IPv6 is the successor to IPv4 and was designed to solve a simple problem: IPv4 addresses have run out. Many providers already enable it on home connections, often without the user noticing. Understanding how it works avoids surprises, especially on the security front, because some habits formed with IPv4 no longer apply.
Much longer addresses
An IPv6 address is 128 bits long instead of 32. It is written in hexadecimal, in eight groups of four digits separated by colons:
2001:0db8:0000:0000:0000:ff00:0042:8329
To make it readable, two rules apply:
- leading zeros in each group can be omitted (
0db8becomesdb8); - one single run of all-zero groups can be replaced with
::.
The address above therefore becomes 2001:db8::ff00:42:8329. The 2001:db8::/32 block is reserved for documentation, which is why it appears in examples.
Prefixes: your provider gives you a whole network
With home IPv4 you get a single public address. With IPv6 the provider instead assigns a prefix, a block of addresses, typically a /56 or a /48, sometimes just a /64. The standard convention is that each local network (each segment, each VLAN) uses a /64.
In practice:
| Prefix received | /64 networks available |
|---|---|
| /64 | 1 |
| /60 | 16 |
| /56 | 256 |
| /48 | 65,536 |
A /64 alone contains an enormous number of addresses, 2 to the power of 64. There is no point in "saving" them: the scarcity typical of IPv4 disappears here.
How devices get an address
IPv6 has two main mechanisms:
- SLAAC (stateless address autoconfiguration): the router periodically announces the network prefix in messages called Router Advertisements, and each device builds its own address within that prefix.
- DHCPv6: a server assigns addresses much like IPv4 DHCP. Note that Android does not support DHCPv6 for address assignment, so on networks with Android devices SLAAC remains essential.
Every interface also has a link-local address, starting with fe80::, valid only on the local segment and used for housekeeping communication, such as talking to the router.
Many operating systems also generate temporary addresses for privacy, which change periodically and are used for outgoing connections, so that websites cannot track a device through a fixed address.
No NAT: every device is addressable
This is the most important practical change. IPv6 does not need NAT: every device has a global address, reachable in theory from anywhere on the Internet.
With IPv4, NAT effectively blocked inbound connections, even though it was never designed as a security measure. In IPv6 this implicit protection does not exist. Protection must come from the router's firewall, which should:
- allow outbound traffic and the related replies;
- block unsolicited inbound connections;
- allow essential ICMPv6 messages, without which IPv6 does not work properly.
Almost all modern routers apply this policy by default, but it is worth checking in the IPv6 firewall section. To expose a service you do not use port forwarding: you open a rule allowing traffic to that device's address and port.
ICMPv6: do not block it wholesale
In IPv4 many administrators blocked ICMP without much consequence. In IPv6 that is a mistake. ICMPv6 carries core functions:
- neighbour discovery (the equivalent of ARP);
- router advertisements;
- "packet too big" messages, which are necessary because IPv6 routers do not fragment packets in transit.
Blocking it causes problems that are hard to diagnose, such as sites that load halfway or connections that stall with large packets.
Dual stack: IPv4 and IPv6 together
Today the most common setup is dual stack: the network uses IPv4 and IPv6 at the same time. When a site has both addresses, the operating system tends to prefer IPv6 and falls back to IPv4 if the connection does not succeed quickly, thanks to a mechanism called Happy Eyeballs.
For anyone running a server or website, dual stack means:
- publishing both the A record (IPv4) and the AAAA record (IPv6) in DNS;
- checking that firewalls and services also listen on IPv6;
- making sure logs, access restrictions and blocking rules also account for IPv6 addresses.
A frequent mistake is to protect a server well on IPv4 and leave the same service open on IPv6, where nobody has configured any rules.
In short
- IPv6 uses 128-bit addresses, and the provider assigns a prefix, not a single address.
- Each local network uses a /64; devices configure themselves via SLAAC or DHCPv6.
- Without NAT every device is addressable: the router firewall becomes essential.
- ICMPv6 must not be blocked indiscriminately, because the protocol depends on it.
- In dual stack, make sure security rules and services are consistent across both protocols.
