IPv6 on a VPS: Why It Matters in 2025 and How to Enable Dual-Stack Networking
IPv4 address exhaustion is no longer a theoretical future problem — regional internet registries have been allocating addresses from reserved pools for years, and acquiring new IPv4 addresses costs real money. IPv6 solves the address scarcity problem with an effectively unlimited address space, and its adoption has accelerated significantly since 2023. In 2025, a meaningful portion of global internet traffic — over 40% by some measurements — travels over IPv6. Enabling IPv6 on your VPS is no longer optional for organizations serious about performance, future-proofing, and reaching the full scope of their audience.
Why IPv6 Matters for VPS Hosting
Growing IPv6 Traffic Share
Mobile networks in the United States, India, and Western Europe deliver a significant majority of their traffic over IPv6. T-Mobile USA, Verizon, and AT&T run primarily IPv6 networks. Users on these networks reaching an IPv4-only server require address translation (NAT64/DNS64) that adds latency and complexity. A dual-stack server serves these users directly over IPv6 without translation overhead.
No NAT Required
IPv6 was designed for end-to-end connectivity — every device gets a globally routable address. This eliminates NAT (Network Address Translation), which adds complexity and latency in IPv4 networks. Direct addressing simplifies firewall rules, improves peer-to-peer application performance, and makes server logs more accurate (you see the actual client IP, not a NAT gateway).
Future-Proofing Infrastructure
New internet infrastructure — IoT devices, 5G networks, emerging markets — is being built IPv6-first. Applications that do not support IPv6 will increasingly face connectivity issues as the transition accelerates. Configuring IPv6 now, while it is additive rather than disruptive, is significantly easier than retrofitting it later.
SEO and Performance
Browsers connecting over IPv6 often see lower latency due to shorter routing paths on IPv6-native networks. Google’s web crawlers support IPv6 and prefer IPv6 connections when available. Enabling IPv6 ensures your site performs optimally for the growing segment of users on IPv6-native networks.
Step 1: Verify IPv6 Support on Your VPS
First, confirm your VPS provider has assigned an IPv6 address and that the kernel supports IPv6:
# Check if an IPv6 address is assigned
ip -6 addr show
# Check if IPv6 is enabled in the kernel
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
# 0 = enabled, 1 = disabledIf no IPv6 address is shown, contact your VPS provider. VPS.DO includes IPv6 addresses on all plans — check your control panel to find your assigned IPv6 address and prefix.
Step 2: Configure the Network Interface for IPv6
On Ubuntu 22.04 with Netplan
sudo nano /etc/netplan/50-cloud-init.yamlnetwork:
version: 2
ethernets:
eth0:
dhcp4: true
dhcp6: true
# Or configure static IPv6 if your provider assigns a static address:
# addresses:
# - "2001:db8:1234:5678::1/64"
# routes:
# - to: "::/0"
# via: "2001:db8:1234:5678::1"
# nameservers:
# addresses:
# - "2606:4700:4700::1111" # Cloudflare IPv6 DNS
# - "2001:4860:4860::8888" # Google IPv6 DNSsudo netplan apply
ip -6 addr show eth0Verify IPv6 Connectivity
# Ping IPv6 Google DNS
ping6 2001:4860:4860::8888
# Check routing
ip -6 route show
# Test connectivity to an IPv6-only service
curl -6 https://ipv6.icanhazip.comStep 3: Enable IPv6 in the Kernel
Ensure IPv6 is enabled and properly configured at the kernel level:
sudo nano /etc/sysctl.d/40-ipv6.conf# Enable IPv6
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
# Accept Router Advertisements (for SLAAC address assignment)
net.ipv6.conf.all.accept_ra = 2
net.ipv6.conf.default.accept_ra = 2
# Enable forwarding if this server routes between interfaces
# net.ipv6.conf.all.forwarding = 1
# Privacy extensions (generates temporary addresses for outbound connections)
net.ipv6.conf.all.use_tempaddr = 2sudo sysctl -p /etc/sysctl.d/40-ipv6.confStep 4: Configure UFW Firewall for IPv6
UFW applies separate rule sets for IPv4 and IPv6. Verify IPv6 is enabled in UFW’s configuration:
sudo nano /etc/default/ufwIPV6=yes# Add IPv6-equivalent rules for your services
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw reload
# Verify IPv6 rules are active
sudo ufw status verboseUFW rules without an explicit proto apply to both IPv4 and IPv6 when IPV6=yes is set. Rules like allow ssh automatically create both IPv4 and IPv6 allow rules.
