Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a MikroTik router set up with the latest stable OS on it, and I just set up an ipv6 tunnel with Hurricane Electric, but I'm having an odd issue with it. I can't ping anything until I first ping the tunnel endpoint on HE's side. After that I can ping any ipv6 address fine, but give it a little time (say, maybe 30 sec) and I can't ping any ipv6 addresses again. Whenever it stops allowing ping to go through I notice the counter on my firewall rule that drops invalid connections goes up.

this is my ipv6 firewall config:

add action=accept chain=input comment="" connection-state=established \
    disabled=no in-interface=sit1
add action=accept chain=input comment="" connection-state=related disabled=no \
add action=accept chain=input comment="" disabled=no in-interface=bridge \
add action=drop chain=input comment="" connection-state=invalid disabled=no \
add action=drop chain=input comment="" disabled=no in-interface=sit1

Any ideas on what it could be?

share|improve this question
How about rules in IPv4 firewall blocking 6to4 protocol after while (6to4 is IP protocol 41, not listed in "protocol" value of firewall rule). Look for dropped IPv4 packets when IPv6 packets starts to being drop. – mkudlacek Mar 8 '11 at 7:19
I reset the counters on my ipv4 firewall, and no substantial packets are hitting any of the drop rules. (2 packets in several minutes of pinging) – MikeSmitty Mar 8 '11 at 15:41
What about the default ipv6 route? have you tried to set the 2000::/3 gateway=sit1? can you add a ipv4 firewall log rule to see ip protocol 41 transit? – user131305 Aug 7 '12 at 18:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.