IPv6 for People Who Know IPv4

Introduction¶

IPv6 isn't "IPv4 with more digits" — a few design choices change how you subnet, address hosts, and firewall. If you're fluent in IPv4, here's the delta.

Notation¶

• 128 bits, eight groups of 16-bit hex: 2001:0db8:0000:0000:0000:ff00:0042:8329.
• Compression: drop leading zeros per group, and :: replaces one run of all-zero groups: 2001:db8::ff00:42:8329.
• Prefix length like CIDR: 2001:db8:abcd:12::/64.
• In URLs: https://[2001:db8::1]:8080/.

The /64 rule¶

Almost every subnet is a /64. Not because you need 18 quintillion hosts, but because SLAAC (autoconfig) and other features assume a 64-bit interface identifier. You get a /56 or /48 from your provider and carve /64s out of it — one per VLAN/link. Don't use /112 or /120 "to save space"; space is not the constraint.

Address types (a host has several at once)¶

• Link-local fe80::/10 — auto-configured on every interface, only valid on that link. Used by NDP and routing protocols. Always present.
• ULA fc00::/7 (in practice fd00::/8) — the IPv6 equivalent of RFC1918 private space. Random /48, internal only.
• GUA (Global Unicast) 2000::/3 — publicly routable. Your provider delegates these.

A server typically has a link-local + a GUA (+ maybe a ULA). ip -6 addr shows them all.

Autoconfiguration: SLAAC vs DHCPv6¶

• SLAAC — the router advertises the /64 prefix (Router Advertisement, RA); the host forms its own address (prefix + interface ID, often a stable-privacy random value; older = EUI-64 from the MAC). No server needed.
• DHCPv6 — stateful, like DHCPv4, hands out specific addresses + options. Not all OSes do DHCPv6 the same way (Android famously doesn't).
• RA flags decide: M (managed → use DHCPv6 for addresses), O (other → DHCPv6 for DNS/options only), neither → pure SLAAC.
• RDNSS in the RA can supply DNS servers without DHCPv6.

The router's RA is central — a rogue RA can hijack a LAN (RA Guard on switches mitigates).

No NAT¶

IPv6 gives every device a routable address, so there's no NAT by default. What NAT gave you, and the replacement:

• "Private addressing" → ULA, or just firewall your GUAs.
• "Hiding the internal topology" → not a real security control; firewall properly.
• "One public IP, many hosts" → you have a /64+; every host gets a GUA.
• Inbound blocking → this was a NAT side effect. Now it's an explicit stateful firewall job — default-deny inbound, allow established/related. Don't skip this; hosts are directly reachable.

NPTv6 (prefix translation) exists for multihoming but is niche.

NDP replaces ARP (and more)¶

Neighbor Discovery Protocol (ICMPv6) does what ARP did, plus router discovery and address autoconfiguration:

• Neighbor Solicitation/Advertisement ≈ ARP request/reply (ip -6 neigh).
• Router Solicitation/Advertisement — find routers, get the prefix.
• DAD (Duplicate Address Detection) — check an address is unused before using it.

Crucial: do not blanket-block ICMPv6. IPv6 needs NDP, RA/RS, and PMTUD (Packet Too Big) to function. Filter ICMPv6 selectively, never -p ipv6-icmp -j DROP wholesale.

Dual stack¶

Most networks run IPv4 and IPv6 together. Clients use Happy Eyeballs — try both, use whichever connects first — so a broken IPv6 path just adds latency rather than breaking things (usually). A half-broken IPv6 (address but no working route) is worse than none.

Verification and troubleshooting¶

ip -6 addr; ip -6 route
ip -6 neigh
ping -6 2001:4860:4860::8888
ping -6 -c1 ff02::1%eth0             # all-nodes on the link
tracepath -6 example.com
sysctl net.ipv6.conf.all.forwarding  # 1 to route

• Has an IPv6 address, can't reach the internet — no default route (RA not received / accept_ra=0 on a forwarding host), or upstream doesn't route your prefix, or ICMPv6 PMTUD blocked (large packets hang — the "small pages load, big ones stall" symptom).
• SLAAC not working — RAs not arriving (router not sending, RA Guard, or net.ipv6.conf.<if>.accept_ra is 0; on a router it must be 2 to accept RAs while forwarding).
• DNS over IPv6 fails — no RDNSS/DHCPv6 DNS, or /etc/resolv.conf only has v4 resolvers (fine if they answer AAAA over v4).
• Address changes constantly — privacy extensions (temporary addresses); normal for clients, disable on servers (use_tempaddr=0) and set a static address.
• Firewall "open" — you configured iptables but not ip6tables / an nftables inet table. Every IPv4 rule needs an IPv6 counterpart (nftables inet tables cover both at once).
• ping works, TCP doesn't — MTU/PMTUD (blocked Packet Too Big), or the service isn't bound to :: (only 0.0.0.0).

Related tools and reading¶

• On-site: Subnet Calculator, IP address lookup.
• Related posts: How NAT actually works, ARP and the neighbour table.