IPv6 is now common on many home and small‑business connections, but the configuration on RouterOS can be confusing. This guide shows MikroTik IPv6 setup for home Internet step by step so you can get stable dual‑stack, IPv4 and IPv6, with proper prefix delegation, LAN addressing, firewall rules, and DNS behavior.

By the end, your clients will get global IPv6 addresses, the router will have a safe IPv6 firewall, and DNS will work as expected.

What You Need Before Starting MikroTik IPv6 Setup

Before doing any MikroTik IPv6 setup for home Internet, you must check these points:

• Your ISP really supports IPv6 and gives you a prefix, for example, /56 or /64, via DHCPv6‑PD.
• Your MikroTik runs RouterOS v7 with the IPv6 package enabled by default.
• You already have a working IPv4 setup with a WAN interface, for example, ether1 or pppoe-out1, and a LAN bridge, such as bridge.

Note: If your ISP uses PPPoE, you will run the DHCPv6 client on the PPPoE interface, not on the physical port.

Now you can proceed to the following steps to start MikroTik IPv6 setup for home Internet.

Step 1. Enable IPv6 and Basic Tools

This step prepares the router for MikroTik IPv6 setup for home Internet and makes sure the IPv6 menu is visible.

You must log in to your router using WinBox, WebFig, or SSH.

Then, you must navigate to the:

System → Packages

And confirm that IPv6 is present and enabled. On RouterOS v7, it is enabled by default. If you changed the default configuration in the past, you must verify that IPv6 appears in the left menu.

Note: You do not need to add any IPv6 address yet; that will come from the ISP prefix in the next step.

Step 2. Get an IPv6 Prefix from ISP with DHCPv6‑PD

In most home cases, MikroTik IPv6 setup for home Internet starts with a DHCPv6 client on the WAN, which receives a delegated prefix from your ISP.

Open IPv6 → DHCP Client and click + to add a new client:

• Interface: your WAN, for example, ether1 or pppoe-out1.
• Request: select prefix.
• Pool Name: type a name such as ipv6-delegation.
• Pool Prefix Length: usually 56 or 60; if you are not sure, you can leave it empty, and RouterOS will use what the ISP sends.
• Add Default Route: check this so the router adds an IPv6 default route.

Once you are done, click Apply and OK.

When it works, you should see the DHCPv6 client status as bound and a dynamic pool under IPv6 → Pools with your delegated prefix, for example:

2001:db8:1234::/56

If this does not show up, contact your ISP and confirm that IPv6 and prefix delegation are enabled on your line.

Step 3. Assign IPv6 Addresses to LAN

Now you can use the delegated pool to give the LAN bridge a global IPv6 address and to advertise a /64 to clients. This is the core of MikroTik IPv6 setup for home Internet and internal network.

Go to IPv6 → Addresses and click + and set these:

• From Pool: choose the ipv6-delegation, or the name you used.
• Interface: your LAN bridge, for example, bridge.
• Advertise: check yes so that RouterOS will advertise this prefix on the LAN.

Then, click Apply and OK.

RouterOS will automatically create a /64 on the bridge and use Neighbor Discovery (ND) to let clients configure their own addresses using SLAAC. Each device will receive a global unicast IPv6 address and keep private addresses for IPv4 at the same time.

Step 4. Configure IPv6 Neighbor Discovery on the LAN

Neighbor Discovery (ND) is how clients learn IPv6 gateway and prefix information. Tuning ND is an important part of a correct MikroTik IPv6 setup for home Internet, so that all devices get a stable address.

Open IPv6 → ND, if you see a single default entry, you can:

• Keep it and set interface=bridge, or
• Create a new ND entry for your bridge.

For a simple home LAN:

• Interface: bridge.
• RA Interval: keep default or use something like 20s–60s.
• Managed address configuration: usually no for SLAAC only.
• Other configuration: yes if you plan to use DHCPv6 for extra options like DNS.

After this, your clients should start showing global IPv6 addresses and a default gateway in their network status.

Step 5. Build a Safe IPv6 Firewall for Home Use

There is no NAT in IPv6, so a firewall is mandatory in any MikroTik IPv6 setup for home Internet. The idea is:

• Allow established and related connections.
• Allow essential ICMPv6, needed for path MTU, Neighbor Discovery, and more.
• Allow DHCPv6 client traffic from the ISP.
• Drop everything else coming from the outside to the router and the LAN.

Here is a simple rule set you can enter under IPv6 → Firewall → Filter. The order matters:

1. Accept established and related traffic:

Chain: input
Connection state: established,related
Action: accept

2. Accept ICMPv6 to the router:

Chain: input
Protocol: icmpv6
Action: accept

3. Accept DHCPv6 client traffic on WAN:

Chain: input
Protocol: udp
Dst. Port: 546
Src. Address: fe80::/10
In. Interface: your WAN
Action: accept

4. Drop everything else to the router:

Chain: input
Action: drop

For forwarding, traffic passing through the router between the WAN and the LAN:

1. Accept established and related:

Chain: forward
Connection state: established,related
Action: accept

2. Drop invalid:

Chain: forward
Connection state: invalid
Action: drop

3. Accept LAN to WAN:

Chain: forward
In. Interface: bridge
Action: accept

4. Drop all remaining:

Chain: forward
Action: drop

This is a basic but strong IPv6 firewall that blocks unsolicited incoming connections while allowing your devices to browse and use IPv6 services. For more advanced rules and best practices, you can check the Essential MikroTik Firewall Rules.

