Multi-homing IPv6 over CGNAT on RouterOS

A. VPS  — runs BFD with home, announces your /48 up to transit
          (announce-only — AS 52025 sends nothing back), and re-
          originates its own default route to home over iBGP as
          ::/0 with empty AS_PATH
B. Route64 — eBGPs your /48 from home to AS 212895, advertises ::/0
             back with AS_PATH=[212895]
C. Home — receives ::/0 from both sessions, BGP best-path installs the
          VPS-learned default (shorter AS_PATH), Route64-learned
          default is the backup

set -e
apt-get update -qq
apt-get install -y -qq wireguard bird2 nftables

cat >/etc/sysctl.d/99-multi-homed.conf <<'EOF'
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.<VPS_NIC>.accept_ra = 2
EOF
sysctl --system >/dev/null

umask 077
mkdir -p /etc/wireguard
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
VPS_PRIVKEY=$(cat /etc/wireguard/server.key)

cat >/etc/wireguard/wg0.conf <<EOF
[Interface]
PrivateKey = ${VPS_PRIVKEY}
Address    = <OWN_48>:0::1/64, fe80::1/64
ListenPort = 51820
MTU        = 1420
Table      = off

[Peer]
PublicKey  = <HOME_PUBKEY>
AllowedIPs = <OWN_48>:0::2/128, <OWN_48>::/48
PersistentKeepalive = 25
EOF

systemctl enable --now wg-quick@wg0
echo "VPS public key: $(cat /etc/wireguard/server.pub)"

cat >/etc/nftables.conf <<'EOF'
#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority filter; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif lo accept
    meta l4proto { icmp, icmpv6 } accept

    tcp dport 22 accept                       # SSH
    udp dport 51820 accept                    # WireGuard from home
    iifname "<VPS_NIC>" tcp dport 179 accept  # BGP from transit
    iifname "wg0" tcp dport 179 accept        # BGP from home, wg0 only
    iifname "wg0" udp dport 3784 accept       # BFD from home, wg0 only
  }

  chain forward {
    type filter hook forward priority filter; policy drop;

    ct state established,related accept
    iifname "wg0" ip6 saddr <OWN_48>::/48 accept   # LAN -> internet, source must be ours
    oifname "wg0" ip6 daddr <OWN_48>::/48 accept   # internet -> LAN, dest must be ours
  }

  chain output {
    type filter hook output priority filter; policy accept;
  }
}
EOF
systemctl enable --now nftables

mkdir -p /etc/bird
cat >/etc/bird/bird.conf <<'EOF'
log syslog all;
router id <VPS_ROUTER_ID>;

protocol device { }

protocol direct {
  ipv6;
  interface "wg0", "<VPS_NIC>";
}

protocol kernel kernel6 {
  metric 32;
  ipv6 {
    # Pull only ::/0 from the kernel. This is what becomes locally-
    # originated in BGP (empty AS_PATH) and what wins best-path on home.
    import filter {
      if net = ::/0 then accept;
      reject;
    };

    # Install the BGP-learned <OWN_48> (from home) into the kernel so
    # return traffic to home actually goes via wg0.
    export filter {
      if net = <OWN_48>::/48 then accept;
      reject;
    };
  };
  learn yes;
}

# Active BFD probing toward home. Without an explicit neighbor, bird is
# passive; after a flap both sides wait for the other and recovery stalls.
protocol bfd {
  interface "wg0" {
    min rx interval 200 ms;
    min tx interval 200 ms;
    idle tx interval 1 s;
    multiplier 3;
  };
  neighbor <OWN_48>:0::2 dev "wg0";
}

# iBGP downstream to home — both ends in <OWN_AS>.
protocol bgp home {
  local <OWN_48>:0::1 as <OWN_AS>;
  neighbor <OWN_48>:0::2 as <OWN_AS>;
  bfd on;

  ipv6 {
    import filter {
      if net = <OWN_48>::/48 then accept;
      reject;
    };

    export filter {
      if net = ::/0 then accept;
      reject;
    };

