From e60ab3ebfbd6969e7189f11b16d395472b51deec Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sat, 9 May 2026 13:03:30 -0500 Subject: [PATCH] routers update --- mikrotik-tool/494.rsc | 2 +- mikrotik-tool/982.rsc | 2 +- mikrotik-tool/climax.rsc | 2 +- mikrotik-tool/core.rsc | 2 +- mikrotik-tool/culleoka.rsc | 2 +- mikrotik-tool/edge.rsc | 2 +- mikrotik-tool/home-v6-apply.rsc | 116 ++++++++++++++++++-------------- mikrotik-tool/home.rsc | 27 ++++---- mikrotik-tool/lowry.rsc | 2 +- mikrotik-tool/newhope.rsc | 2 +- mikrotik-tool/verona.rsc | 14 ++-- 11 files changed, 97 insertions(+), 76 deletions(-) diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index 0ac36d6..ba0f3f2 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:51 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 2ff060e..297f1e0 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:51 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index 7474a23..2faae67 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:51 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 7fcd77e..8fb1253 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:47 by RouterOS 7.21.4 +# 2026-05-09 13:02:52 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index 47cc216..e61b837 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:52 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index 8841216..d337992 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/09/2026 12:34:46 by RouterOS 6.49.18 +# may/09/2026 13:02:52 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS diff --git a/mikrotik-tool/home-v6-apply.rsc b/mikrotik-tool/home-v6-apply.rsc index db90c3e..5745c4a 100644 --- a/mikrotik-tool/home-v6-apply.rsc +++ b/mikrotik-tool/home-v6-apply.rsc @@ -2,20 +2,20 @@ # graham's home router — IPv6 apply (RB5009UG+S+, ROS 7.22.3) # ============================================================================= # -# This is graham's home — connects to verona via ether5-vntx-static carrying -# 204.110.191.0/27 (home .1, verona .30). Multi-WAN: TMO primary, VNTX -# secondary, Starlink last-resort. v6 transit goes via VNTX (only v6-aware -# upstream). +# This is graham's home — multi-WAN: TMHI primary, VNTX secondary, Starlink +# last-resort. v6 source is T-Mobile Home Internet's gateway via DHCPv6-PD +# on ether6-tmobile. Switched off the verona-PD path on 2026-05-09 because +# TWC isn't accepting our 2606:1c80::/32 yet (separate ticket); TMHI gives +# us a globally-reachable v6 prefix today, even if it rotates. # -# Treated like a regular WISP customer: DHCPv6-PD from verona's customer -# pool. Verona delegates a /56 from `verona-cust-pd-1` (2606:1c80:1001::/48). -# Whatever /56 verona hands us is then split into two /64s for our internal -# LANs: +# Whatever TMHI delegates (typically /64 on residential, sometimes /60 on +# the newer gateways) populates the local `home-pd` pool. Internal LANs +# pull /64s from it: # * bridge — main home LAN (10.0.16/24, 10.0.19/22) # * ether3-servers — servers LAN (10.0.15.254/21) -# Both addresses are derived from the local pool `home-pd` populated by the -# DHCPv6 client when the /56 is delegated. If verona reboots and the pool -# happens to give a different /56 next time, both LANs renumber together. +# If TMHI only delegates a single /64, only `bridge` gets v6; the second +# `from-pool=` add will error harmlessly. If they hand out a /60 or /56, +# both LANs come up. # ============================================================================= # ----------------------------------------------------------------------------- @@ -34,49 +34,69 @@ # ----------------------------------------------------------------------------- # APPLY — settings # ----------------------------------------------------------------------------- -# Forward must stay on; do NOT accept RAs as a router would. The dhcp-client -# below enables `add-default-route=yes` to install ::/0 from the server's -# advertisements specifically, separate from the global accept-RA toggle. -/ipv6 settings set forward=yes accept-router-advertisements=no +# Forward stays on (we're a router). accept-router-advertisements=yes is +# REQUIRED on this router because TMHI only provides v6 via SLAAC — no +# DHCPv6 server, no PD downstream. Without this we wouldn't even get a +# global v6 address on ether6-tmobile. RAs we send on bridge/ether3-servers +# are not received by ourselves so this is safe to leave global. +/ipv6 settings set forward=yes accept-router-advertisements=yes # ----------------------------------------------------------------------------- -# APPLY — DHCPv6 client (request prefix delegation from verona) +# APPLY — DHCPv6 client (request prefix delegation from TMHI gateway) # ----------------------------------------------------------------------------- -# Treats us as a wired customer: request=prefix asks for a /56, pool-name -# stores the delegation in a local pool we then assign /64s out