This guide provides a practical, step-by-step walkthrough to configure and enable IPv6 over PPPoE with NAT66 on MikroTik RouterOS v7. It covers dynamic Prefix Delegation (PD), Unique Local Address (ULA) distribution via SLAAC, and real-time verification using Neighbor Discovery (ND) tools.
The setup uses SLAAC to autoconfigure internal LAN clients with private ULA addresses, which are then translated (masqueraded) to the public IPv6 WAN address assigned by your ISP.
Enable IPv6 Stack and Verify Link-Local PPPoE Session
Ensure that the global IPv6 stack is enabled and force a re-negotiation of the PPPoE connection to establish an IPv6CP link-local (fe80::) peering with the ISP BNG:
[admin@Mikrotik] > /ipv6 settings set disable-ipv6=no
[admin@Mikrotik] > /interface pppoe-client disable pppoe-out1
[admin@Mikrotik] > /interface pppoe-client enable pppoe-out1
Verify that IPv6CP negotiation succeeded and link-local addresses are assigned:
[admin@Mikrotik] > /interface pppoe-client monitor pppoe-out1 once
status: connected
uptime: 4h55m26s
active-links: 1
encoding:
service-name: bm
ac-name: gw2.gobul.net
ac-mac: 18:FD:74:69:96:03
mtu: 1480
mru: 1492
local-address: 85.14.41.73
remote-address: 85.14.41.1
local-ipv6-address: fe80::db22:f608:0:8
remote-ipv6-address: fe80::dfe7:54da:f6:34be
An active status with valid fe80:: addresses confirms that IPv6CP is fully operational over the PPPoE connection.
Request an IPv6 prefix delegation (PD) from the ISP and save it into an internal address pool. Keep add-default-route=no to prevent conflicts with the IPv6CP interface route:
[admin@Mikrotik] > /ipv6 dhcp-client add interface=pppoe-out1 request=prefix pool-name=isp-ipv6-pool add-default-route=no use-peer-dns=yes
Check the delegated prefix state:
[admin@Mikrotik] > /ipv6 dhcp-client print
Flags: D - dynamic, X - disabled, I - invalid
# INTERFACE STATUS PREFIX EXPIRES-IN
0 pppoe-out1 bound 2a0b:b185:1441:4006::/64 23h52m10s
A status of bound indicates the router has successfully acquired a public IPv6 prefix.
Assign Public GUA Address to WAN Interface
Assign an IPv6 address from the delegated pool to the WAN interface (pppoe-out1) so the router can source outbound traffic and perform NAT66 translation:
[admin@Mikrotik] > /ipv6 address add address=::1/64 pool-name=isp-ipv6-pool interface=pppoe-out1 advertise=no
Verify WAN address configuration:
[admin@Mikrotik] > /ipv6 address print where interface=pppoe-out1
Flags: G - GLOBAL, L - LINK-LOCAL; D - DYNAMIC
Columns: ADDRESS, FROM-POOL, INTERFACE
# ADDRESS FROM-POOL INTERFACE
0 G 2a0b:b185:1441:4006::1/64 isp-ipv6-pool pppoe-out1
Setting advertise=no ensures the router does not broadcast Router Advertisements (RA) upstream toward the ISP BNG.
Assign a Unique Local Address (ULA) prefix to the local bridge interface (BR-LAN) and enable SLAAC auto-configuration:
[admin@Mikrotik] > /ipv6 address add address=fd00:10:10:1::1/64 interface=BR-LAN advertise=yes
[admin@Mikrotik] > /ipv6 nd set [ find default=yes ] interface=BR-LAN ra-lifetime=30m disabled=no
Check the active Neighbor Discovery prefixes on the bridge interface:
[admin@Mikrotik] > /ipv6 nd prefix print
Flags: X - disabled, I - invalid; D - dynamic
0 D prefix=fd00:10:10:1::/64 6to4-interface=none interface=BR-LAN on-link=yes autonomous=yes valid-lifetime=4w2d preferred-lifetime=1w
The autonomous=yes flag confirms that LAN clients can auto-configure fd00:: ULA addresses using SLAAC.
Enable NAT66 Outbound Masquerade
Configure an IPv6 source NAT rule to translate internal ULA addresses (fd00::/64) to the public GUA address on the PPPoE interface:
[admin@Mikrotik] > /ipv6 firewall nat add chain=srcnat out-interface=pppoe-out1 action=masquerade
Verify the NAT66 firewall rule configuration:
[admin@Mikrotik] > /ipv6 firewall nat print
Flags: X - disabled, I - invalid; D - dynamic
0 chain=srcnat action=masquerade out-interface=pppoe-out1
This rule handles IPv6 network address translation for all outbound LAN traffic destined for the global Internet.
