In this guide
Addressing
IPv6 addresses are 128 bits and are written as eight 16-bit hexadecimal hextets. Leading zeroes can be removed and one consecutive run of zero hextets can be represented by ::.
2001:db8:1234:0000:0000:0000:0000:42
2001:db8:1234::42IPv6 is classless. Prefix length, not an address class, defines the network boundary.
Prefixes and subnetting
A /64 is the normal LAN prefix length for SLAAC-capable networks and the conventional choice for end-user and server segments. It is not a protocol requirement that every conceivable IPv6 subnet must be /64, but using /64 on ordinary LANs avoids breaking assumptions made by common host and network functions.
Provider allocations such as /48 and /56 are common planning conventions. A /48 contains 65,536 /64s; a /56 contains 256 /64s. Design a hierarchy so summarisation remains possible.
2001:db8:1234::/48
2001:db8:1234:10::/64
2001:db8:1234:20::/64SLAAC and host addresses
Stateless Address Autoconfiguration allows hosts to form addresses from prefixes advertised by routers. Modern hosts do not need to derive their interface identifier from the MAC address.
EUI-64
EUI-64 is a historical interface-identifier technique that embeds information derived from a MAC address. It is useful to recognise in captures and legacy configurations, but should not be treated as the modern default.
Stable and temporary addresses
Stable opaque interface identifiers avoid exposing a hardware address in the IPv6 address. Temporary privacy addresses are intended to reduce long-term tracking. A host can therefore have multiple addresses with different lifetimes and purposes.
DHCPv6 and Router Advertisements
Router Advertisements are part of NDP and tell hosts about prefixes and default-router information. DHCPv6 can provide additional configuration and can allocate addresses in stateful designs.
RA flags commonly include A for autonomous address configuration, M for managed address configuration and O for other configuration. Exact host behaviour depends on the combination of flags and operating system.
Address types
- Global unicast: globally scoped unicast addressing; common global allocations are within
2000::/3. - Unique Local Address:
fc00::/7, with locally assigned ULAs normally usingfd00::/8. - Link-local:
fe80::/10; essential for neighbour discovery and on-link communication. - Multicast:
ff00::/8; IPv6 has no broadcast address. - Anycast: the same address can be configured at multiple locations and routing selects an appropriate instance.
NDP and ICMPv6
IPv6 does not use ARP. Neighbor Discovery uses ICMPv6 for neighbour discovery, address resolution, router discovery, Duplicate Address Detection and redirects.
| Message | Purpose |
|---|---|
| RS | Host requests router information |
| RA | Router advertises prefixes, default-router information and flags |
| NS | Neighbour discovery, address resolution and DAD |
| NA | Neighbour advertisement/response |
| Redirect | Router indicates a better next hop |
ICMPv6 is also used for error reporting and Path MTU Discovery. Blocking ICMPv6 broadly can break IPv6 rather than improve security.
IPv6 DNS
Forward DNS uses AAAA records for IPv6 addresses. Reverse DNS uses the ip6.arpa namespace. DNS64 can synthesise AAAA responses from IPv4-only destinations as part of NAT64.
Routing and default gateways
IPv6 hosts normally learn on-link prefixes and default-router information through Router Advertisements. Routers then use normal longest-prefix routing to forward traffic. Link-local addresses are important in routing protocols and as next-hop addresses because they remain valid only on the local link.
Do not treat IPv6 routing as a completely separate operational world: verify route tables, firewall policy, dynamic routing, summarisation and return paths just as you would for IPv4.
MTU and PMTUD
IPv6 routers do not fragment packets in transit. If a packet is too large for the next link, the router sends ICMPv6 Packet Too Big and the sender is expected to reduce the packet size.
This makes Path MTU Discovery especially important. Broken ICMPv6 filtering can create “works for small packets, fails for large packets” symptoms, particularly across tunnels and firewalls.
Transition technologies
Dual stack
Runs IPv4 and IPv6 concurrently. It is straightforward conceptually but requires both stacks to be secured, monitored and routed.
NAT64/DNS64
NAT64 translates IPv6 clients towards IPv4 destinations; DNS64 helps clients discover synthetic IPv6 destinations. 464XLAT can support IPv4-only applications in IPv6-only access networks.
Tunnelling
Tunnels carry IPv6 across IPv4 infrastructure but introduce overhead and additional MTU and troubleshooting considerations.
Security and troubleshooting
IPv6 needs explicit firewall policy. Do not assume global unicast means open to the internet; reachability is controlled by routing and filtering.
- Protect against rogue Router Advertisements with controls such as RA Guard where appropriate.
- Consider NDP inspection and SEND concepts in higher-risk environments.
- Monitor unexpected IPv6 addresses, RAs and neighbour changes.
- When troubleshooting, inspect RA, DAD, NS/NA, routes, DNS and ICMPv6 Packet Too Big messages.
- Test both IPv4 and IPv6 paths; applications may prefer IPv6 when it is available.
- Check whether an apparent IPv6 failure is actually DNS preference, firewall policy or an MTU problem.
Standards
- RFC 4291 — IPv6 Addressing Architecture.
- RFC 4862 — IPv6 Stateless Address Autoconfiguration.
- RFC 8200 — IPv6 Specification.
- RFC 4193 — Unique Local IPv6 Unicast Addresses.
- RFC 7217 — Stable Privacy Addresses.
- RFC 8981 — Temporary Address Extensions.
- RFC 8415 — DHCPv6.
Key takeaways
Plan IPv6 as a complete protocol stack: prefixes, RAs, NDP, ICMPv6, DNS, routing and security all matter. A successful deployment is not achieved by simply assigning 128-bit addresses.