Step 5: Configure Nginx for Dual-Stack
Nginx listens on IPv4 by default. Configure it to accept connections on both IPv4 and IPv6:
sudo nano /etc/nginx/sites-available/yourdomain.comserver {
listen 80;
listen [::]:80; # IPv6 listener
listen 443 ssl http2;
listen [::]:443 ssl http2; # IPv6 SSL listener
server_name yourdomain.com www.yourdomain.com;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
# ... rest of your configuration
}The [::]:80 syntax specifies the IPv6 wildcard address. This makes Nginx accept HTTP connections from both IPv4 and IPv6 clients on port 80.
sudo nginx -t && sudo systemctl reload nginxStep 6: Configure SSH for IPv6
OpenSSH listens on all interfaces (including IPv6) by default. Verify your SSH configuration allows this:
sudo nano /etc/ssh/sshd_config# Listen on all interfaces (both IPv4 and IPv6)
ListenAddress 0.0.0.0
ListenAddress ::If you have restricted SSH to specific IP addresses in your UFW rules or sshd_config, add the IPv6 address or prefix of authorized clients.
Step 7: Configure DNS AAAA Records
Add an AAAA record (IPv6 equivalent of the A record) to your domain’s DNS:
# A record (IPv4 — existing)
yourdomain.com. IN A 203.0.113.10
# AAAA record (IPv6 — add this)
yourdomain.com. IN AAAA 2001:db8:1234:5678::1After adding the AAAA record, verify it resolves correctly:
dig AAAA yourdomain.com
# Should return your IPv6 address
# Test that the site is accessible over IPv6
curl -6 https://yourdomain.comStep 8: Issue SSL Certificates for IPv6
Let’s Encrypt supports IPv6 natively. If your server is accessible via both IPv4 and IPv6, Certbot works without modification. If your server is only accessible via IPv6, use the DNS challenge instead of the HTTP challenge:
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
# Certbot automatically handles both IPv4 and IPv6 if both A and AAAA records existStep 9: Configure Fail2ban for IPv6
Fail2ban must be configured to ban IPv6 addresses, not just IPv4:
sudo nano /etc/fail2ban/jail.local[DEFAULT]
banaction = ufw
banaction_allports = ufw
[sshd]
enabled = true
mode = aggressiveThe ufw ban action blocks both IPv4 and IPv6 addresses automatically.
Testing Your IPv6 Configuration
Online Testing Tools
- test-ipv6.com — Comprehensive IPv6 connectivity test from a browser
- whatismyipv6.com — Shows your current IPv6 address if connected via IPv6
- ipv6-test.com/validate.php — Validates that your server responds correctly over IPv6
Command-Line Testing
# Test HTTP over IPv6
curl -6 -I https://yourdomain.com
# Test DNS resolution including AAAA
dig +short yourdomain.com AAAA
# Verify Nginx is listening on IPv6
ss -tlnp | grep nginx
# Check access logs for IPv6 visitors
grep ":" /var/log/nginx/access.log | head -20IPv6 Address Types to Understand
- Global unicast (2000::/3): Public routable addresses — used for server listeners and DNS records
- Link-local (fe80::/10): Auto-configured, not routable beyond the local network segment — used for routing protocol communication
- Loopback (::1): Equivalent to IPv4 127.0.0.1 — used for local service communication
- Unspecified (::): Wildcard address — used in listen directives to accept connections from any IPv6 address
Getting Started
IPv6 is included with all USA VPS plans and Hong Kong VPS plans at VPS.DO. Find your assigned IPv6 address in the control panel at my.vps.do, and follow the steps in this guide to enable dual-stack operation. The full configuration — network interface, firewall, Nginx, SSH, and DNS — can be completed in under 30 minutes.
Conclusion
IPv6 configuration on a VPS is a straightforward process once you understand the components involved: kernel network configuration, firewall rules for both address families, application listeners on both IPv4 and IPv6, and DNS AAAA records. With over 40% of internet traffic now IPv6 and growing, enabling dual-stack is no longer a future consideration — it is current best practice for any VPS serving public internet traffic.
