The internet runs on two versions of the Internet Protocol side by side. IPv4 is the original, with addresses like 203.0.113.10, and it has run out of free addresses. IPv6 is its successor, with addresses like 2001:db8::10, and enough space for every device imaginable. Most servers today run dual-stack, or at least need to understand both. Here’s what differs, and what matters when you run a server.

Side by side

IPv4 IPv6
Address length 32 bits 128 bits
Example 203.0.113.10 2001:db8:85a3::8a2e:370:7334
Address count ~4.3 billion ~3.4 × 10³⁸
Typical allocation Single addresses, NAT for private networks A /64 per network, often a /48 or /56 per site
NAT Common (home, CGNAT) Generally not needed
Configuration DHCP or static SLAAC, DHCPv6 or static
Header Variable, with a checksum Fixed 40 bytes, no checksum
Fragmentation Routers may fragment Only the sender, using Path MTU Discovery
ARP Yes Replaced by Neighbor Discovery (ICMPv6)
Reverse DNS in-addr.arpa ip6.arpa

Reading IPv6 addresses

An IPv6 address is eight groups of four hex digits:

2001:0db8:0000:0000:0000:ff00:0042:8329

Shortened by two rules:

  1. Drop leading zeros in each group: 2001:db8:0:0:0:ff00:42:8329.
  2. Replace one run of zero groups with ::: 2001:db8::ff00:42:8329.

In URLs, use brackets: http://[2001:db8::10]:8080/.

Useful ranges:

Prefix Meaning
::1 Loopback (like 127.0.0.1)
fe80::/10 Link-local (every interface has one)
fc00::/7 (in practice fd00::/8) Unique local addresses (like private IPv4)
2000::/3 Global unicast (public addresses)
2001:db8::/32 Documentation examples

NAT and reachability

With IPv4, scarcity led to NAT everywhere, so home devices aren’t directly reachable. See NAT explained. With IPv6, every device can have a globally routable address. Inbound access is controlled by firewalls, not by NAT. That makes peer-to-peer and hosting simpler, but it means your IPv6 firewall matters as much as your IPv4 one.

Performance

Neither is inherently faster. Differences come from routing: sometimes IPv6 paths are shorter, sometimes longer. Browsers use Happy Eyeballs: they try both and use whichever connects first, so a broken IPv6 path costs a small delay instead of failure.

Running a server: practical points

Check what you have

ip -6 addr show
ip -6 route
curl -6 -s https://ifconfig.co      # your public IPv6, if any
ping -6 -c 3 google.com

Services must listen on both

Many services listen on IPv4 and IPv6 by default. Check them:

sudo ss -tlnp | grep -E ':80|:443'
# [::]:443 and 0.0.0.0:443 → both

Nginx needs explicit listen [::]:443 ssl; lines alongside listen 443 ssl;. See Nginx server blocks.

Firewalls for both

  • UFW handles IPv4 and IPv6 together when IPV6=yes is set in /etc/default/ufw (the default). See UFW.
  • With raw iptables, IPv6 rules go in ip6tables, a separate rule set. Forgetting it leaves IPv6 wide open. nftables inet tables cover both. See nftables.
  • Don’t block ICMPv6 wholesale. IPv6 needs it for neighbour discovery and Path MTU Discovery. See MTU explained.

DNS: only publish AAAA if it works

An AAAA record tells IPv6 clients where to connect. If you publish one and the service doesn’t actually answer on that address, IPv6 users and validators like Let’s Encrypt may fail. Publish AAAA only after testing:

curl -6 -I https://example.com

See configure IPv6 on Linux and DNS records explained.

Mail

Sending mail over IPv6 requires reverse DNS for the IPv6 address, and SPF entries for it. Otherwise Gmail and others reject it. Without that, force Postfix to IPv4 (inet_protocols = ipv4). See PTR records.

Logs, rate limits and allow-lists

Make sure log parsers, Fail2Ban, rate limits and IP allow-lists handle IPv6 addresses. With IPv6, one user may control a whole /64, so rate limiting by single address is less effective. Limit by /64 where your tools allow it.

Do I need IPv6 on my server?

  • Outbound: helpful but rarely required, since most services are still reachable over IPv4.
  • Inbound: IPv4 alone still reaches virtually all users, through their ISPs’ dual-stack or NAT64 setups. IPv6 is a plus for IPv6-only mobile networks and future-proofing.
  • Must-have: a public IPv4 address for compatibility. All VPS.DO VPS plans include public IPv4 addresses.

Quick reference

Task IPv4 IPv6
Show addresses ip -4 addr ip -6 addr
Ping ping ping -6
DNS record A AAAA
Raw firewall iptables ip6tables (or nftables inet)
Loopback 127.0.0.1 ::1
Private 10/8, 172.16/12, 192.168/16 fd00::/8

Related: subnetting and CIDR and private IP ranges.

  • Networking
  • IPv6
  • IPv4