IPv6 is active but there is no IPv6 firewall

What the audit found

The router has IPv6 enabled and holds a global IPv6 address (or obtains one through DHCPv6), but the IPv6 firewall filter (IPv6 → Firewall → Filter Rules) contains no active rules. The IPv4 firewall under IP → Firewall → Filter Rules does not apply to IPv6 traffic, so whatever protection you built there covers only half of your connectivity.

The audit rates this critical because the consequence is not limited to the router: with IPv6 there is no NAT, so every device on the LAN has its own globally routable address, and with no filter rules every one of them is reachable from the internet.

Why it matters

Most people have a mental model of their home or office network built on IPv4: devices sit behind a single public address, NAT hides them, and the firewall on the router protects the router itself. IPv6 changes the first two parts of that picture. Every laptop, printer, NAS, camera and smart TV gets a public address of its own, and the router forwards packets to it directly.

Without IPv6 firewall rules that means an attacker anywhere in the world can connect to the web interface of your NAS, the RDP port of a Windows machine, or the telnet service on a cheap IP camera — over IPv6, straight through the router. The router's own services (Winbox, SSH, API) are equally exposed on its IPv6 address.

This is easy to overlook because many people never configured IPv6 on purpose. An ISP starts handing out prefixes, the router picks one up via DHCPv6 or a default configuration, and suddenly the network is dual-stack. The IPv4 firewall still looks fine in Winbox, and nothing in the IPv4 rule list hints that a second, unfiltered path exists.

What it looks like in Winbox

Open IPv6 → Firewall → Filter Rules. If the list is empty (or every rule is greyed out), this is your situation. Compare it with IP → Firewall → Filter Rules, which probably contains your usual rules.

To confirm IPv6 is really in use, look at IPv6 → Addresses: any address that does not start with fe80: is a global address. IPv6 → DHCP Client shows whether the router requests a prefix from the ISP.

How to fix it

The fix is to give IPv6 the same firewall that IPv4 already has: a small set of rules under IPv6 → Firewall → Filter Rules that mirrors the logic of your IPv4 input and forward chains. The principle is identical — accept traffic that belongs to connections your own devices started, drop malformed packets, and end each chain with a rule that drops anything arriving from an interface that is not in your LAN interface list. Because the LAN side is identified by interface list rather than by address, the rules keep working when the ISP changes your prefix.

IPv6 has two requirements IPv4 does not. ICMPv6 must stay allowed in both chains, since neighbour discovery and path MTU discovery depend on it — filtering it away breaks IPv6 rather than securing it. And if the router obtains its prefix through DHCPv6, the input chain needs to let the ISP's reply through from the link-local range, or the lease will silently expire.

Build the rules with Safe Mode switched on in Winbox. If you manage the router over IPv6 from outside and get the order wrong, the router reverts the change when your session drops. If you do not use IPv6 at all, the alternative is to disable it entirely under IPv6 → Settings — only do that if you are sure nothing depends on it.

Afterwards, from a network that is not your LAN, try to reach the router's global IPv6 address and one LAN device with a browser or SSH; the connections should time out, while ping may still answer. Then re-run the audit: the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I never set up IPv6. How did it get enabled?

RouterOS enables IPv6 as soon as the package is present (on RouterOS 7 it is built in). If your ISP announces a prefix, the router accepts it via DHCPv6 or router advertisements and passes it on to the LAN. The result is a working dual-stack network that nobody consciously configured.

Will these rules break IPv6 for my devices?

No. Outgoing connections from the LAN are still allowed, and the established/related rule lets the replies back in. ICMPv6 stays open because neighbour discovery and path MTU discovery depend on it. Only unsolicited connections from the internet to the router or your devices are dropped.

I want one device reachable over IPv6 from outside. Can I still do that?

Yes — add an accept rule in the forward chain for that device's address and port, placed above the final drop. That is the IPv6 equivalent of a port forward, and you decide exactly which device and service is exposed instead of all of them.