RouterOS manual

6to4



interface/6to4

Type: Directory

6to4 is a special mechanism that allows IPv6 packets to be transmitted over IPv4 networks.

<ArgTableRow arg="X" typ="disabled">Whether an item is disabled.</ArgTableRow> <ArgTableRow arg="R" typ="running">Whether the interface is running.</ArgTableRow>

<ArgTableRow arg="name" typ="string">Interface name.</ArgTableRow> <ArgTableRow arg="mtu" typ="num">Layer3 maximum transmission unit.</ArgTableRow> <ArgTableRow arg="local-address" typ="ipAddr">Source address of the packets, local to the router.</ArgTableRow> <ArgTableRow arg="remote-address" typ="alt { address: ipAddr , name: string }">IP address of the remote end of the 6to4 tunnel. If left unspecified, the IPv4 address is derived from the 2002::/16 gateway address.</ArgTableRow>

The keepalive parameter sets the time interval in which the tunnel running flag remains even if the remote end of the tunnel goes down. If the configured time and retries fail, the interface running flag is removed.
Parameters are written in the following format: KeepaliveInterval,KeepaliveRetries
where KeepaliveInterval is the time interval and KeepaliveRetries is the number of retry attempts.
By default keepalive is set to 10 seconds and 10 retries.

<ArgTableRow arg="dscp" typ="num">DSCP value of the packet. Inherited means the DSCP value is inherited from the packet to be encapsulated.</ArgTableRow> <ArgTableRow arg="clamp-tcp-mss" typ="bool">Controls whether to change MSS size for received TCP SYN packets. When enabled, the router changes the MSS size for received TCP SYN packets if the current MSS size exceeds the tunnel interface MTU (taking into account the TCP/IP overhead). The received encapsulated packet still contains the original MSS, and only after decapsulation the MSS is changed.</ArgTableRow>

Whether to include the DF bit in related packets.

  • no - fragment if needed.
  • inherit - use the DF flag of the original packet.

<ArgTableRow arg="ipsec-secret" typ="string" syscap="security">When a secret is specified, the router adds a dynamic IPsec peer to remote-address with a pre-shared key and policy (by default phase2 uses sha1/aes128cbc).</ArgTableRow>

<ArgTableRow arg="actual-mtu" typ="num">Actual maximum transmission unit of the tunnel.</ArgTableRow> <ArgTableRow arg="current-remote-address" typ="ipAddr">Current IPv4 address of the remote end.</ArgTableRow>

Source

Updated 2026-08-22.