    next hop self;
  };
}

# eBGP upstream to transit — your <OWN_AS> peering with <TRANSIT_AS>.
# AS 52025 hands you a peer address (<TRANSIT_PEER_V6>) that sits in a
# different subnet from your on-link /64, so it's reached over your
# default route and the session is multihop. `local` pins the source to
# your on-link address (<VPS_GUA>); without it bird may source from the
# wrong address and the peering won't come up.
protocol bgp transit {
  local <VPS_GUA> as <OWN_AS>;
  neighbor <TRANSIT_PEER_V6> as <TRANSIT_AS>;
  multihop 2;

  ipv6 {
    # AS 52025 is announce-only and sends nothing, so this imports no
    # routes in practice. Kept defensive: the ::/0 home uses is the
    # kernel-originated one above (empty AS_PATH), not anything learned
    # here. Anything more-specific would be provider-routed; reject it.
    import filter {
      if net = ::/0 then accept;
      reject;
    };

    # Originate only <OWN_48> upstream. ROA must already authorize this
    # origin or transit will drop it via RPKI.
    export filter {
      if net = <OWN_48>::/48 then accept;
      reject;
    };
  };
}
EOF
chown -R bird:bird /etc/bird

mkdir -p /etc/systemd/system/bird.service.d
printf '[Service]\nRestart=on-failure\nRestartSec=2s\n' \
  > /etc/systemd/system/bird.service.d/restart.conf
systemctl daemon-reload
systemctl enable --now bird

/ipv6/route add dst-address=<OWN_48>::/48 blackhole distance=254 \
    comment="aggregate-for-bgp"

/ipv6/firewall/address-list add list=bgp-networks-own \
    address=<OWN_48>::/48 comment="/48 to both upstreams"

/routing/bgp/instance add name=default-bgp as=<OWN_AS> router-id=<HOME_ROUTER_ID>

/interface/wireguard add name=wg-host listen-port=51820 mtu=1420
/interface/wireguard/peers add interface=wg-host name=vps \
    public-key="<VPS_PUBKEY>" \
    endpoint-address=<VPS_IP> endpoint-port=51820 \
    allowed-address=::/0 \
    persistent-keepalive=25s

/ipv6/address add address=<OWN_48>:0::2/64 interface=wg-host advertise=no

/routing/filter/rule add chain=bgp-in-vps \
    rule="if (dst == ::/0) { accept } reject"
/routing/filter/rule add chain=bgp-out-vps \
    rule="if (dst == <OWN_48>::/48) { accept } reject"

/routing/bgp/template add name=tpl-host as=<OWN_AS> use-bfd=yes
/routing/bgp/connection add name=host-vps instance=default-bgp \
    remote.address=<OWN_48>:0::1 remote.as=<OWN_AS> \
    local.address=<OWN_48>:0::2 local.role=ibgp \
    templates=tpl-host afi=ipv6 use-bfd=yes \
    input.filter=bgp-in-vps \
    output.network=bgp-networks-own output.filter-chain=bgp-out-vps

/routing/bfd/configuration/add interfaces=wg-host \
    min-rx=200ms min-tx=200ms multiplier=3

# BFD's UDP/3784 packets arrive unsolicited, so the defconf
# established,related,untracked rule doesn't cover them. The BGP
# session itself is dialed out by home and needs no input rule.
/ipv6/firewall/filter add chain=input action=accept protocol=udp dst-port=3784 \
    in-interface=wg-host comment="BFD from VPS" \
    place-before=[find where chain=input and comment="defconf: drop everything else not coming from LAN"]
# place-before= pins the new accept above the defconf drop. If your
# RouterOS version's defconf wording differs, [find ...] returns
# nothing and the rule lands at the bottom (after the drop) — swap to
# a numeric place-before= in that case.

/interface/wireguard add name=wg-route64 mtu=1420 \
    listen-port=<R64_POP_PORT> private-key="<R64_PRIVKEY>"
/interface/wireguard/peers add interface=wg-route64 \
    public-key="<R64_SRV_PUBKEY>" \
    endpoint-address=<R64_POP_IP> endpoint-port=<R64_POP_PORT> \
    allowed-address=::/0 persistent-keepalive=15s
/ipv6/address add address=<R64_LINK>::2/64 interface=wg-route64 advertise=no

/routing/filter/rule add chain=bgp-in-r64 \
    rule="if (dst == ::/0) { accept } reject"
/routing/filter/rule add chain=bgp-out-r64 \
    rule="if (dst == <OWN_48>::/48) { accept } reject"