Verify Outbound WAN Connectivity
Check the active IPv6 default route and execute an outbound ping test to an external IPv6 target:
[admin@Mikrotik] > /ipv6 route print where dst-address="::/0"
Flags: D - DYNAMIC; A - ACTIVE; v - IPV6CP
Columns: DST-ADDRESS, GATEWAY, DISTANCE
DST-ADDRESS GATEWAY DISTANCE
DAv ::/0 pppoe-out1 1
[admin@Sveltio-Serviz] > /ping 2001:4860:4860::8888 count=4
SEQ HOST SIZE TTL TIME STATUS
0 2001:4860:4860::8888 56 57 12ms45us echo reply
1 2001:4860:4860::8888 56 57 11ms98us echo reply
sent=2 received=2 packet-loss=0% min-rtt=11ms98us avg-rtt=12ms21us max-rtt=12ms45us
Successful ICMPv6 echo responses confirm that the router has active IPv6 internet reachability.
Verify Neighbor Discovery and Active ULA Clients
Send an ICMPv6 multicast echo request across the LAN bridge to trigger Neighbor Discovery resolution:
[admin@Mikrotik] > /ping ff02::1%BR-LAN count=4
SEQ HOST SIZE TTL TIME STATUS
0 fe80::7a9a:18ff:fe45:d7de 56 64 554us echo reply
0 fe80::b219:21ff:fe28:d968 56 64 1ms517us echo reply
0 fe80::e80:63ff:fe8a:bcb5 56 64 1ms648us echo reply
0 fe80::8e2:6eed:52ca:a07b 56 64 2ms343us echo reply
sent=1 received=4 packet-loss=-300% min-rtt=554us avg-rtt=1ms515us max-rtt=2ms343us
Inspect active ULA client entries in the RouterOS Neighbor table:
[admin@Mikrotik] > /ipv6 neighbor print where interface=BR-LAN
Flags: D - DYNAMIC; R - ROUTER
Columns: ADDRESS, MAC-ADDRESS, INTERFACE, VRF
# ADDRESS MAC-ADDRESS INTERFACE VRF
0 D fe80::c5c6:553b:630f:9689 C0:4B:24:10:29:96 BR-LAN main
1 D fe80::8e2:6eed:52ca:a07b C8:13:8B:64:27:A6 BR-LAN main
2 D fd00:10:10:1:9f5b:f58d:cc2b:62bd 26:38:CA:44:07:4A BR-LAN main
3 D fd00:10:10:1:3cff:dc0a:b42e:8588 A0:D8:07:23:11:98 BR-LAN main
Active fd00:: entries confirm that local devices are auto-configuring ULA addresses through SLAAC. Note that modern operating systems use IPv6 Privacy Extensions (RFC 8981), generating randomized interface identifiers instead of EUI-64 hardware addresses.
Verify Active NAT66 Connections
Check active IPv6 connection tracking table entries to ensure ULA client sessions are translated correctly:
[admin@Mikrotik] > /ipv6 firewall connection print where src-address~"fd00"
Flags: S - SEEN-REPLY; A - ASSURED; C - CONFIRMED; s - SRCNAT
Columns: PROTOCOL, SRC-ADDRESS, SRC-PORT, DST-ADDRESS, DST-PORT, TCP-STATE, TIMEOUT, ORIG-RATE, REPL-RATE, ORIG-PACKETS, REPL-PACKETS
# PRO SRC-ADDRESS SRC-P DST-ADDRESS DST- TCP-STATE TIMEOUT ORIG-RATE REPL-RAT ORI REP
0 SACs tcp fd00:10:10:1:5d60:173e:82da:7afa 49631 2a00:1450:4017:823::200a 443 established 23h59m47s 0bps 0bps 23 25
1 SACs tcp fd00:10:10:1:a532:bb08:bb77:4dfe 48554 2a03:2880:f028:113:face:b00c:0:8e 443 established 23h59m36s 0bps 0bps 9 8
2 SACs tcp fd00:10:10:1:5d60:173e:82da:7afa 49576 2a00:1450:4017:819::200e 443 established 23h59m42s 0bps 0bps 17 17
3 SACs tcp fd00:10:10:1:5d60:173e:82da:7afa 49579 2a00:1450:4017:820::200e 443 established 23h59m43s 0bps 0bps 16 16
4 SACs tcp fd00:10:10:1:5d60:173e:82da:7afa 49623 2a00:1450:4002:405::200a 443 established 23h59m45s 0bps 0bps 15 18
5 SACs udp fd00:10:10:1:a532:bb08:bb77:4dfe 43952 2a03:2880:f028:110:face:b00c:0:2 443 2m26s 0bps 0bps 52 67
6 SACs tcp fd00:10:10:1:2:8e84:7776:754d 49584 2a03:2880:f128:188:face:b00c:0:4c63 443 established 23h41m39s 0bps 0bps 256 184
Seeing established ULA connection states in the tracking table confirms that NAT66 translation and IPv6 routing are functioning seamlessly across the network.
Useful IPv6 Diagnostic Commands Summary
/interface pppoe-client monitor pppoe-out1
/ipv6 dhcp-client print
/ipv6 address print
/ipv6 nd prefix print
/ipv6 route print where dst-address="::/0"
/ping ff02::1%BR-LAN count=2
/ipv6 neighbor print where interface=BR-LAN
/ipv6 firewall connection print where src-address~"fd00"