diff --git a/CLAUDE.md b/CLAUDE.md
index 03ea0e7..87f23ad 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -246,6 +246,22 @@ Per-tower /44s + central server LAN at `2606:1c80::/64` on edge. Full
 allocation plan in `mikrotik-tool/ipv6.md`. NetBox has these as IPAM
 prefixes.
 
+### IPv6 forward firewall — must accept the whole /32
+Every tower router's `/ipv6 firewall filter chain=forward` needs
+`action=accept src-address=2606:1c80::/32` before the `default deny`.
+A per-tower `/44` rule is **wrong** — customer traffic transits other
+routers to reach `edge`, so each transit hop blackholes other towers'
+`/44`s. Classic symptom: ICMPv6 ping works (there's an `accept
+protocol=icmpv6` rule) but TCP/HTTP times out at `connect` (forwarded
+TCP hits `default deny`). The original `ipv6.md` template used
+`in-interface-list=customer`, but that list was never created on any
+router so the rule matched nothing — fixed fleet-wide 2026-05-14, and
+the now-redundant per-tower `/44` and `internal-to-internal` forward
+rules were removed at the same time. `edge` has a permissive forward
+chain (no default-deny) so it didn't need the rule. Resolver/DNS
+roll-out (`2606:1c80::240`/`::250` in `/ip dns` + the `v6-dns` DHCPv6
+option) is also fleet-wide as of 2026-05-14.
+
 ### graham's home network — IPv6
 Home (`RB5009`, identity `graham`, `10.0.19.254`) takes a **`/56`** from
 verona via DHCPv6-PD on `ether5-vntx-static` (verona's `verona-wired-pd`
diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc
index 4fefb7d..f959de3 100644
--- a/mikrotik-tool/494.rsc
+++ b/mikrotik-tool/494.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:51 by RouterOS 7.21.4
+# 2026-05-14 09:37:53 by RouterOS 7.21.4
 # software id = K4QG-8NQV
 #
 # model = RB5009UG+S+
@@ -482,10 +482,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment="v6 outbound from 494 customers" \
-    src-address=2606:1c80:1a00::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc
index b61a263..61b5f23 100644
--- a/mikrotik-tool/982.rsc
+++ b/mikrotik-tool/982.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:52 by RouterOS 7.21.4
+# 2026-05-14 09:37:53 by RouterOS 7.21.4
 # software id = FUVS-HCM5
 #
 # model = CCR1009-7G-1C-1S+
@@ -428,10 +428,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment="v6 outbound from 982 customers" \
-    src-address=2606:1c80:1300::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc
index 7dcd81c..ce350b5 100644
--- a/mikrotik-tool/climax.rsc
+++ b/mikrotik-tool/climax.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:51 by RouterOS 7.21.4
+# 2026-05-14 09:37:53 by RouterOS 7.21.4
 # software id = UETF-WF31
 #
 # model = CCR2004-16G-2S+
@@ -448,11 +448,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment=\
-    "v6 outbound from climax tower (customer + mgmt)" src-address=\
-    2606:1c80:1100::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc
index ec6e51d..fd9916a 100644
--- a/mikrotik-tool/core.rsc
+++ b/mikrotik-tool/core.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:52 by RouterOS 7.21.4
+# 2026-05-14 09:37:54 by RouterOS 7.21.4
 # software id = XS5B-41QR
 #
 # model = CCR1009-7G-1C-1S+
@@ -551,10 +551,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment="v6 outbound from 380 tower" \
-    src-address=2606:1c80:1400::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc
index d07e559..b6c9f10 100644
--- a/mikrotik-tool/culleoka.rsc
+++ b/mikrotik-tool/culleoka.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:52 by RouterOS 7.21.4
+# 2026-05-14 09:37:53 by RouterOS 7.21.4
 # software id = HVP9-3G0K
 #
 # model = CCR1009-7G-1C-1S+
@@ -632,10 +632,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment="v6 outbound from culleoka customers" \
-    src-address=2606:1c80:1600::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 add advertise-dns=yes interface=mgmt other-configuration=yes
diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc
index f7d1784..6d4601a 100644
--- a/mikrotik-tool/edge.rsc
+++ b/mikrotik-tool/edge.rsc
@@ -1,4 +1,4 @@
-# may/14/2026 09:28:51 by RouterOS 6.49.18
+# may/14/2026 09:37:53 by RouterOS 6.49.18
 # software id = 8XZE-R7EJ
 #
 # model = CCR2004-1G-12S+2XS
diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc
index d3bc6d2..b9c6918 100644
--- a/mikrotik-tool/home.rsc
+++ b/mikrotik-tool/home.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:51 by RouterOS 7.22.3
+# 2026-05-14 09:37:53 by RouterOS 7.22.3
