Skip to main content
RouterOS calls its IPv6-over-IPv4 tunnel interface 6to4. With an explicit remote-address, you can use it for a configured point-to-point link between two routers. This routes IPv6 traffic; it does not bridge Ethernet or automatically provide public IPv6 Internet access. This example uses private IPv6 networks behind two routers and RouterOS’s ipsec-secret option. See the MikroTik interface reference for current behavior and IPsec defaults.

​
Before you begin

  • You administer both RouterOS routers and their firewall policies.
  • Both ends have reachable public IPv4 addresses. This example does not cover NAT.
  • Each router has an appropriate LAN interface or bridge for its downstream network. Do not blindly apply the LAN address to a VPS’s public/WAN interface.
  • Back up the router configuration and keep an alternate management connection available.
An EDIS VPS already has native IPv6. This tunnel is for a specific network design; it is not required to enable ordinary VPS IPv6 connectivity.

​
Example address plan

All addresses below are documentation examples. Replace the IPv4 endpoints with your actual public addresses. For production private networks, generate a unique ULA /48 prefix and allocate non-overlapping subnets; see RFC 4193. The ULA addresses are for private communication, not globally routed Internet addresses. Replace LAN_INTERFACE below with each router’s actual downstream interface or bridge.

​
1. Enable IPv6

On both routers:
Enable IPv6 in RouterOS

​
2. Create the tunnel

Use the same long, randomly generated secret at both ends. REPLACE_WITH_UNIQUE_SECRET is a placeholder, not a usable example password. Do not reuse a public documentation password. On Router 1:
On Router 2:
Specifying ipsec-secret creates a dynamic IPsec peer and policy. Review the negotiated algorithms and policy against your requirements; creating the interface alone does not prove that encrypted traffic is flowing.

​
3. Assign the tunnel and LAN addresses

On Router 1:
On Router 2:
These examples do not configure downstream clients or router advertisements. Configure each client with an address from its LAN subnet and a route through its local router, or configure IPv6 address distribution separately.

​
4. Route the remote LAN

On Router 1:
On Router 2:
Permit the required IPsec negotiation and encrypted traffic between the two exact IPv4 peers, and the intended IPv6 forwarding between your LANs. Protocol 41 is an IP protocol number, not TCP or UDP port 41. Do not add a broad rule accepting unprotected encapsulated traffic as a shortcut around an IPsec policy problem.

​
5. Verify both routing and encryption

First check that the expected IPsec peer and security associations are established in RouterOS. Then test the remote tunnel endpoint and remote LAN router address. From Router 1:
From Router 2:
Finally, test traffic between actual downstream hosts and inspect IPsec counters. A successful ping to a router alone does not verify downstream routing or the confidentiality of the path. If a test fails, check endpoint reachability, the shared secret, IPsec policies, IPv6 routes, firewall counters, and the LAN clients’ return routes. The starting MTU of 1280 may also need path-specific investigation; it is not a guarantee that every underlying path can carry the encapsulated packet without fragmentation.
Last modified on September 30, 2026