Transition Mechanisms · Topic 1 of 2
Dual Stack on RouterOS
Learn how dual stack runs IPv4 and IPv6 side by side on a RouterOS device, how DNS and address choice work, and what to configure and secure twice.
- 5 min
- Dual stack runs IPv4 and IPv6 together on the same interfaces.
- It needs no translation or tunnel, and it is the preferred transition method.
- Addresses, routes, firewall and pools are configured separately for each stack.
What it is
Dual stack means a device runs IPv4 and IPv6 at the same time on the same interfaces.
It is the simplest and most common way to move to IPv6. Nothing is translated or wrapped. Each host and router speaks both protocols, and each conversation uses whichever protocol suits it.
Existing IPv4 services keep working during the move. IPv6 is added next to them, and IPv4 is removed only when it is no longer needed.
How it works
Each stack is independent, so everything you configure for IPv4 needs an IPv6 twin.
Two sets of configuration
On RouterOS the two protocols have separate menus.
| Item | IPv4 | IPv6 |
|---|---|---|
| Addresses | /ip address | /ipv6 address |
| Routes | /ip route | /ipv6 route |
| Firewall | /ip firewall | /ipv6 firewall |
| Pools | /ip pool | /ipv6 pool |
| DHCP server | /ip dhcp-server | /ipv6 dhcp-server |
| Neighbour table | /ip arp | /ipv6 neighbor |
A change in one menu has no effect on the other. A router can have a perfect IPv4 setup and a broken IPv6 one, or the reverse.
On RouterOS v6 the ipv6 package must be installed and enabled before the IPv6 menus work. In RouterOS v7 IPv6 is part of the main package.
A dual stack interface
/ip address add address=192.168.88.1/24 interface=bridge-lan
/ipv6 address add address=2001:db8:1::1/64 interface=bridge-lan advertise=yes
/ip dhcp-server add name=lan interface=bridge-lan address-pool=lan-poolThe IPv4 clients use DHCP. The IPv6 clients build their own addresses from the advertised prefix. A client ends up with both an IPv4 and an IPv6 address.
Which protocol does a host use?
A client asks DNS for both A and AAAA records. An A record holds an IPv4 address. An AAAA record holds an IPv6 address.
If the name has both, the host chooses. Most systems prefer IPv6 when they have a working global IPv6 address. A technique called Happy Eyeballs tries both and uses whichever connects first, so a broken IPv6 path does not cause long delays.
The DNS server can run on IPv4 and still return AAAA records. RouterOS can serve both kinds of answer from one DNS service, which is covered under the version agnostic services topic.
Keeping both stacks secure
Every IPv4 rule needs an IPv6 rule where the same protection is wanted. The /ip firewall rules do not cover IPv6. NAT does not hide IPv6 hosts, so the IPv6 filter rules carry all of the protection.
/ip firewall filter add chain=input connection-state=established,related action=accept
/ipv6 firewall filter add chain=input connection-state=established,related action=acceptThe same rule appears in both firewalls. Treat the two rule sets as one security policy that you maintain twice.
Advantages and drawbacks
| Advantage | Drawback |
|---|---|
| No translation, so no extra devices | Needs IPv4 addresses for as long as IPv4 runs |
| Native speed and full features | Two configurations and two firewalls to maintain |
| Easy to roll back, since IPv4 stays | Faults can hide when one stack works and the other fails |
| Clients choose the best path | Needs dual stack support in servers and services |
Dual stack does not remove the IPv4 address shortage. It only makes IPv6 available. Other mechanisms, such as tunnels, help when the access network is still IPv4 only.
Checking each stack
Test both stacks separately, and test with names as well as addresses.
/ping 192.0.2.1
/ping 2001:db8:ffff::1
/ipv6 route print
/ipv6 address printIf IPv4 works and IPv6 fails, look at the IPv6 route, the IPv6 firewall and the address list. These menus do not depend on the IPv4 ones.
When a site loads slowly, test the IPv6 and IPv4 paths separately. A broken IPv6 path often shows as long delays before the browser falls back to IPv4.
What to remember for the exam
Seven facts cover most questions on this topic.
- Dual stack runs IPv4 and IPv6 together on the same interfaces.
- It needs no translation or tunnel, and it is the preferred transition method.
- Addresses, routes, firewall and pools are configured separately for each stack.
- A records hold IPv4 addresses, and AAAA records hold IPv6 addresses.
- Hosts usually prefer IPv6, and Happy Eyeballs falls back quickly to IPv4.
- The IPv4 firewall does not protect IPv6, so both need rules.
- RouterOS v6 needs the
ipv6package, and v7 has IPv6 built in.
Do not assume that an IPv4 firewall covers IPv6 hosts. They have global addresses and no NAT in front of them.
Common mistakes
These four mistakes appear often.
Configuring only one stack. Addresses, routes and firewall rules must exist for each protocol.
Forgetting the AAAA record. Without it, clients keep using IPv4 for that name.
Leaving IPv6 open. The IPv6 hosts are reachable from outside unless the IPv6 firewall blocks them.
Testing only IPv4. A working IPv4 ping says nothing about IPv6.
Check yourself
Work through these three questions.
What does dual stack mean?
A device runs IPv4 and IPv6 at the same time on the same interfaces, with no translation.
Which DNS record type holds an IPv6 address?
An AAAA record.
Why does a dual stack router need two firewall rule sets?
The
/ip firewallrules do not apply to IPv6, so the/ipv6 firewallrules must protect IPv6 traffic.
Topic 1 of 2 in Transition Mechanisms
Test yourself on Transition Mechanisms
The full MikroTik MTCIPv6E question bank has 486 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.