I'm running a Mikrotik RB3011 with direct IPv4 behind an 2nd Generation Starlink (Standard), not unsing the Starlink Router.
With IPv6 everything runs ok. Advertisements internal, using clients to internet - full service.
Another older Starlink 1st Generation (round dish) get's IPv6 too, but the default gateway is broken - not reachable. Why?
Same with another 1st Generation (round dish) 100s kilometers away. IPv6 iss assigned, but given gateway is not reachable ...
What are your experiences with IPv6 Gateways? Is there any harwdare difference,
somethiong to change on the round dish (without starlink router)?
And futher question: can you connect directly from Starlink 2 Starlink via IPv6?
Starlink IPv6 Gateway broken ...
Last edited by SWISSSNOW on Thu Jun 22, 2023 8:34 am, edited 1 time in total.
Re: Starlink IPv6 Gateway broken ...
Yeah, I've never found IPv6 being stable with starlink. So I've avoid using it, and just use ZeroTier to connect starlink sites over the IPv4 CGNAT.
I think you always get an IPv6 address assigned, but the prefix delegation is where things go wrong. So it might be possible to route between two starlink networks using the single IPv6 address, but at that point a VPN might be easier/more reliable in case they change how IPv6 works.
At first I thought it was some locations didn't have IPv6 rolled out, but you may right that the starlink dish type also matters (circle vs rectangular vs HP/square)... The only time I've seen IPv6 work is on an older circle dish & the currently shipping rectangular ones I don't recall it ever working. Which is the opposite of what you're seen – but I haven't tested in a while since the starlink I use are all deployed (and remote) so messing with them isn't an option to test. But maybe starlink fixed something in IPv6 for current gen starlink router, but broke the original circle routers...
But I think you'll have to ask starlink...
I think you always get an IPv6 address assigned, but the prefix delegation is where things go wrong. So it might be possible to route between two starlink networks using the single IPv6 address, but at that point a VPN might be easier/more reliable in case they change how IPv6 works.
At first I thought it was some locations didn't have IPv6 rolled out, but you may right that the starlink dish type also matters (circle vs rectangular vs HP/square)... The only time I've seen IPv6 work is on an older circle dish & the currently shipping rectangular ones I don't recall it ever working. Which is the opposite of what you're seen – but I haven't tested in a while since the starlink I use are all deployed (and remote) so messing with them isn't an option to test. But maybe starlink fixed something in IPv6 for current gen starlink router, but broke the original circle routers...
But I think you'll have to ask starlink...
Re: Starlink IPv6 Gateway broken ...
Thanks for this report.
Yes, it's not really a Mikrotik thing here, but I tried to push the experiences from users with expert knowledge and experimental spirit.
If you use the actual Standard Dish it comes with the combination "Router-with-Power-Injection" so you have to split out the Ethernet with an extra adapter, both sides madly not CAT. Connecting there you get via DHCP-Client an IPv4 in the provider range 100.64.0.0/10 further on you get NAT in the Datacenter, where the ground station is connected regionaly. Dual Stack you can try IPv6-DHCP-Client you get an /56 range to split inside to local networks with /64 (or other below /56), clients in there can get an individual adress ... here it works fine at the moment: surfing to tcp/443 with valid AAAA runs and udp/sip to a telephone provider out- an incomming.
I asked for direct IPv6 connections because of unsupported ground routing or DHCP Services. I'm not shure where the logic is located für IPv6. The delegation /56 comes from the sat or ground station? What happens when ground is offline. Just thought about BCM situations you could go on with Starlink, if ground is broken, has no fiber ... and maybe it goes faster - did anyone test the "ultra fast connection" intercontinantal, that should come faster than fiber based?
Starlink on webpage (2023-06):
"(...)
Each Starlink is allocated one IPv4 address and delegated a /56 IPv6 prefix for network clients. All Starlink network clients are assigned an IPv6 address if the router is IPv6 is capable. IPv6 is not supported on the early generation router in the Circular Starlink Kit.
(...)"
Maybe this is why the IPv6 is broken, because they do not expect working IPv6 with those "Circular Starlink Kit" ?
Hope to get more reports using Starlink with Mikrotik.
Yes, it's not really a Mikrotik thing here, but I tried to push the experiences from users with expert knowledge and experimental spirit.
If you use the actual Standard Dish it comes with the combination "Router-with-Power-Injection" so you have to split out the Ethernet with an extra adapter, both sides madly not CAT. Connecting there you get via DHCP-Client an IPv4 in the provider range 100.64.0.0/10 further on you get NAT in the Datacenter, where the ground station is connected regionaly. Dual Stack you can try IPv6-DHCP-Client you get an /56 range to split inside to local networks with /64 (or other below /56), clients in there can get an individual adress ... here it works fine at the moment: surfing to tcp/443 with valid AAAA runs and udp/sip to a telephone provider out- an incomming.
I asked for direct IPv6 connections because of unsupported ground routing or DHCP Services. I'm not shure where the logic is located für IPv6. The delegation /56 comes from the sat or ground station? What happens when ground is offline. Just thought about BCM situations you could go on with Starlink, if ground is broken, has no fiber ... and maybe it goes faster - did anyone test the "ultra fast connection" intercontinantal, that should come faster than fiber based?
