diff --git a/global-functions.rsc b/global-functions.rsc
index 5c98a206..7b3a56fd 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -62,6 +62,7 @@
 :global MIN;
 :global MkDir;
 :global NetMask4;
+:global NetMask6;
 :global NotificationFunctions;
 :global ParseDate;
 :global ParseKeyValueStore;
@@ -998,6 +999,34 @@
   :return ((255.255.255.255 << (32 - $CIDR)) & 255.255.255.255);
 }
 
+# return an IPv6 netmask for CIDR
+:set NetMask6 do={
+  :local FuncName $0;
+  :local CIDR [ :tostr $1 ];
+
+  :global NetMask6Cache;
+
+  :global GetRandom20CharAlNum;
+
+  :if ([ :typeof $NetMask6Cache ] = "array") do={
+    :return ($NetMask6Cache->$CIDR);
+  }
+
+  :set NetMask6Cache { "128"=(~::) };
+
+  :local GenList ($FuncName . "-" . [ $GetRandom20CharAlNum ]);
+  :for I from=0 to=127 do={
+    /ipv6/firewall/address-list/add dynamic=yes timeout=1m list=$GenList address=((~::) . "/" . $I) comment=$I;
+  }
+  :foreach FwAddrList in=[ /ipv6/firewall/address-list/find where list=$GenList ] do={
+    :local Address [ /ipv6/firewall/address-list/get $FwAddrList ];
+    :set ($NetMask6Cache->($Address->"comment")) \
+      [ :toip6 [ :pick ($Address->"address") 0 [ :find ($Address->"address") "/" ] ] ];
+  }
+
+  :return ($NetMask6Cache->$CIDR);
+}
+
 # prepare NotificationFunctions array
 :if ([ :typeof $NotificationFunctions ] != "array") do={
   :set NotificationFunctions ({});