Configuring IPv6 firewall with Mikrotik

I switched to an internet provider that gives the IPv6 addresses, here’s what I had to do on the Mikrotik router to provide the functionality to the clients My WAN interface is called wan

Disable RA by default

I am disabling the RA by default and will be enabling by subnet later

/ipv6 nd set [ find default=yes ] disabled=yes
/ipv6 dhcp-client add add-default-route=yes interface=wan pool-name=ipv6pool request=prefix

Setup basic firewall rules

(I borrowed those)

/ipv6 firewall filter
add action=drop chain=input comment="Drop (invalid)" connection-state=invalid
add action=accept chain=input comment="Accept (established, related)" connection-state=established,related
add action=accept chain=input comment="Accept DHCP (10/sec)" in-interface=wan limit=10,20:packet protocol=udp \
    src-port=547
add action=drop chain=input comment="Drop DHCP (>10/sec)" in-interface=wan protocol=udp src-port=547
add action=accept chain=input comment="Accept external ICMP (10/sec)" in-interface=wan limit=10,20:packet \
    protocol=icmpv6
add action=drop chain=input comment="Drop external ICMP (>10/sec)" in-interface=wan protocol=icmpv6
add action=accept chain=input comment="Accept internal ICMP" in-interface=!wan protocol=icmpv6
add action=drop chain=input comment="Drop external" in-interface=wan
add action=reject chain=input comment="Reject everything else"
add action=accept chain=output comment="Accept all"
add action=drop chain=forward comment="Drop (invalid)" connection-state=invalid
add action=accept chain=forward comment="Accept (established, related)" connection-state=established,related
add action=accept chain=forward comment="Accept external ICMP (20/sec)" in-interface=wan limit=20,50:packet \
    protocol=icmpv6
add action=drop chain=forward comment="Drop external ICMP (>20/sec)" in-interface=wan protocol=icmpv6
add action=accept chain=forward comment="Accept internal" in-interface=!wan
add action=accept chain=forward comment="Accept outgoing" out-interface=wan
add action=drop chain=forward comment="Drop external" in-interface=wan
add action=reject chain=forward comment="Reject everything else"

Subnet Configuration

Now for each local subnet I add the router IP address from the pool and enable router advertisements

/ipv6 address add  address=::1 from-pool=ipv6pool interface=vlan1222
/ipv6 nd add interface=vlan1222