of. -# add-default-route=yes installs ::/0 via verona's link-local on receipt. +# request=address,prefix asks for both an IA_NA address on the WAN and a +# delegated prefix (IA_PD) for downstream LANs. pool-name stores the PD in +# a local pool we then carve /64s out of. add-default-route=yes installs +# ::/0 via TMHI's gateway link-local on receipt. Distance 1 matches the v4 +# default priority for TMHI. +# Disabled — TMHI Sagemcom 5688W gateway runs no DHCPv6 server, only +# SLAAC. Verified 2026-05-09: client stays in status=searching... forever +# even with prefix-hint=::/56. The ROUTER itself gets v6 from RAs (above). +# Internal LANs can't get native PD from TMHI. To get v6 on internal LANs +# while routing via TMHI: add NAT66 with a ULA prefix (see notes in +# CLAUDE.md / memory). Kept here disabled so we remember the attempt. /ipv6 dhcp-client -add interface=ether5-vntx-static request=prefix pool-name=home-pd pool-prefix-length=64 \ +add interface=ether6-tmobile request=address,prefix pool-name=home-pd pool-prefix-length=64 \ + add-default-route=yes default-route-distance=1 \ + use-peer-dns=yes disabled=yes \ + comment="DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)" + +# Disabled fallback — re-enable manually if TMHI v6 dies and verona is up +# AND TWC has accepted our 2606:1c80::/32 (separate ticket). +add interface=ether5-vntx-static request=prefix pool-name=home-pd-vntx pool-prefix-length=64 \ add-default-route=yes default-route-distance=2 \ - use-peer-dns=yes \ - comment="DHCPv6-PD from verona on the wired customer link" + use-peer-dns=yes disabled=yes \ + comment="DHCPv6-PD from verona (disabled, fallback)" # ----------------------------------------------------------------------------- -# APPLY — internal LAN addresses pulled from the delegated /56 +# APPLY — internal LAN addresses # ----------------------------------------------------------------------------- -# from-pool=home-pd grabs a /64 from the delegation; the `address=::1` part -# fills the host bits, so each LAN ends up at ::1. -# bridge gets ::1/64; ether3-servers gets the next /64 at -# ::1/64 — pool allocation is sequential, so /64s in the same /56 -# stay contiguous. -/ipv6 address -add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN" -add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN" +# Currently no internal v6 — TMHI doesn't delegate a prefix and the verona +# path is held until TWC accepts our /32. When PD is restored, re-enable +# whichever dhcp-client is appropriate above and uncomment these: +# +# /ipv6 address +# add address=::1 from-pool=home-pd interface=bridge advertise=yes comment="home main LAN" +# add address=::1 from-pool=home-pd interface=ether3-servers advertise=yes comment="home servers LAN" # ----------------------------------------------------------------------------- # APPLY — neighbour discovery on internal LANs (SLAAC + RDNSS for clients) # ----------------------------------------------------------------------------- -/ipv6 nd -add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes -add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes - -# Stateless DHCPv6 for DNS option (clients still get addresses from SLAAC) -/ipv6 dhcp-server -add interface=bridge name=home-bridge-stateless address-pool=static-only -add interface=ether3-servers name=home-servers-stateless address-pool=static-only - -/ipv6 dhcp-server option -add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" +# Skipped while no internal v6 prefix exists — RAs without a global prefix +# would just announce the router as a default gateway with no on-link +# prefix, which doesn't help clients. Re-enable along with the address +# block above when PD is back. +# +# /ipv6 nd +# add interface=bridge ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes +# add interface=ether3-servers ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes +# +# /ipv6 dhcp-server +# add interface=bridge name=home-bridge-stateless address-pool=static-only +# add interface=ether3-servers name=home-servers-stateless address-pool=static-only +# +# /ipv6 dhcp-server option +# add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'" # ----------------------------------------------------------------------------- # APPLY — firewall (mirror v4 hygiene; deny by default on input) @@ -102,10 +122,8 @@ add chain=forward action=drop # ----------------------------------------------------------------------------- # VERIFY (after apply) # ----------------------------------------------------------------------------- -# /ipv6 dhcp-client print ;; should show status=bound and a /56 prefix -# /ipv6 pool print ;; should show home-pd populated -# /ipv6 address print ;; bridge + ether3-servers each have ::1/64 -# /ipv6 route print where active ;; ::/0 via fe80::xxxx of verona -# /ping 2606:1c80:0:10::101 count=3 ;; verona loopback -# /ping 2606:1c80:0:10::253 count=3 ;; core loopback -# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (works once TWC v6 is solved) +# /ipv6 dhcp-client print ;; should show status=bound on ether6-tmobile +# /ipv6 pool print ;; should show home-pd populated (whatever TMHI delegated) +# /ipv6 address print ;; bridge gets ::1/64; servers gets one too if TMHI gave /60+ +# /ipv6 route print where active ;; ::/0 via fe80::xxxx of TMHI gateway +# /ping 2606:4700:4700::1111 count=3 ;; cloudflare — should work once dhcp-client is bound diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc index 8370d6f..33f521d 100644 --- a/mikrotik-tool/home.rsc +++ b/mikrotik-tool/home.