CloudLabBox
Try the free demo

MikroTik MTCIPv6E lab 4 of 8

IPv6 firewall and protection against rogue router advertisements

With IPv6 there's no NAT to hide behind: every PC at Harbourside has a global address, and the ISP can reach the web service one of them runs. Build a stateful IPv6 firewall that keeps the ICMPv6 that IPv6 needs, then stop a misconfigured router on a meeting-room port from handing out its own prefix and default route with a bridge filter that acts as RA guard.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,280 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCIPv6E RouterOS v7 guided labs, then 04 - IPv6 firewall and protection against rogue router advertisements

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
4 vCPU, 1,280 MB
Smallest plan
Lite

The scenario

The Harbourside office router CPE now routes IPv6, and that changes two things. First, there's no NAT: every PC has a global address, and anything listening on a PC can be reached from the Internet unless a firewall stops it; PC1 runs a small intranet web page on port 80. Second, hosts trust router advertisements, and someone has plugged old lab kit, ROGUE, into the meeting-room socket: it advertises its own prefix and itself as the preferred default router.

DeviceAddress
CPEether1 2001:db8:0:1::2/64 (WAN) · bridge lan (ether2 desk 12, ether3 meeting room) 2001:db8:4800:10::1/64
ISP2001:db8:0:1::1/64 · Internet 2001:db8:ffff::1
PC1 (Linux)2001:db8:4800:10::100/64 plus SLAAC; a web page on port 80
ROGUEfd66:6666:6666::1/64, advertised with high preference

What you’ll practise

  • Explain why IPv6 needs a stateful firewall even where IPv4 had NAT
  • Build input and forward chains that keep ICMPv6, DHCPv6 and traceroute working
  • Drop special-purpose addresses early with an address list in RAW
  • Recognise a rogue router advertisement and block it on a bridge port
  • Test the policy from inside and outside

The tasks

  1. Prepare PC1
  2. See what the rogue router does
  3. RA guard
  4. What an IPv6 firewall must let through
  5. The input chain
  6. The forward chain and RAW

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IPv6 firewall and protection against rogue router advertisements4 nodes, 3 links. Every link is listed as text below the diagram.CPEISPROGUEPC1ether1ether1ether2eth0ether3ether1
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • CPE ether1 to ISP ether1
  • CPE ether2 to PC1 eth0
  • CPE ether3 to ROGUE ether1
Nodes in IPv6 firewall and protection against rogue router advertisements, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
CPEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ROGUEMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
PC1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCIPv6E RouterOS v7 guided labs.

  3. Open 04 - IPv6 firewall and protection against rogue router advertisements and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCIPv6E labs

All MikroTik MTCIPv6E labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.