1:5000::/52 prefix-length=64
+add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
 /ppp profile
 set *0 remote-address=dhcp_pool3
-add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
-    local-address=100.64.19.253 name=newhope on-down="{\
+add change-tcp-mss=yes dhcpv6-pd-pool=newhope-cust-pd-1 dns-server=\
+    204.110.191.240,204.110.191.20 local-address=100.64.19.253 name=newhope \
+    on-down="{\
     \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
     uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
     7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@@ -263,7 +266,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
     \n  }\
     \n} while ( \$attempts < \$max )\
     \n}\
-    \n" remote-address=cgnat use-upnp=no
+    \n" remote-address=cgnat remote-ipv6-prefix-pool=newhope-cust-pd-1 \
+    use-upnp=no
 /queue type
 add kind=pcq name=delinquent_download pcq-classifier=dst-address \
     pcq-dst-address6-mask=64 pcq-rate=64k pcq-src-address6-mask=64 \
@@ -282,19 +286,18 @@ set ether5-switch queue=fq-codel
 set ether6-lowrycrossing queue=fq-codel
 set ether7-tower queue=fq-codel
 set sfp-sfpplus1-edgepoint queue=fq-codel
+/routing bgp instance
+add as=393837 name=bgp-instance-1 router-id=10.254.254.108
 /routing bgp template
-set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\
+set default as=393837 disabled=no output.network=bgp-networks .redistribute=\
     connected
 /routing id
 add disabled=no id=10.254.254.108 name=id-1 select-dynamic-id=""
 /routing ospf instance
 add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
     ospf-out redistribute=connected,rip router-id=id-1
-add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
-    ospf-out router-id=id-1 version=3
 /routing ospf area
 add disabled=no instance=default-v2 name=backbone-v2
-add disabled=no instance=default-v3 name=backbone-v3
 /snmp community
 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
     kdyyJrT0Mm
@@ -311,12 +314,17 @@ add bridge=newhope ingress-filtering=no interface=combo1 internal-path-cost=\
 add bridge=newhope interface=ether5-switch
 add bridge=newhope interface=sfp-sfpplus1-edgepoint
 /ip firewall connection tracking
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
     tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
     tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
     tcp-time-wait-timeout=2m udp-stream-timeout=2m
 /ip settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set tcp-syncookies=yes
+/ipv6 settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
+set accept-router-advertisements=no
 /interface pppoe-server server
 add authentication=mschap2 default-profile=newhope disabled=no interface=\
     newhope max-mru=1492 max-mtu=1492 one-session-per-host=yes service-name=\
@@ -506,6 +514,17 @@ add disabled=no dst-address=100.64.20.0/22 gateway=10.250.1.105 \
     routing-table=main
 add disabled=no dst-address=10.10.144.0/20 gateway=10.250.1.105 \
     routing-table=main
+/ipv6 route
+add comment="default via core" distance=1 dst-address=::/0 gateway=\
+    2606:1c80:0:13::1
+add comment="core loopback (iBGP bootstrap)" distance=1 dst-address=\
+    2606:1c80:0:10::253/128 gateway=2606:1c80:0:13::1
+add comment="edge loopback via core" distance=1 dst-address=\
+    2606:1c80:0:10::254/128 gateway=2606:1c80:0:13::1
+add blackhole comment="newhope /44 aggregate (iBGP origin)" distance=200 \
+    dst-address=2606:1c80:1800::/44
+add comment="lowry loopback via P2P" distance=1 dst-address=\
+    2606:1c80:0:10::109/128 gateway=2606:1c80:0:18::2
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@@ -520,10 +539,40 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
 /ip traffic-flow
 set cache-entries=256k enabled=yes
 /ipv6 address
-add address=2606:1c80:0:1001::2 interface=ether2-380
+add address=2606:1c80:0:10::108/128 advertise=no comment=loopback interface=\
+    lo
+add address=2606:1c80:0:13::2 advertise=no comment="P2P newhope<->core" \
+    interface=ether2-380
+add address=2606:1c80:0:18::1 advertise=no comment="P2P newhope<->lowry" \
+    interface=ether6-lowrycrossing
+add address=2606:1c80:1800::1 comment="newhope mgmt LAN" interface=\
+    bridge_cpe_mgmt
 /ipv6 dhcp-server
-add disabled=yes interface=sfp-sfpplus1-edgepoint name=server1 prefix-pool=\
-    newhope-v6
+add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless
