NightFox

NightFox

IPv6 (Internet Protocol Version 6)

My biggest piece of advice about IPv6: learn it as its own network, not as "IPv4 but longer." A lot of IPv6 confusion comes from trying to map every IPv4 habit onto it. Some carry over. A lot don't, and that's kind of the point.

Why bother?

IPv4 has about 4.3 billion addresses, and we ran out a long time ago. NAT and carrier-grade NAT have stretched it, at the cost of a lot of state and weirdness. IPv6 has 128-bit addresses, which is about 340 undecillion of them. You're not going to run out.

  • Address space: no more rationing addresses or stacking NAT on NAT.
  • End-to-end addressing: devices can have real, globally routable addresses again. (You still want a firewall. No NAT does not mean no firewall.)
  • It's already here: most phones, ISPs, and big content networks are dual-stack. Your clients are probably using IPv6 right now whether you planned for it or not.

You'll sometimes read that IPv6 is "more secure because of IPsec." That's mostly a leftover from the early specs. IPsec is available for both IPv4 and IPv6, and it isn't magically turned on for you in either.

Reading the addresses

Eight groups of four hex digits, separated by colons:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

You can drop leading zeros in each group, and replace one run of all-zero groups with :: (only once per address):

2001:db8:85a3::8a2e:370:7334

They look intimidating for about a week. After that, you mostly just care about the prefix.

Kinds of addresses

  • Unicast: one interface.
  • Multicast: a group of interfaces. IPv6 uses multicast for a lot of things IPv4 used broadcast for, and there's no broadcast at all.
  • Anycast: the same address on several interfaces; routing delivers to the nearest one.

The prefixes you'll see constantly

  • Link-local, fe80::/10: every IPv6 interface has one, automatically. Routers use these as next hops, so don't be surprised to see them in your routing table.
  • Unique local (ULA), fc00::/7: sort of like private IPv4 space. In practice you'll see fd00::/8.
  • Global unicast, 2000::/3: the real, routable Internet addresses.

Rolling it out

The way I'd approach it:

  • Go dual-stack. Run IPv4 and IPv6 side by side. It's the least painful path.
  • Check your gear. Routers, switches, firewalls, monitoring, and your own software all need to handle it. Firewalls and monitoring are where gaps usually hide.
  • Firewall it properly. Write IPv6 rules on purpose. Don't block all of ICMPv6 — Neighbor Discovery and Path MTU Discovery need it.
  • Add AAAA records only once the service actually works over IPv6. A broken AAAA is worse than none.
  • Test it. test-ipv6.com is a quick sanity check from the client side.

Address planning

This is the fun part, because you finally have room. A site usually gets a /48, which gives you 65,536 /64 subnets. A simple layout:

2001:db8:abcd::/48
  ├─ 2001:db8:abcd:0000::/64  (Infrastructure)
  ├─ 2001:db8:abcd:0001::/64  (DMZ)
  ├─ 2001:db8:abcd:0002::/64  (Office LAN)
  └─ 2001:db8:abcd:0003::/64  (Wi-Fi Network)

Every LAN gets a /64, even if it has three devices on it. That feels wasteful coming from IPv4, but SLAAC expects /64s and things break in odd ways when you fight it. Tip: if you can line up the subnet number with the VLAN ID (VLAN 20 gets :20::/64), you'll thank yourself later.

Things that work differently

  • SLAAC: hosts can build their own addresses from router advertisements. No DHCP server needed.
  • Neighbor Discovery (NDP): replaces ARP, and also handles finding routers and detecting duplicate addresses.
  • No fragmentation by routers: only the sender fragments, so Path MTU Discovery needs to work. This is another reason not to block ICMPv6.
  • Multiple addresses per interface are normal: link-local, a stable address, and often temporary privacy addresses too. Keep that in mind when reading logs.

Transition mechanisms

  • Dual stack: both protocols at once. My default.
  • Tunneling: IPv6 carried over IPv4, for when your upstream doesn't offer native IPv6. Hurricane Electric's tunnel broker is how plenty of people (homelabs especially) got started.
  • NAT64/DNS64: lets IPv6-only clients reach IPv4-only servers. Common on mobile networks.

Why adoption has been slow

  • Old hardware and software that doesn't support it, or supports it badly.
  • People have to learn new habits, and IPv4 "works fine."
  • The addresses look scary at first.

None of those are great reasons anymore, in my opinion. But I get it.

Where it shows up

  • At home: lots of ISPs already hand out IPv6. Check your router; you might just need to turn it on.
  • Web hosting: configure the server, test it, then add the AAAA record.
  • IoT and big fleets: having enough addresses for every device is where IPv6 really shines.

Good places to learn more

Last Modified: October 12, 2026, 11:46 am