Router management reachable over IPv6 from the internet

What the audit found

Your router has IPv6 connectivity — a global address or a DHCPv6 client on the WAN side — and an IPv6 firewall exists, but the input chain under IPv6 → Firewall does not drop new connections arriving from the internet. RouterOS services such as Winbox, SSH, the web interface and the API listen on IPv6 as well as IPv4, so they are reachable over IPv6 even when the IPv4 firewall is complete.

The audit reports this as high because the effect is the same as an unprotected IPv4 router: a management login prompt is open to the whole internet, only on a different address.

Why it matters

IPv6 is easy to forget. Most people build their firewall once, on the IPv4 side, and test it by scanning their IPv4 public address. Then the ISP turns on IPv6, the router picks up a prefix, and every service on the device is suddenly reachable on a second address that nobody has looked at. The IPv4 rules do not apply — the IP firewall and the IPv6 firewall are entirely separate.

Attackers have not forgotten. Scanning the whole IPv6 space is impractical, but scanners do not need to: routers announce their addresses through DNS, through reverse lookups, through neighbour discovery on shared segments, and through the traffic they generate. Once a router's IPv6 address is known, port 8291 or 22 answers just as it would on IPv4, with the same passwords and the same bugs.

There is a second reason this is worse than it sounds. Because the router has no NAT on IPv6, its own address is a real global address, not a private one. There is no accidental protection from being "behind" something. If the input chain does not drop unsolicited traffic, the router is simply on the internet.

What it looks like in Winbox

Open IPv6 → Firewall → Filter Rules — note that this is a different menu from IP → Firewall. Look at rules with Chain = input. You will likely see a few accept rules, perhaps for ICMPv6 and established connections, but no final rule that drops traffic arriving on the WAN interface, or one that exists but is disabled. Confirm the router has a global IPv6 address under IPv6 → Addresses (anything not starting with fe80).

How to fix it

The fix mirrors the IPv4 one: the IPv6 input chain needs a final rule that drops everything arriving on an interface that is not in your LAN interface list. The list is shared between the two address families, so if your IPv4 firewall already uses it you are set; otherwise create it under Interfaces → Interface List.

The drop must be the last rule in the chain, and the rules above it must allow what IPv6 needs to function — this is where IPv6 differs from IPv4. A complete minimal input chain accepts established and related connections, drops invalid ones, accepts ICMPv6, accepts DHCPv6 client replies from link-local addresses, and only then drops the rest. ICMPv6 cannot be treated like ICMP on IPv4: it carries neighbour discovery and router advertisements, and blocking it breaks IPv6 outright. The DHCPv6 rule keeps your prefix delegation working. If you manage the router over IPv6 from outside, add an accept for your own source address above the drop — or, better, use a VPN. Check the forward chain as well; it needs a similar final drop so that the devices behind the router are not directly reachable either, since there is no NAT to hide them.

Do this with Safe Mode on, so a wrong rule reverts itself. Afterwards, from a network with IPv6 connectivity other than your own (mobile data usually has it), try to open Winbox or SSH on the router's global IPv6 address and confirm it times out, while management and IPv6 browsing from the LAN still work and the DHCPv6 client still shows its prefix bound. Then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I only manage the router over IPv4. Are the services really listening on IPv6?

Yes. The RouterOS services under IP → Services listen on all addresses of the router, both families, unless restricted in the Available From field. The address restriction there accepts IPv6 prefixes too, and setting it is a good second layer alongside the firewall.

My ISP does not give me IPv6. Why is this reported?

The audit reports it only on routers that actually have IPv6 connectivity. If you have a tunnel (for example a 6to4 or a tunnel broker interface), that counts as IPv6 connectivity. If IPv6 is genuinely unused, disabling the IPv6 package or the DHCPv6 client removes the exposure entirely.

Can I just copy my IPv4 rules?

Mostly, with two changes: the ICMP accept must match ICMPv6 instead, and the DHCPv6 client rule must be added. Everything else — established/related accept, invalid drop, final drop by interface list — carries over unchanged. The report lists the IPv6 chain rule by rule.