+/ipv6 firewall filter
+add action=accept chain=input comment=established connection-state=\
+    established,related
+add action=drop chain=input comment=invalid connection-state=invalid
+add action=accept chain=input comment=icmpv6 protocol=icmpv6
+add action=accept chain=input comment=link-local src-address=fe80::/10
+add action=accept chain=input comment=internal src-address=2606:1c80::/32
+add action=drop chain=input comment="default deny"
+add action=accept chain=forward comment=established connection-state=\
+    established,related
+add action=drop chain=forward comment=invalid connection-state=invalid
+add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
+    icmpv6
+add action=accept chain=forward comment=icmpv6 protocol=icmpv6
+add action=accept chain=forward comment=internal-to-internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment="v6 outbound from newhope customers" \
+    src-address=2606:1c80:1800::/44
+add action=accept chain=forward comment=\
+    "v6 outbound from lowry customers (transit)" src-address=\
+    2606:1c80:1900::/44
+add action=drop chain=forward comment="default deny"
+/ipv6 nd
+add advertise-dns=yes interface=bridge_cpe_mgmt other-configuration=yes
 /mpls interface
 add interface=ether2-380 mpls-mtu=1508
 add interface=ether6-lowrycrossing mpls-mtu=1508
@@ -546,11 +595,20 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
 set accept=yes
 /routing bfd configuration
 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
+/routing bgp connection
+add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
+    bgp-instance-1 local.address=2606:1c80:0:10::108 .role=ibgp multihop=yes \
+    name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
+    v6-ibgp-out .redistribute=connected,static remote.address=\
+    2606:1c80:0:10::253 .as=393837 templates=default
 /routing filter rule
 add chain=ospf-in disabled=no rule="accept;"
 add chain=ospf-out disabled=no rule="accept;"
 add chain=bgp-in disabled=no rule="accept;"
 add chain=bgp-out disabled=no rule="accept;"
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1800::/44 || dst==2\
+    606:1c80:0:10::108/128 || (dst-len==64 && (dst==2606:1c80:0:13::/64 || dst\
+    ==2606:1c80:0:18::/64))) { accept; } else { reject; }"
 /routing ospf interface-template
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether4 priority=1 type=ptp use-bfd=yes
@@ -558,12 +616,7 @@ add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether6-lowrycrossing priority=1 type=ptp use-bfd=yes
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether2-380 priority=1 type=ptp use-bfd=yes
-add area=backbone-v3 cost=10 disabled=no priority=1 use-bfd=no
 add area=backbone-v2 disabled=no passive
-add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether4 \
-    type=ptp
-add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=ether2-380 \
-    type=ptp
 /routing rip static-neighbor
 add address="" disabled=no instance=*1
 /snmp
diff --git a/mikrotik-tool/verona-v6-apply.rsc b/mikrotik-tool/verona-v6-apply.rsc
index c8ef357..75ac1f7 100644
--- a/mikrotik-tool/verona-v6-apply.rsc
+++ b/mikrotik-tool/verona-v6-apply.rsc
@@ -27,13 +27,13 @@
 /ipv6 dhcp-server option remove [find]
 /ipv6 dhcp-client remove [find]
 /ipv6 nd prefix remove [find]
-/ipv6 nd remove [find !default]
+/ipv6 nd remove [find default=no]
 /ipv6 pool remove [find]
-/ipv6 route remove [find !dynamic]
+/ipv6 route remove [find dynamic=no]
 /ipv6 firewall filter remove [find]
 /ipv6 firewall mangle remove [find]
 /ipv6 firewall raw remove [find]
-/ipv6 address remove [find !dynamic]
+/ipv6 address remove [find dynamic=no]
 
 # OSPFv3 — remove the v3 instance, area, interface-template entry, leave v2 alone.
 /routing ospf interface-template remove [find area=backbone-v3]
@@ -41,7 +41,7 @@
 /routing ospf instance remove [find name=default-v3]
 
 # Any leftover v6 BGP — wipe internal-only, never touch upstream peers.
-/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
 
 # -----------------------------------------------------------------------------
 # APPLY — addresses
diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc
index 55eb5a2..d33a114 100644
--- a/mikrotik-tool/verona.rsc
+++ b/mikrotik-tool/verona.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 11:21:08 by RouterOS 7.21.4
+# 2026-05-09 12:15:10 by RouterOS 7.21.4
 # software id = Y1CT-1WB1
 #
 # model = CCR2004-16G-2S+