Starlink on webpage (2023-06):
"(...)
Each Starlink is allocated one IPv4 address and delegated a /56 IPv6 prefix for network clients. All Starlink network clients are assigned an IPv6 address if the router is IPv6 is capable. IPv6 is not supported on the early generation router in the Circular Starlink Kit.
(...)"
Maybe this is why the IPv6 is broken, because they do not expect working IPv6 with those "Circular Starlink Kit" ?
Hope to get more reports using Starlink with Mikrotik.
Re: Starlink IPv6 Gateway broken ...
I have exactly the same problem. First generation antenna, mikrotik (hp ac2) with DHCPv6-PD and gateway not working. But for months it worked without problem and I didn't change anything in the configuration. I noticed the problem two days ago. A user from Germany wrote about a similar problem on the Starlink Discord. In his case the problem was solved by restarting the router a day later. For me it hasn't helped so far.
-
-
psaintemarie
just joined
- Posts: 1
- Joined:
Re: Starlink IPv6 Gateway broken ...
Hi! Are you able to share the config to use with eh 2nd Gen Starling please?I'm running a Mikrotik RB3011 with direct IPv4 behind an 2nd Generation Starlink (Standard), not unsing the Starlink Router.
With IPv6 everything runs ok. Advertisements internal, using clients to internet - full service.
I'm getting the prefix, get ips assigned to the lan but I have no connectivity from the lan.
Thanks!
Re: Starlink IPv6 Gateway broken ...
Today I solved my problem.
I contacted Starlink support and they queried the captured DHCPv6 and RA messages. Everything was fine. So I looked deeper.
The problem was either my click-through or a change in the new version of RouterOS - in the IPv6 settings, "IPv6 forwarding" was enabled and at the same time "Accept Router Advertisements: yes if forwarding disabled" was selected. So my router ignored SLAAC and didn't get the address from the prefix the gateway router was in.
In short:
DHCPv6 Client will ask for a prefix and set the default route. This is how LAN clients get IPv6 addresses.
The router itself gets the address via SLAAC - in "IPv6 Settings" it must be set to accept Router Advertisements (=yes).
Last but not least, ICMPv6 and incoming UDP packets on ports 546-547 (DHCPv6) must be enabled on the IPv6 firewall.
I contacted Starlink support and they queried the captured DHCPv6 and RA messages. Everything was fine. So I looked deeper.
The problem was either my click-through or a change in the new version of RouterOS - in the IPv6 settings, "IPv6 forwarding" was enabled and at the same time "Accept Router Advertisements: yes if forwarding disabled" was selected. So my router ignored SLAAC and didn't get the address from the prefix the gateway router was in.
In short:
DHCPv6 Client will ask for a prefix and set the default route. This is how LAN clients get IPv6 addresses.
The router itself gets the address via SLAAC - in "IPv6 Settings" it must be set to accept Router Advertisements (=yes).
Last but not least, ICMPv6 and incoming UDP packets on ports 546-547 (DHCPv6) must be enabled on the IPv6 firewall.
Code: Select all
/ipv6 dhcp-client
add add-default-route=yes interface="ether1 - Starlink" pool-name=pool6 request=prefix use-interface-duid=yes use-peer-dns=yes
/ipv6 address
add address=::1 from-pool=pool6 interface=bridge
/ipv6 nd
set [ find default=yes ] advertise-dns=no advertise-mac-address=no disabled=yes hop-limit=64 mtu=1280 other-configuration=yes
add advertise-mac-address=no interface=bridge other-configuration=yes
/ipv6 nd prefix default
set preferred-lifetime=10m valid-lifetime=15m
/ipv6 settings
set accept-router-advertisements=yes max-neighbor-entries=8192
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment=DHCPv6 protocol=udp src-port=546-547
Re: Starlink IPv6 Gateway broken ...
I recommend enabling neighbor discovery on the WAN interface instead of the DHCPv6 default route hack:
This way RouterOS will add default route without the "add-default-route=yes" hack. The latter is problematic because upstream may relocate the DHCPv6 server to be off link.
Code: Select all
add advertise-dns=no interface=<WAN> ra-lifetime=none ra-preference=low reachable-time=5m
Re: Starlink IPv6 Gateway broken ...
I see. So I learned something new today. Thank you.The latter is problematic because upstream may relocate the DHCPv6 server to be off link.
(it works)
Re: Starlink IPv6 Gateway broken ...
This post has been invaluable to get ipv6 working with Starlink, but I found the option to use
add advertise-dns=no interface=<WAN> ra-lifetime=none ra-preference=low reachable-time=5m
instead of assigning it to each of my subnets or interfaces like I have below would only work for my lan and none of the other interfaces,
I was curious if there is any way I can use the setting Kentzo suggested in my multiple interface arrangement?
Here's whats working for me below
add advertise-dns=no interface=<WAN> ra-lifetime=none ra-preference=low reachable-time=5m
instead of assigning it to each of my subnets or interfaces like I have below would only work for my lan and none of the other interfaces,
I was curious if there is any way I can use the setting Kentzo suggested in my multiple interface arrangement?
