IPv6 Basics: Enabling, Configuring, and Common Pitfalls

The IPv4 address pool ran dry years ago, and a growing share of networks now reach the internet over IPv6 only. Configuring IPv6 on your server lets IPv6-only clients connect to you directly and reduces your reliance on carrier-grade NAT. This guide focuses on Ubuntu/Debian with netplan and walks through the full path: enabling, configuring, and troubleshooting.

Why IPv6 Matters

• No more address scarcity. IPv6 offers a 128-bit address space, effectively ending the shortage that plagues IPv4.
• Broader reach. Many mobile and some residential networks hand out IPv6 only; without it, those users may not reach your service at all.
• One less layer of NAT. Every host can hold a routable public address, so connections stay end-to-end.

The Address Format at a Glance

An IPv6 address is 128 bits, written as eight groups of four hexadecimal digits separated by colons:

2001:0db8:0000:0000:0000:0000:0000:0001

You can shorten it: drop leading zeros in each group, and collapse one run of all-zero groups with a single :: (allowed only once per address). The address above is equivalent to:

2001:db8::1

A couple of prefixes to recognize: fe80::/10 is link-local (every interface has one; not routable), and providers typically hand you a /64 subnet to work with.

Enabling and Configuring on a VPS

First, confirm whether your provider has already assigned IPv6, whether you got a single address or a full /64 block, and what the gateway is. With those details in hand, edit your netplan config (files live under /etc/netplan/, usually named something like 01-netcfg.yaml):

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
      addresses:
        - "2001:db8:1234:5678::100/64"
      routes:
        - to: "::/0"
          via: "fe80::1"

Swap the interface name (eth0), address, and gateway (via) for the values your provider gave you. On many providers the IPv6 gateway is simply the link-local address fe80::1. Then apply:

sudo netplan try     # confirm within 60s; a bad config auto-reverts
sudo netplan apply

If your provider supports SLAAC or DHCPv6, you can instead set dhcp6: true and let the system configure itself.

Verifying Connectivity

ip -6 addr show eth0        # you should see your global address (scope global)
ip -6 route show           # confirm a default route ::/0 exists
ping6 -c 3 2606:4700:4700::1111   # reach the public internet (Cloudflare DNS)

A successful ping6 means your address, route, and gateway are all correct. If you get Network is unreachable, the gateway or default route is almost certainly the culprit.

Adding an AAAA Record

IPv4 uses A records; IPv6 uses AAAA records. Add one in your DNS provider's console:

Type: AAAA    Host: www    Value: 2001:db8:1234:5678::100

Verify it:

dig AAAA www.example.com +short

Dual-Stack

Dual-stack means a host runs IPv4 and IPv6 at the same time. A single domain can carry both A and AAAA records, and clients pick whichever protocol is available (modern systems prefer IPv6). It's the smoothest way to migrate: legacy clients stay on IPv4 while IPv6-only clients still reach you, with no disruption to either.

Common Pitfalls

• Address set, gateway forgotten. You can ping hosts on the same subnet but nothing beyond it. Always configure the default route ::/0.
• The firewall needs IPv6 rules of its own. IPv4 and IPv6 rulesets are independent. iptables rules don't touch IPv6 — use ip6tables. With ufw, both stacks are managed together, but confirm IPV6=yes in /etc/default/ufw before opening ports:

sudo ufw allow 443/tcp     # applies to both IPv4 and IPv6
sudo ip6tables -L -n       # inspect IPv6 rules directly

• The service only listens on IPv4. A process bound to 0.0.0.0 hears IPv4 alone; bind to :: (or add a second IPv6 listener) instead. Use ss -6 -tlnp to confirm the port is open on IPv6 too.

Summary

The core steps to bring up IPv6 on a VPS: confirm the provider's allocation, set the address and gateway in netplan, verify with ip -6 addr and ping6, then add an AAAA record. Keep two rules front of mind: don't skip the default route, and open the firewall for IPv6 separately. Once you're dual-stacked, both legacy and IPv6-only users reach your service without a hitch.