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.22.3 +# 2026-05-09 13:02:51 by RouterOS 7.22.3 # software id = ZGNY-ZJW7 # # model = RB5009UG+S+ @@ -99,6 +99,9 @@ add bridge=bridge comment=defconf ingress-filtering=no interface=\ add bridge=bridge comment=defconf ingress-filtering=no interface=sfp-sfpplus1 \ internal-path-cost=10 path-cost=10 add bridge=dockers interface=veth1 +/ipv6 settings +# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings +set accept-router-advertisements=yes /interface detect-internet set detect-interface-list=all internet-interface-list=all lan-interface-list=\ LAN wan-interface-list=WAN @@ -440,8 +443,6 @@ add check-gateway=ping comment="VNTX probe pin" distance=1 dst-address=\ 4.2.2.2/32 gateway=204.110.191.30%ether5-vntx-static scope=10 add check-gateway=ping comment="Starlink probe pin" distance=1 dst-address=\ 4.2.2.3/32 gateway=192.168.1.1%ether7-starlink scope=10 -/ipv6 route -add distance=1 dst-address=2000::/3 gateway=2001:470:1f0e:299::1 /ip service set ftp disabled=yes set telnet disabled=yes @@ -457,17 +458,19 @@ add disabled=yes interface=ether6-tmobile type=external add interface=*14 type=external add interface=bridge type=internal /ipv6 address -# address pool error: pool not found: home-pd (4) -add address=::1 comment="home main LAN" from-pool=home-pd interface=bridge -# address pool error: pool not found: home-pd (4) -add address=::1:0:0:0:1 comment="home servers LAN" from-pool=home-pd \ +add address=::1 comment="home main LAN" disabled=yes from-pool=home-pd \ + interface=bridge +add address=::1 comment="home servers LAN" disabled=yes from-pool=home-pd \ interface=ether3-servers /ipv6 dhcp-client -add interface=ether7-starlink pool-name=starlink pool-prefix-length=64 \ - request=address,prefix -add add-default-route=yes comment="DHCPv6-PD from verona" \ - default-route-distance=2 disabled=yes interface=ether5-vntx-static \ - pool-name=home-pd pool-prefix-length=64 request=prefix +add add-default-route=yes comment=\ + "DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)" \ + disabled=yes interface=ether6-tmobile pool-name=home-pd \ + pool-prefix-length=64 prefix-hint=::/56 request=address,prefix +add add-default-route=yes comment=\ + "DHCPv6-PD from verona (disabled, fallback)" default-route-distance=2 \ + disabled=yes interface=ether5-vntx-static pool-name=home-pd-vntx \ + pool-prefix-length=64 request=prefix /ipv6 dhcp-server add interface=bridge name=home-bridge-stateless add interface=ether3-servers name=home-servers-stateless diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index d311239..15430f1 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:52 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc index d1ca013..2bebc96 100644 --- a/mikrotik-tool/newhope.rsc +++ b/mikrotik-tool/newhope.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:52 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc index eded02e..863ee26 100644 --- a/mikrotik-tool/verona.rsc +++ b/mikrotik-tool/verona.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 12:34:46 by RouterOS 7.21.4 +# 2026-05-09 13:02:51 by RouterOS 7.21.4 # software id = Y1CT-1WB1 # # model = CCR2004-16G-2S+ @@ -174,12 +174,6 @@ add address-pool=verona-cgnat addresses-per-mac=unlimited interface=verona \ name=hotspot1 profile=hsprof1 /ip smb users set [ find default=yes ] disabled=yes -/ipv6 dhcp-server -add address-pool=verona-cust-pd-1 interface=verona name=verona-cust-pd-server -add address-pool=altoga-cust-pd-1 interface=ether6-switch name=\ - altoga-cust-pd-server -add interface=vlan9_sfpplus1 name=verona-wired-pd prefix-pool=\ - verona-cust-pd-1 /ipv6 dhcp-server option add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" /ipv6 pool @@ -935,6 +929,12 @@ add address=2606:1c80:1500::1 comment="altoga mgmt LAN" interface=\ ether6-switch add address=2606:1c80:0:30::1 advertise=no comment="P2P verona<->graham home" \ interface=vlan9_sfpplus1 +/ipv6 dhcp-server +add address-pool=verona-cust-pd-1 interface=verona name=verona-cust-pd-server +add address-pool=altoga-cust-pd-1 interface=ether6-switch name=\ + altoga-cust-pd-server +add interface=vlan9_sfpplus1 name=verona-wired-pd prefix-pool=\ + verona-cust-pd-1 /ipv6 firewall filter add action=accept chain=input comment=established connection-state=\ established,related