Chapter 4 of 6 · MikroTik MTCIPv6E
IPv6 Security
ICMPv6 and ND messages, MLD, temporary addresses, the IPv6 firewall on RouterOS and IPsec protection.
- 4topics
- 20 minfast track
- 2diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1ICMPv6 and Neighbor Discovery MessagesLearn the ICMPv6 message types, the five Neighbor Discovery messages and options, the hop limit check, and the main ND attacks…5 min
- 2MLD and Temporary AddressesLearn how Multicast Listener Discovery manages IPv6 multicast groups, how MLDv1 and MLDv2 differ, and why temporary addresses…5 min
- 3IPv6 Firewall on RouterOSLearn how the RouterOS IPv6 firewall works, including filter chains, connection states, ICMPv6 and DHCPv6 rules, address lists…Diagram5 min
- 4IPsec with IPv6Learn how IPsec protects IPv6 traffic with AH and ESP, transport and tunnel mode, IKE negotiation, and how RouterOS sets up…Diagram5 min
About this chapter
What this chapter covers
This chapter explains how IPv6 control traffic works, how it can be abused, and how to protect a network.
It covers the ICMPv6 messages that IPv6 depends on, the group management protocol MLD, and the privacy feature called temporary addresses. It then shows how to build a firewall for IPv6 and how to protect traffic with IPsec.
The theme is simple. IPv6 gives every host a global address, so the protection you add on the router matters more than it did behind IPv4 NAT.
How the topics fit together
The first pages describe what happens on a link, and the last pages describe how to defend it.
The first page covers ICMPv6 and the Neighbor Discovery messages. You learn the message types, why a hop limit of 255 matters, and which attacks exist on a shared link.
The second page covers MLD and temporary addresses. MLD is carried inside ICMPv6, so it connects directly to the first page. Temporary addresses explain why client addresses change and why rules should match prefixes.
The third page covers the IPv6 firewall. It builds on everything before it, because the ruleset must allow the ICMPv6, MLD and DHCPv6 traffic that IPv6 needs.
The fourth page covers IPsec. It shows how to protect traffic between sites with ESP, and how the firewall must allow the key exchange.
A careless rule that drops all ICMPv6 is the most common way to break an IPv6 network. Keep that in mind on every page of this chapter.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Learn the ICMPv6 type numbers first, because they appear in the firewall and in packet captures. Then read the baseline firewall ruleset line by line until you can explain why each rule is there.
If you can, build a small lab with two routers and test the firewall from a host outside the LAN. Watching a connection get dropped, and then allowed, teaches more than reading about it.
Ready for more practice?
The full MikroTik MTCIPv6E question bank has 486 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.