🌐 IPv6

🔹 IPv4 vs IPv6 Basics

Feature	IPv4	IPv6
Address Size	32-bit (~4.3 billion addresses)	128-bit (~340 undecillion addresses)
Format	4 decimal numbers, dot-separated	8 groups of 4 hex digits, colon-separated
Example	`192.168.0.21`	`2401:xxxx:xxxx:xxxx::21`
NAT	Common (private → public mapping)	Not needed, direct global addressing
Config	Manual / DHCP (DHCPv4)	SLAAC (RA) + optional DHCPv6
DNS Records	`A` record	`AAAA` record
Security	IPSec optional	IPSec mandatory (spec in protocol, not always enforced in practice)

🌐 IPv6 Address Types

Address Type	Prefix / Range	Scope	Reachable From	Typical Use
Global Unicast	`2000::/3` (e.g., 2401:...)	Internet-routable	Anywhere on the Internet	Public IPv6 addresses; host websites, servers, direct remote access
Link-Local	`fe80::/10`	Link-only (LAN)	Same LAN only	Neighbor discovery, router communications, internal traffic
Unique Local (ULA)	`fc00::/7` (commonly `fd00::/8`)	Private LAN / site-local	LAN or VPN only	Internal private networks, similar to IPv4 `192.168.x.x`

Notes:

Link-local addresses (fe80::) are automatically assigned; not routable beyond LAN.
ULA is optional for internal-only communication; not reachable from the Internet.
Global addresses are usually assigned via SLAAC (RA) or DHCPv6; routable externally.

📌 IPv6 Address Assignment

IPv6 global addresses can be assigned in several ways:

SLAAC (Stateless Address Autoconfiguration)
The most common method. Routers send Router Advertisements (RA) with the network prefix, and clients auto-generate their own global IPv6 addresses.
→ This is why you often see a 2401:xxxx:... address appear automatically, even without iface inet6 dhcp.
DHCPv6
Provides address assignment and optional parameters (DNS, NTP, etc.), but in most home networks DHCPv6 is not used for delivering the global IPv6 address itself. ISPs/routers often rely on SLAAC instead.
Static assignment
You can manually configure a global IPv6 address if needed.

✅ Note: In typical home setups, SLAAC handles the global address, while DHCPv6—if enabled—may only supply DNS or extra configuration details.

🔧 Debian Network Configuration Examples

SLAAC (most common in home networks)

auto enp6s18
iface enp6s18 inet6 auto

DHCPv6 (if explicitly provided by ISP/router)

auto enp6s18
iface enp6s18 inet6 dhcp

Dual Stack (IPv4 + IPv6)

auto enp6s18
iface enp6s18 inet dhcp

iface enp6s18 inet6 auto
# or use "dhcp" if DHCPv6 is available

🔍 Checking IPv6 on Linux

Show interface details:

ip -6 addr show

Typical output:

inet6 2401:xxxx:xxxx:xxxx::21/64 scope global dynamic
inet6 fe80::be24:11ff:fe1e:4cdc/64 scope link

Global IPv6 → public, routable.
Link-local (fe80::/64) → local LAN only.

🚏 Confirming IPv6 Gateway

Check routes:

ip -6 route show

Example:

2401:xxxx:xxxx:xxxx::/64 dev eth0 proto kernel metric 256
default via fe80::3e6a:d2ff:fef6:30d2 dev eth0 proto ra

default via fe80::3e6a:d2ff:fef6:30d2 → router’s link-local IPv6 gateway.

🧪 Testing IPv6 Connectivity

Ping IPv6 host:

ping6 google.com

Check AAAA DNS record:

dig AAAA google.com

Curl with IPv6:

curl -6 https://google.com

🔹 Common Practice: IPv4 ↔ IPv6 Mapping

In dual-stack networks, admins often mirror the last octet of the IPv4 address into IPv6 for easier identification.

Example:

IPv4 → 192.168.0.21
IPv6 → 2401:xxxx:xxxx:xxxx::21

This keeps device mapping consistent.

🛠 Debugging IPv6 Issues

If you only see fe80:: but no global IPv6, or IPv6 connectivity fails:

Check Router Advertisements (RA)
```
apt install -y ndisc6   # provides rdisc6 
rdisc6 enp6s18
```
- Should show the router’s link-local IPv6 and advertised prefixes.
- Look for Prefix and Autonomous address conf. → yes = SLAAC possible.
- If nothing appears → router isn’t sending RA.
Check Kernel Settings and Forwarding
```
# Check IPv6 forwarding
sysctl net.ipv6.conf.all.forwarding
sysctl net.ipv6.conf.ens18.forwarding

sysctl net.ipv6.conf.all.accept_ra
sysctl net.ipv6.conf.default.accept_ra
sysctl net.ipv6.conf.ens18.accept_ra
```
Notes:
- Forwarding disabled (0): interface is a host; accept_ra=1 is sufficient.
- Forwarding enabled (1): interface behaves like a router; you must set accept_ra=2 for RA to be accepted and SLAAC to work.

Modify accept_ra Temporarily

# For forwarding interfaces, accept RA even while forwarding
sysctl -w net.ipv6.conf.ens18.accept_ra=2
sysctl -w net.ipv6.conf.all.accept_ra=1

Make accept_ra Permanent
1. Create /etc/sysctl.d/99-ipv6-custom.conf) and add:
```
# Accept RA even with forwarding enabled 
net.ipv6.conf.ens18.accept_ra = 2
```
1. Apply immediately without reboot:
```
sysctl --system
```
- Now the setting persists after reboot.

Bring the Interface Down/Up to Trigger SLAAC

ip link set dev ens18 down
ip link set dev ens18 up

# Or
systemctl restart networking

Manually Request IPv6 via DHCPv6 (if ISP requires it)
```
dhclient -6 -v enp6s18
```
- If you get an address here, your network uses DHCPv6, not just SLAAC.
Check Assigned IPv6 Addresses
```
ip -6 addr show dev ens18
```
- Look for inet6 2401:xxxx:xxxx:xxxx::xxxx/64 scope global.
- fe80::/64 = link-local, only for local network.
Check Routing Table
```
ip -6 route show
```
- Should show a global prefix route and a default route via the router’s link-local address (fe80::...).
- If no default route, manually add it:
```
ip -6 route add default via fe80::<router-link-local> dev ens18
```

Confirm Outbound Connectivity

ping6 2001:4860:4860::8888   # Google IPv6 DNS
curl -6 https://google.com

✅ Key Notes

IPv4 (192.168.x.x) → requires NAT/port forwarding for external access.
IPv6 (2401:...) → devices are globally reachable (if firewall/ISP allows).
Even if IPv6 is configured, many ISPs still run dual stack (both IPv4 + IPv6) for compatibility.
If you move to a new house or switch ISPs, all manually configured or mirrored addresses (IPv4 → IPv6 host part) must be updated.

ngoc-minh-do/ipv6.md

Select an option

No results found