 # software id = ZGNY-ZJW7
 #
 # model = RB5009UG+S+
diff --git a/mikrotik-tool/ipv6.md b/mikrotik-tool/ipv6.md
index d386a91..e2e4a6b 100644
--- a/mikrotik-tool/ipv6.md
+++ b/mikrotik-tool/ipv6.md
@@ -303,12 +303,23 @@ add chain=input action=drop
 add chain=forward action=accept connection-state=established,related
 add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1   ;; PMTUD
 add chain=forward action=accept protocol=icmpv6
-add chain=forward action=accept src-address=2606:1c80::/32 \
-                                  dst-address=2606:1c80::/32
-add chain=forward action=accept in-interface-list=customer        ;; v6 outbound
+add chain=forward action=accept src-address=2606:1c80::/32        ;; v6 outbound + transit
 add chain=forward action=drop
 ```
 
+The `src-address=2606:1c80::/32` forward rule is **load-bearing and must
+match the whole /32, not a per-tower /44**. Traffic from one tower's
+customers transits other routers on the way to `edge`, so a router that
+only accepts its own `/44` blackholes every other tower's customers at
+its `default deny` (presents as "ICMPv6 pings work, TCP/HTTP doesn't" —
+the `accept protocol=icmpv6` rule lets echo through while forwarded TCP
+hits the drop). It also covers internal-to-internal, so no separate
+`src+dst=2606:1c80::/32` rule is needed. Do **not** use
+`in-interface-list=customer` — that list was never populated on the
+fleet and the rule silently matched nothing. Unsolicited inbound from
+the internet to customers still hits `default deny`; only
+`established,related` returns.
+
 Edge keeps its existing inbound BGP rules. Do **not** NAT v6 — every
 prefix is GUA from your /32.
 
@@ -530,8 +541,7 @@ add chain=input action=drop comment="default deny"
 add chain=forward action=accept connection-state=established,related
 add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
 add chain=forward action=accept protocol=icmpv6
-add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32
-add chain=forward action=accept in-interface-list=customer comment="v6 outbound"
+add chain=forward action=accept src-address=2606:1c80::/32 comment="v6 outbound (all vntx sources)"
 add chain=forward action=drop comment="default deny"
 
 # ---- OSPFv3 (router-id = v4 loopback)
diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc
index 92e6f94..59d72c5 100644
--- a/mikrotik-tool/lowry.rsc
+++ b/mikrotik-tool/lowry.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:52 by RouterOS 7.21.4
+# 2026-05-14 09:37:53 by RouterOS 7.21.4
 # software id = 2I9X-PQZP
 #
 # model = CCR1009-7G-1C-1S+
@@ -1303,10 +1303,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment="v6 outbound from lowry customers" \
-    src-address=2606:1c80:1900::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 add advertise-dns=yes interface=management other-configuration=yes
diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc
index 33ebac6..44218d0 100644
--- a/mikrotik-tool/newhope.rsc
+++ b/mikrotik-tool/newhope.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:52 by RouterOS 7.21.4
+# 2026-05-14 09:37:54 by RouterOS 7.21.4
 # software id = 5HTF-YFWV
 #
 # model = CCR1009-7G-1C-1S+
@@ -563,13 +563,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
-add action=accept chain=forward comment="v6 outbound from newhope customers" \
-    src-address=2606:1c80:1800::/44
-add action=accept chain=forward comment=\
-    "v6 outbound from lowry customers (transit)" src-address=\
-    2606:1c80:1900::/44
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 add advertise-dns=yes interface=bridge_cpe_mgmt other-configuration=yes
diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc
index 4c163cc..dbb7b2a 100644
--- a/mikrotik-tool/verona.rsc
+++ b/mikrotik-tool/verona.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:28:51 by RouterOS 7.21.4
+# 2026-05-14 09:37:53 by RouterOS 7.21.4
 # software id = Y1CT-1WB1
 #
 # model = CCR2004-16G-2S+
@@ -931,8 +931,8 @@ add action=drop chain=forward comment=invalid connection-state=invalid
 add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
     icmpv6
 add action=accept chain=forward comment=icmpv6 protocol=icmpv6
-add action=accept chain=forward comment=internal-to-internal dst-address=\
-    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment="v6 outbound (all vntx sources)" \
+    src-address=2606:1c80::/32
 add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes