MLD and Temporary Addresses

What it is

MLD tells routers which multicast groups have listeners, and temporary addresses stop hosts being tracked by a fixed address.

These two topics are unrelated in function, but both are part of how IPv6 hosts behave on a link. MLD is the IPv6 counterpart of IGMP. Temporary addresses are a privacy feature of SLAAC.

Both are visible to a firewall, and both can be misused or misunderstood.

How it works

MLD is carried in ICMPv6, and temporary addresses are generated by the host itself.

Multicast Listener Discovery

IPv6 has no broadcast, so even basic services use multicast groups. A host joins a group, and a router must forward matching traffic to that link. The router learns about listeners through MLD.

MLD messages are ICMPv6 messages. They are sent from link local addresses, and they carry a hop limit of 1 so that they never leave the link.

MLDv1 reports are sent to the group address being reported. MLDv2 reports go to the group ff02::16, which all MLDv2 capable routers listen on. MLDv2 can also state which sources a host wants, so it supports source specific multicast.

A router sends a General Query to ff02::1 to ask which groups are in use. A Multicast Address Specific Query asks about one group only. A host that leaves a group sends a Done message in MLDv1, and the router then queries that group to see if any listener is left.

Every IPv6 host also joins its solicited node group for each address. That is why MLD reports appear on a quiet network. They are normal and are not a sign of a fault.

MLD and the bridge

A switch or bridge floods multicast to all ports unless it listens to MLD. This listening is called snooping. A bridge that snoops sends multicast only to ports with listeners.

RouterOS bridges have multicast snooping settings in the bridge. The IGMP snooping setting is long established, but support for MLD snooping depends on the RouterOS version and release, so check yours.

Snooping needs a querier on the link. If no device sends queries, listener state times out and traffic may stop.

Firewall and MLD

MLD uses ICMPv6, so a rule that blocks ICMPv6 also blocks MLD. If you restrict ICMPv6 by type, allow the MLD types on the link local scope.

/ipv6 firewall filter add chain=input protocol=icmpv6 src-address=fe80::/10 action=accept comment="ND and MLD from link local"

Temporary addresses

An address built with EUI-64 contains the MAC address. The same interface ID follows the device to every network it joins, so outsiders can recognise it. This is a privacy problem.

Temporary addresses solve it. The host builds a random interface ID instead, and uses it for outgoing connections. The prefix still comes from the router by SLAAC.

A host usually has two global addresses at once:

• A stable address that is kept for incoming connections.
• One or more temporary addresses used for outgoing connections.

A temporary address has a short lifetime. When it expires, the host generates a new one, and old connections finish on the old address.

Each address has a preferred lifetime and a valid lifetime.

A preferred address can start new connections. A deprecated address, past its preferred lifetime, is only used for existing connections. After the valid lifetime, the address is removed.

Another privacy approach is a stable but opaque interface ID. It is derived from the prefix and a secret, so it is fixed in one network and different in another. Many modern systems use it instead of EUI-64.

What this means on RouterOS

Temporary addresses are made by the client operating system, not by the router. RouterOS advertises the prefix with /ipv6 nd prefix, and the lifetimes in that entry limit how long clients keep the addresses.

Because client addresses change, do not write firewall rules or address lists that depend on one client address. Match on the prefix or the interface instead.

/ipv6 firewall filter add chain=forward src-address=2001:db8:1::/64 out-interface-list=WAN action=accept