graham/network
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

routers update

Browse source
This commit is contained in:
Graham McIntire 2026-05-14 09:38:11 -05:00
parent d709aabe50
commit bde0beae11
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
12 changed files with 57 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
CLAUDE.md
View file

@ -246,6 +246,22 @@ Per-tower /44s + central server LAN at `2606:1c80::/64` on edge. Full
allocation plan in `mikrotik-tool/ipv6.md`. NetBox has these as IPAM
prefixes.
### IPv6 forward firewall — must accept the whole /32
Every tower router's `/ipv6 firewall filter chain=forward` needs
`action=accept src-address=2606:1c80::/32` before the `default deny`.
A per-tower `/44` rule is **wrong** — customer traffic transits other
routers to reach `edge`, so each transit hop blackholes other towers'
`/44`s. Classic symptom: ICMPv6 ping works (there's an `accept
protocol=icmpv6` rule) but TCP/HTTP times out at `connect` (forwarded
TCP hits `default deny`). The original `ipv6.md` template used
`in-interface-list=customer`, but that list was never created on any
router so the rule matched nothing — fixed fleet-wide 2026-05-14, and
the now-redundant per-tower `/44` and `internal-to-internal` forward
rules were removed at the same time. `edge` has a permissive forward
chain (no default-deny) so it didn't need the rule. Resolver/DNS
roll-out (`2606:1c80::240`/`::250` in `/ip dns` + the `v6-dns` DHCPv6
option) is also fleet-wide as of 2026-05-14.
### graham's home network — IPv6
Home (`RB5009`, identity `graham`, `10.0.19.254`) takes a **`/56`** from
verona via DHCPv6-PD on `ether5-vntx-static` (verona's `verona-wired-pd`

8
mikrotik-tool/494.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:51 by RouterOS 7.21.4
# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = K4QG-8NQV
#
# model = RB5009UG+S+
@ -482,10 +482,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from 494 customers" \
src-address=2606:1c80:1a00::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes

8
mikrotik-tool/982.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:52 by RouterOS 7.21.4
# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = FUVS-HCM5
#
# model = CCR1009-7G-1C-1S+
@ -428,10 +428,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from 982 customers" \
src-address=2606:1c80:1300::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes

9
mikrotik-tool/climax.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:51 by RouterOS 7.21.4
# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = UETF-WF31
#
# model = CCR2004-16G-2S+
@ -448,11 +448,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment=\
"v6 outbound from climax tower (customer + mgmt)" src-address=\
2606:1c80:1100::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes

8
mikrotik-tool/core.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:52 by RouterOS 7.21.4
# 2026-05-14 09:37:54 by RouterOS 7.21.4
# software id = XS5B-41QR
#
# model = CCR1009-7G-1C-1S+
@ -551,10 +551,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from 380 tower" \
src-address=2606:1c80:1400::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes

8
mikrotik-tool/culleoka.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:52 by RouterOS 7.21.4
# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = HVP9-3G0K
#
# model = CCR1009-7G-1C-1S+
@ -632,10 +632,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from culleoka customers" \
src-address=2606:1c80:1600::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
add advertise-dns=yes interface=mgmt other-configuration=yes

2
mikrotik-tool/edge.rsc
View file

@ -1,4 +1,4 @@
# may/14/2026 09:28:51 by RouterOS 6.49.18
# may/14/2026 09:37:53 by RouterOS 6.49.18
# software id = 8XZE-R7EJ
#
# model = CCR2004-1G-12S+2XS

2
mikrotik-tool/home.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:51 by RouterOS 7.22.3
# 2026-05-14 09:37:53 by RouterOS 7.22.3
# software id = ZGNY-ZJW7
#
# model = RB5009UG+S+

20
mikrotik-tool/ipv6.md
View file

@ -303,12 +303,23 @@ add chain=input action=drop
add chain=forward action=accept connection-state=established,related
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 ;; PMTUD
add chain=forward action=accept protocol=icmpv6
add chain=forward action=accept src-address=2606:1c80::/32 \
dst-address=2606:1c80::/32
add chain=forward action=accept in-interface-list=customer ;; v6 outbound
add chain=forward action=accept src-address=2606:1c80::/32 ;; v6 outbound + transit
add chain=forward action=drop
```
The `src-address=2606:1c80::/32` forward rule is **load-bearing and must
match the whole /32, not a per-tower /44**. Traffic from one tower's
customers transits other routers on the way to `edge`, so a router that
only accepts its own `/44` blackholes every other tower's customers at
its `default deny` (presents as "ICMPv6 pings work, TCP/HTTP doesn't" —
the `accept protocol=icmpv6` rule lets echo through while forwarded TCP
hits the drop). It also covers internal-to-internal, so no separate
`src+dst=2606:1c80::/32` rule is needed. Do **not** use
`in-interface-list=customer` — that list was never populated on the
fleet and the rule silently matched nothing. Unsolicited inbound from
the internet to customers still hits `default deny`; only
`established,related` returns.
Edge keeps its existing inbound BGP rules. Do **not** NAT v6 — every
prefix is GUA from your /32.
@ -530,8 +541,7 @@ add chain=input action=drop comment="default deny"
add chain=forward action=accept connection-state=established,related
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
add chain=forward action=accept protocol=icmpv6
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32
add chain=forward action=accept in-interface-list=customer comment="v6 outbound"
add chain=forward action=accept src-address=2606:1c80::/32 comment="v6 outbound (all vntx sources)"
add chain=forward action=drop comment="default deny"
# ---- OSPFv3 (router-id = v4 loopback)

8
mikrotik-tool/lowry.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:52 by RouterOS 7.21.4
# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = 2I9X-PQZP
#
# model = CCR1009-7G-1C-1S+
@ -1303,10 +1303,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from lowry customers" \
src-address=2606:1c80:1900::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
add advertise-dns=yes interface=management other-configuration=yes

11
mikrotik-tool/newhope.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:52 by RouterOS 7.21.4
# 2026-05-14 09:37:54 by RouterOS 7.21.4
# software id = 5HTF-YFWV
#
# model = CCR1009-7G-1C-1S+
@ -563,13 +563,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from newhope customers" \
src-address=2606:1c80:1800::/44
add action=accept chain=forward comment=\
"v6 outbound from lowry customers (transit)" src-address=\
2606:1c80:1900::/44
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
add advertise-dns=yes interface=bridge_cpe_mgmt other-configuration=yes

6
mikrotik-tool/verona.rsc
View file

@ -1,4 +1,4 @@
# 2026-05-14 09:28:51 by RouterOS 7.21.4
# 2026-05-14 09:37:53 by RouterOS 7.21.4
# software id = Y1CT-1WB1
#
# model = CCR2004-16G-2S+
@ -931,8 +931,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
src-address=2606:1c80::/32
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes