6to4

6to4 is a special mechanism that allows IPv6 packets to be transmitted over IPv4 networks without explicitly configured tunnel interfaces. It is especially useful for connecting two or more IPv6 networks over a network that does not have IPv6 support. The 6to4 mechanism operates in two modes. If remote-address is not configured, the router encapsulates and sends an IPv6 packet directly over IPv4 if the first 16 bits are 2002, with the next 32 bits interpreted as the destination (IPv4 address converted to hex). In the other case, the IPv6 packet is sent directly to the IPv4 remote-address.

Configuration Examples

Simple 6to4 tunnel encapsulation (Not working)

It is possible to simply route IPv6 packets over an IPv4 network with the 2002::/16 allocated address space. All 6to4 nodes must have reachable IPv4 addresses - if you are running this setup over the Internet, all IPv4s must be public addresses.

R1 configuration

Create the 6to4 tunnel interface:

/interface/6to4
add name=6to4-tunnel1

Assign an IPv6 address with '2002' as the first 16 bits and IPv4 in hex format as the next 32 bits. For example, if the router's IP address is 10.0.1.1, the IPv6 address is 2002:A00:101::

/ipv6/address
add address=2002:a00:101::/128 advertise=no interface=6to4-tunnel1

Add a route to the specially allocated 6to4 tunnel range over the 6to4-tunnel interface.

/ipv6/route
add dst-address=2002::/16 gateway=6to4-tunnel1

R2 configuration

Create the 6to4 tunnel interface:

/interface/6to4
add name=6to4-tunnel1

Assign an IPv6 address that is generated by the same principles as R1. In this case, 10.0.2.1 translates to 2002:A00:201::

/ipv6/address
add address=2002:a00:201::/128 advertise=no interface=6to4-tunnel1

The 6to4 route is necessary on this side as well.

/ipv6/route
add dst-address=2002::/16 gateway=6to4-tunnel1

Testing

After configuring both devices, it should be possible to ping the IPv6 addresses if they were generated correctly.

From R1:

/ping 2002:a00:201::

Hurricane Electric Tunnel Broker Example

This example shows how to get IPv6 connectivity on a RouterOS device through an IPv4 network with a 6to4 tunnel.

To create the tunnel, you need a public IPv4 address and enable ping from the Tunnel Broker IPv4 server.

When you create a tunnel with Hurricane Electric Tunnel Broker, you receive a routed /64 IPv6 prefix and additional information necessary for setting up the tunnel.

This example assumes that your public IPv4 address is 194.105.56.170

Hurricane Electric provides ready-to-use commands for RouterOS in the 'Example Configurations' section:

/interface/6to4
add comment="Hurricane Electric IPv6 Tunnel Broker" disabled=no local-address=194.105.56.170 mtu=1280 name=sit1 remote-address=216.66.80.90
/ipv6/route
add comment="" disabled=no distance=1 dst-address=2000::/3 gateway=2001:470:27:37e::1 scope=30 target-scope=10
/ipv6/address
add address=2001:470:27:37e::2/64 advertise=no disabled=no eui-64=no interface=sit1

These commands set up the tunnel. The router can then connect to IPv6 hosts, but end-user devices (computers, tablets, phones) do not yet have IPv6 connectivity.

To assign IPv6 addresses to your clients, add the Routed IPv6 Prefix to your internal interface (by default bridge-local).

/ipv6/address/add address=2001:470:28:37e:: interface=bridge-local advertise=yes

Enable DNS server advertising through network discovery.

/ipv6/nd/set [ find default=yes ] advertise-dns=yes

And finally add IPv6 DNS servers (these are Google public DNS servers, you can also use the one provided by Hurricane Electric - 2001:470:20::2).

/ip/dns/set allow-remote-requests=yes servers=2001:4860:4860::8888,2001:4860:4860::8844

After enabling IPv6 on your device, use https://test-ipv6.com to test IPv6 connectivity.