# Route64 portal must have BYO ASN set to <OWN_AS> for this to peer.
/routing/bgp/connection add name=host-r64 instance=default-bgp \
    remote.address=<R64_LINK>::1 remote.as=212895 \
    local.address=<R64_LINK>::2 local.role=ebgp \
    afi=ipv6 \
    input.filter=bgp-in-r64 \
    output.network=bgp-networks-own output.filter-chain=bgp-out-r64

/tool/netwatch add name=v6health type=tcp-conn \
    host=2606:4700:4700::1111 port=443 \
    interval=5s timeout=2s comment=v6health \
    up-script="/ipv6/nd set [find interface=bridge] ra-lifetime=30m; /ipv6/nd set [find interface=vlan-iot] ra-lifetime=30m; /ipv6/nd set [find interface=vlan-guest] ra-lifetime=30m; :log info v6-up" \
    down-script="/ipv6/nd set [find interface=bridge] ra-lifetime=0s; /ipv6/nd set [find interface=vlan-iot] ra-lifetime=0s; /ipv6/nd set [find interface=vlan-guest] ra-lifetime=0s; :log info v6-down-failedtoIPv4"

# Both BGP sessions established
/routing/bgp/session/print
#   expect:  host-vps  established
#            host-r64  established

# BFD up on the VPS session only
/routing/bfd/session/print
#   expect:  one entry, state=up, peer=<OWN_48>:0::1

# Active default route
/routing/route/print where dst-address=::/0
#   expect: two ::/0 candidates; the bgp.as-path=[] one is active

# The active default's gateway is the VPS WG endpoint
/ipv6/route/print where active and dst-address=::/0
#   expect: gateway=<OWN_48>:0::1%wg-host

# netwatch healthy
/tool/netwatch/print where comment=v6health

# BFD/3784 input rule lives above the defconf drop.
# The §5 place-before=[find ...] depends on the defconf comment string
# in your RouterOS version; if it doesn't match, the rule lands at the
# bottom of the chain (after the drop) and BFD silently never arrives.
/ipv6/firewall/filter print
#   expect: the chain=input udp dst-port=3784 rule above the
#           "defconf: drop everything else not coming from LAN" rule

birdc show protocols
#   expect: home (bgp)     Established
#           transit (bgp)  Established
#           bfd1 (bfd)     Up

birdc show route ::/0 all
#   expect: best path via wg0 to <OWN_48>:0::2 from home (iBGP, AS_PATH empty)
#           plus transit's ::/0 from <TRANSIT_PEER_V6>

birdc show route <OWN_48>::/48 all
#   expect: via wg0 from home (learned by iBGP), exported to transit

# On the VPS, drop BFD packets to simulate a half-dead tunnel.
# BFD declares down in ~700 ms; bird withdraws ::/0 from home; home's
# best-path picks the Route64-learned ::/0.
nft add rule inet filter input iifname wg0 udp dport 3784 drop

# On home router: time it.
/log/print where message~"BGP|BFD"
/ipv6/route/print where active and dst-address=::/0
#   expect: gateway now <R64_LINK>::1%wg-route64

ping -c 5 -I <CLIENT_GUA> 2606:4700:4700::1111
#   expect: 1 dropped packet at the switchover, rest reach via Route64

# Undo it — BFD comes back, best-path returns to VPS.
nft -a list ruleset | grep "udp dport 3784 drop"   # note the handle
nft delete rule inet filter input handle <handle>

# Disable Route64 alone. Because VPS is already best-path, this should
# produce no active-route change and no v6-down log line — Route64
# leaves BGP, the LAN sees nothing.
/interface/wireguard/peers/disable [find interface=wg-route64]
/ipv6/route/print where active and dst-address=::/0
#   expect: gateway still <OWN_48>:0::1%wg-host
/log/print where message~"v6-(up|down)"
#   expect: no new entries

/interface/wireguard/peers/enable [find interface=wg-route64]

# Stop WireGuard on the VPS and disable Route64 on home simultaneously.
# Within ~8 s the netwatch fires; clients drop their v6 default and
# Happy-Eyeballs to IPv4.
ssh vps "wg-quick down wg0"
/interface/wireguard/peers/disable [find interface=wg-route64]
/log/print where message~"v6-(up|down)"

# Restore.
/interface/wireguard/peers/enable [find interface=wg-route64]
ssh vps "wg-quick up wg0"