DocumentationVPS Linux

VPS Linux 7 min read Advanced 24.9k

IPv6 on VPS: configuration and best practices

Published on May 17, 2026

Enable and configure IPv6 properly on your Linux VPS. Addressing, firewall, DNS, services up to date. IPv6 is no longer optional in 2026: Cloudflare, Google, Apple prioritize it and some mobile networks are already v6-only.

Category: VPS Linux
Level: Advanced
Reading time: 7 min
Published: May 17, 2026

Introduction

IPv4 has been saturated for a long time. IPv6 brings:

A virtually infinite address space (340 undecillion IPs)
No NAT (each public service has its own IP)
Better network efficiency (simplified header, autoconfig)
Native connectivity to the ~40% of worldwide traffic already on IPv6

In 2026, not supporting IPv6 means excluding some users. Fortunately it's simple to configure.

Prerequisites

Linux VPS with IPv6 allocated by the host (Netrix VeryCloud provides a /64 by default)
Root access
Notes: your IPv6 and the IPv6 gateway provided by VeryCloud

Step 1: Check current IPv6

ip -6 addr show
ip -6 route show
ping6 -c 4 google.com

If you see an address 2a0c:... or 2001:... (other than fe80:: link-local), IPv6 is partially active. If no ping6 response, gateway config is missing.

Step 2: Static IPv6 config (Netplan - recent Ubuntu/Debian)

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
      dhcp6: false
      addresses:
        - 2a0c:b641:abcd::100/64
      routes:
        - to: ::/0
          via: 2a0c:b641:abcd::1
      nameservers:
        addresses:
          - 2606:4700:4700::1111
          - 2606:4700:4700::1001
          - 2001:4860:4860::8888

Apply:

sudo netplan apply

Verify:

ip -6 addr show eth0
ping6 -c 4 2606:4700:4700::1111
ping6 -c 4 ipv6.google.com

Step 3: Config via ifupdown (classic Debian)

sudo nano /etc/network/interfaces

iface eth0 inet6 static
    address 2a0c:b641:abcd::100
    netmask 64
    gateway 2a0c:b641:abcd::1
    dns-nameservers 2606:4700:4700::1111 2606:4700:4700::1001

sudo ifdown eth0 && sudo ifup eth0

Step 4: Test IPv6 connectivity

Basic tests

# DNS
host google.com
host -t AAAA google.com

# Ping
ping6 -c 4 ipv6.google.com

# HTTP via IPv6
curl -6 https://ifconfig.co
# Must return your IPv6 address

Full online test

Visit https://test-ipv6.com from your VPS (in SSH with curl and links) or from your browser: you should get 10/10.

Step 5: Configure UFW firewall for IPv6

UFW manages IPv4 and IPv6 together by default. Check:

sudo nano /etc/default/ufw

IPV6=yes

sudo ufw reload
sudo ufw status verbose

You see two entries per rule (v4 and v6).

IPv6-specific rules

# Allow a specific IPv6
sudo ufw allow from 2a0c:b641:abcd::100 to any port 22

# Block an IPv6 range
sudo ufw deny from 2a01:cb05::/32

# Allow HTTPS from anywhere (IPv4 + IPv6)
sudo ufw allow 443/tcp

Step 6: Configure iptables firewall (if not UFW)

sudo apt install -y iptables-persistent

Minimal IPv6 rules

# Default policy: DROP
sudo ip6tables -P INPUT DROP
sudo ip6tables -P FORWARD DROP
sudo ip6tables -P OUTPUT ACCEPT

# Loopback
sudo ip6tables -A INPUT -i lo -j ACCEPT

# Established sessions
sudo ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# ICMPv6 (ESSENTIAL, don't block!)
sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# SSH
sudo ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

# HTTP/HTTPS
sudo ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT

# Save
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6

⚠️ Never block all ICMPv6: it's used for neighbor discovery (ARP equivalent in IPv4), PMTU discovery, etc. Blocking ICMPv6 breaks IPv6.

Step 7: Make your services listen on IPv6

Nginx

sudo nano /etc/nginx/sites-available/site.conf

server {
    listen 80;
    listen [::]:80;
    
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    
    server_name your-domain.fr;
    # ...
}

sudo nginx -t && sudo systemctl reload nginx

Check:

ss -tlnp | grep ':80\|:443'
# Should show lines with :::80 and :::443 (= IPv6 listening)

Apache

sudo nano /etc/apache2/ports.conf

Listen 80
Listen 443
# Apache listens by default on IPv4 + IPv6 (set Listen 0.0.0.0:80 forces v4 only)

SSH

sudo nano /etc/ssh/sshd_config

ListenAddress 0.0.0.0
ListenAddress ::

Or comment both to listen on all.

Postfix

sudo postconf -e "inet_protocols = all"
sudo systemctl restart postfix

Step 8: DNS - configure AAAA records

For your site to be reachable in IPv6, add AAAA records at your registrar/DNS.

At Cloudflare, Gandi, OVH, etc.:

Type	Name	Value
A	your-domain	82.26.157.10
AAAA	your-domain	2a0c:b641🔡:100
AAAA	www	2a0c:b641🔡:100
AAAA	mail	2a0c:b641🔡:101

Check propagation:

dig AAAA your-domain.fr
host -t AAAA your-domain.fr

Step 9: Reverse DNS (PTR) IPv6

Reverse DNS is crucial for mail servers. On Netrix VeryCloud customer area:

rDNS / Reverse DNS section
Select your IPv6
Enter: mail.your-domain.fr

Test:

host 2a0c:b641:abcd::100
# Must return: mail.your-domain.fr

Step 10: Disable IPv6 (reverse case)

Sometimes you want to disable IPv6 (compatibility, debug). Temporary:

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.eth0.disable_ipv6=1

Permanent:

echo "net.ipv6.conf.all.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.d/99-disable-ipv6.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" | sudo tee -a /etc/sysctl.d/99-disable-ipv6.conf
sudo sysctl --system

Step 11: SLAAC vs DHCPv6

Two IPv6 autoconfig modes:

SLAAC (StateLess Address AutoConfiguration): client generates its IP from the prefix advertised by the router (RA). Default mode on VPS.
DHCPv6: a DHCP server distributes IPs (rarer on VPS, more common in enterprise).

On VeryCloud VPS, SLAAC is generally active if you leave dhcp6: false but accept-ra: yes in Netplan:

network:
  ethernets:
    eth0:
      accept-ra: true

Step 12: Privacy Extensions (RFC 4941)

By default, your SLAAC IPv6 is derived from MAC → traceable. On a server, not a problem (static IP anyway). On a client (laptop, mobile), enable privacy extensions:

sudo sysctl -w net.ipv6.conf.all.use_tempaddr=2
sudo sysctl -w net.ipv6.conf.default.use_tempaddr=2

Step 13: Monitoring IPv6

IPv6 traffic

sudo apt install -y iftop
sudo iftop -i eth0 -F 2a0c:b641:abcd::/64

Active IPv6 sessions

ss -6 -tn

Check IPv6 DNS servers

cat /etc/resolv.conf
nslookup google.com 2606:4700:4700::1111

Troubleshooting

ping6 timeout to internet

Gateway is probably wrong. Check:

ip -6 route show

You must have a default route ::/0 via <gateway>. Compare with what VeryCloud provided.

Site reachable in IPv4 but not IPv6

Web server is probably not listening on IPv6:

ss -tlnp | grep 443

You must see LISTEN 0 ... :::443 ... (with :::). If only 0.0.0.0:443, service is IPv4-only. Adapt config (step 7).

ICMPv6 blocked