Understanding IPv6 on Your VPS

IPv6 adoption is accelerating as IPv4 addresses become scarce. Understanding how to configure and use IPv6 on your VPS ensures your services are accessible to the growing number of IPv6-only clients.

IPv6 Basics

# IPv6 address format: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
# Shortened: 2001:db8:85a3::8a2e:370:7334 (omit leading zeros, collapse :: for consecutive zero groups)

# Address types:
# ::1/128          — Loopback (like 127.0.0.1)
# fe80::/10        — Link-local (auto-configured, not routable)
# 2000::/3         — Global unicast (public internet)
# fc00::/7         — Unique local (like private IPv4)

# Prefix notation:
# /64  — Standard subnet (18 quintillion addresses!)
# /128 — Single address
# /48  — Typical allocation to a site

Checking IPv6 Configuration

# Check if IPv6 is enabled
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
# 0 = enabled, 1 = disabled

# View IPv6 addresses
ip -6 addr show

# Test IPv6 connectivity
ping6 -c 4 ipv6.google.com
# Or: ping -6 -c 4 ipv6.google.com

# Check default IPv6 route
ip -6 route show default

Configuring IPv6

# Netplan (Ubuntu)
network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 198.48.63.50/27
        - "2001:db8::1/64"
      routes:
        - to: default
          via: 198.48.63.33
        - to: "::/0"
          via: "2001:db8::1"
      nameservers:
        addresses:
          - 1.1.1.1
          - "2606:4700:4700::1111"

sudo netplan apply

Web Server IPv6 Configuration

# Nginx — listen on both IPv4 and IPv6
server {
    listen 80;
    listen [::]:80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;
}

DNS for IPv6

# Add AAAA records for IPv6
# In your DNS provider:
# example.com  AAAA  2001:db8::1

# Verify
dig example.com AAAA

Firewall for IPv6

# ip6tables rules (same syntax as iptables)
sudo ip6tables -P INPUT DROP
sudo ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo ip6tables -A INPUT -i lo -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# Save rules
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6

Disabling IPv6 (If Not Needed)

# If your provider does not offer IPv6, disable it to reduce attack surface
echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee /etc/sysctl.d/99-disable-ipv6.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.d/99-disable-ipv6.conf
sudo sysctl -p /etc/sysctl.d/99-disable-ipv6.conf