Step 6. Set up IPv6 DNS Behavior

DNS is often the reason that some pages work and others fail after MikroTik IPv6 setup for home Internet. There are two parts:

• Upstream DNS servers that the router uses.
• How clients learn which DNS server to use.

Configure upstream IPv6 DNS servers

Under IP → DNS (yes, the IPv4 menu), RouterOS can store IPv4 and IPv6 DNS resolvers.

Enter your ISP’s DNS servers if they support IPv6. If the ISP does not provide IPv6 DNS, you can use public ones such as Google’s:

2001:4860:4860::8888
2001:4860:4860::8844

Make sure Allow Remote Requests is enabled if you want the router to act as a caching DNS server for your LAN.

Advertise the Router as DNS over IPv6

By default, MikroTik ND may advertise upstream DNS directly to clients, which bypasses your router’s cache. For home networks, it is usually better to advertise the router itself as DNS.

On RouterOS v7, you can set this under IPv6 → ND. For your bridge interface ND entry, set:

• Advertise DNS: yes.
• DNS: a stable IPv6 on the router, such as the global address on bridge or a ULA address like fd00::1.

If you use ULA for DNS, add it in IPv6 → Addresses on the bridge with advertise=no so it is used only for DNS, not for global routing.

Advanced readers who want encrypted DNS can follow the MikroTik DNS‑over‑HTTPS guide.

Step 7. Test IPv6 Connectivity

Once you finish the main MikroTik IPv6 setup for home Internet, always test from both the router and a client.

From the router:

• Use ping with an IPv6 address, for example, ping ipv6.google.com or a known IPv6 address like 2001:4860:4860::8888.
• Check that the default IPv6 route (::/0) points to your ISP’s gateway under IPv6 → Routes.

From a client, such as a PC or phone, check the network adapter details. You should see:

• A global IPv6 address from your ISP prefix.
• A link‑local address starting with fe80::.
• A default gateway with an IPv6 address from the router.

Visit a test site, such as an IPv6‑only checker, to confirm you have working IPv6. If IPv4 and IPv6 both work, you now have a basic dual‑stack network.

Troubleshooting Common IPv6 Problems on MikroTik

Even with a correct MikroTik IPv6 setup for home Internet, some sites may be slow or broken. Here are common issues and quick checks:

1. Some websites open, others fail or hang

The possible causes of this issue include:

• Broken path MTU discovery because ICMPv6 is blocked.
• DNS is returning IPv6 records, but routing is broken.

What to check:

• Confirm your firewall allows ICMPv6 in both input and forward chains, not just ping.
• Ping a known IPv6 host from the router and from a client.
• Temporarily disable IPv6 on the client and see if the site works over IPv4. If yes, the issue is only with IPv6 routing or DNS.

2. Clients have IPv6 addresses but no Internet

The possible causes can be no default IPv6 route or a DHCPv6‑PD not bound. Check:

• Look at IPv6 → Routes and check that a dynamic ::/0 route exists via the WAN.
• Verify the DHCPv6 client is bound and that IPv6 → Pools shows a delegated prefix.
• Ensure your forward chain firewall allows LAN to WAN forwarding.

3. Only some VLANs or subnets get IPv6

If you have multiple VLANs, you must assign a separate /64 from the pool to each bridge or VLAN interface and create ND entries for them. The rules are the same as for the main LAN, but you slice your delegated prefix into multiple /64 blocks.

Extend MikroTik IPv6 Setup for Home Internet

Once the basic MikroTik IPv6 setup for home Internet is working, you can extend it with:

• Advanced IPv6 firewall groups and address lists for better security.
• Encrypted DNS (DNS over HTTPS) on the router with IPv4 and IPv6.
• Multiple IPv6‑enabled VLANs for guest, IoT, and home office segments.

At this stage, it also makes sense to look at hosted services, VPN endpoints, or public‑facing servers that are fully IPv6‑ready so your network can reach modern content and services reliably.

Conclusion

A correct MikroTik IPv6 setup for home Internet is more than just turning on a checkbox in RouterOS. You need a working DHCPv6‑PD client on the WAN, clean LAN addressing with SLAAC, a safe stateful firewall, and clear DNS behavior so clients always resolve sites through a stable resolver.

We hope you enjoy this guide. You can easily extend your IPv6‑ready network with reliable services and public routing options from PerLod so you can host and access modern apps across both IPv4 and IPv6 without surprises.

FAQs