Here's whats working for me below
Code: Select all
/ipv6 address
add address=::1 from-pool=pool6 interface=ether5
add address=::1 from-pool=pool6 interface=ether4
add address=::1 from-pool=pool6 interface=ether3
/ipv6 dhcp-client
add add-default-route=yes interface=internet pool-name=pool6 request=prefix use-interface-duid=yes
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment=DHCPv6 protocol=udp src-port=546-547
/ipv6 nd
set [ find default=yes ] advertise-dns=no advertise-mac-address=no disabled=yes hop-limit=64 managed-address-configuration=yes mtu=1280 other-configuration=yes ra-interval=3m20s-8m20s
add advertise-mac-address=no interface=ether5 other-configuration=yes
add advertise-mac-address=no interface=ether4 other-configuration=yes
add advertise-mac-address=no interface=ether3 other-configuration=yes
/ipv6 nd prefix default
set preferred-lifetime=10m valid-lifetime=15m
Last edited by Bcmalloy on Sun Jul 30, 2023 12:43 pm, edited 5 times in total.
Re: Starlink IPv6 Gateway broken ...
You need all three:
- DHCPv6 Client to obtain delegated prefix and, optionally, public IPv6 for the router
- non-advertising neighbor discovery on WAN so that RouterOS can learn default gateway (and, possibly, participate in other sense; this is not well documented by Mikrotik)
- address and advertising neighbor discovery on LAN so that hosts can use SLAAC
Re: Starlink IPv6 Gateway broken ...
Thanks I see, here is my full ipv6 starlink working config below using multiple subnets, really liking this routeros only been using for a few days, no faffing with vlans ect for subnets fantastic.
Code: Select all
/ipv6 address
add address=::1 from-pool=pool6 interface=ether5
add address=::1 from-pool=pool6 interface=ether4
add address=::1 from-pool=pool6 interface=ether3
/ipv6 dhcp-client
add add-default-route=no interface=internet pool-name=pool6 request=prefix use-interface-duid=yes
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment=DHCPv6 protocol=udp src-port=546-547
/ipv6 nd
set [ find default=yes ] advertise-dns=no advertise-mac-address=no disabled=yes hop-limit=64 managed-address-configuration=yes mtu=1280 \
other-configuration=yes ra-interval=3m20s-8m20s
add advertise-mac-address=no interface=ether5 other-configuration=yes
add advertise-mac-address=no interface=ether4 other-configuration=yes
add advertise-mac-address=no interface=ether3 other-configuration=yes
add advertise-dns=no interface=internet ra-lifetime=none ra-preference=low reachable-time=5m
/ipv6 nd prefix default
set preferred-lifetime=10m valid-lifetime=15m
Last edited by Bcmalloy on Mon Jul 31, 2023 9:04 am, edited 3 times in total.
Re: Starlink IPv6 Gateway broken ...
Ideally you want "add-default-route=yes" -> "add add-default-route=no".
Re: Starlink IPv6 Gateway broken ...
Thanks, updated the above post to reflect this and tested and verified it's good, always like to use best practice where possible.
Re: Starlink IPv6 Gateway broken ...
I had Starlink global IPv6 working fine in Mikrotik (RB5009) for many months. Yesterday it stopped working and here is the change:
Instead of Starlink sending me a global address of 2605:xxxx:15xx:xxxx:xxxx:xxxx:xxxx:1 I know am receiving a global address of 2605:same:18xx:diff:slaac looking for last 64:/64...
My prefix designation received from Starlink has stayed the same as 2605:xxxx:15yy:yy::/56....
Is the problem that the global address is now outside of the range of the prefix delegation I am still receiving?
Happy to send the configuration, but I changed nothing - just the global address that Starlink is sending (or Mikrotik is picking up)....
Instead of Starlink sending me a global address of 2605:xxxx:15xx:xxxx:xxxx:xxxx:xxxx:1 I know am receiving a global address of 2605:same:18xx:diff:slaac looking for last 64:/64...
My prefix designation received from Starlink has stayed the same as 2605:xxxx:15yy:yy::/56....
Is the problem that the global address is now outside of the range of the prefix delegation I am still receiving?
Happy to send the configuration, but I changed nothing - just the global address that Starlink is sending (or Mikrotik is picking up)....
Re: Starlink IPv6 Gateway broken ...
It's normal and preferred for your WAN interface to receive an IPv6 address that is not part of the PD. Overlapping them is possible, but AFAIK, is an edge case. See RFC 6603 Prefix Exclude Option for DHCPv6-based Prefix Delegation.
Since your router receives an IPv6, can it ping its next hop and/or hosts on the internet? Please describe in more detail what's not working.
Since your router receives an IPv6, can it ping its next hop and/or hosts on the internet? Please describe in more detail what's not working.
Re: Starlink IPv6 Gateway broken ...
Thanks for the response. I was able to fix my problem - my firewall rule to accept prefix delegation needed to be updated for the new global address received from Starlink.