IPv6 is the sixth version of the IP protocol, with 128-bit addresses. It is the answer to IPv4 address exhaustion. An IPv6 address looks like this: 2001:db8::1 — eight groups of four hexadecimal digits.

IPv4 vs IPv6 Comparison

Parameter	IPv4	IPv6
Address length	32 bits	128 bits
Number of addresses	~4.3 billion	340 × 10^36
Notation	192.168.1.1	2001:db8::1
NAT	Required	Not needed
DHCP	Mandatory	SLAAC (auto-configuration)
IPSec	Optional	Built in

Reading IPv6 Addresses

# Full form
2001:0db8:0000:0000:0000:0000:0000:0001

# Shortened (drop leading zeros, :: = groups of zeros)
2001:db8::1

# Loopback (the equivalent of 127.0.0.1)
::1

# All addresses (the equivalent of 0.0.0.0)
::

# Examples with services
::ffff:192.168.1.1  # IPv4-mapped IPv6 address

Configuring IPv6 with Netplan (Ubuntu 22.04+)

# /etc/netplan/01-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
      dhcp6: false
      addresses:
        - "2001:db8:1::/64"       # your IPv6 block from the provider
      routes:
        - to: "::/0"
          via: "fe80::1"          # provider IPv6 gateway
      nameservers:
        addresses:
          - "8.8.8.8"
          - "2001:4860:4860::8888"  # Google DNS IPv6

sudo netplan apply

Checking IPv6 Connectivity

# Ping IPv6
ping6 google.com
ping6 2001:4860:4860::8888

# Show IPv6 addresses
ip -6 addr show

# IPv6 routing table
ip -6 route show

# Traceroute over IPv6
traceroute6 google.com

Configuring UFW for IPv6

# Enable IPv6 in UFW
# /etc/default/ufw
IPV6=yes

# Allow SSH over IPv6
ufw allow in on eth0 to any port 22 proto tcp

sudo ufw reload

💡 Dual Stack: Modern servers run on IPv4 and IPv6 at the same time. The browser picks IPv6 automatically when it is available (Happy Eyeballs, RFC 6555). Nginx and Apache listen on both protocols automatically on :: (all).

⚠️ UFW blocks IPv6 by default: If you enabled UFW but did not set IPV6=yes, IPv6 traffic bypasses the firewall rules. Always check /etc/default/ufw.

A Special Case: IPv6-only VPS

Some budget plans provide only an IPv6 address, with no IPv4 at all. Such a server reaches IPv4 hosts through the provider's NAT64 gateway and a DNS64 resolver, which synthesizes IPv6 addresses for domains that only have an A record.

# Check whether the server is actually IPv6-only
ip -4 addr show | grep inet
# If there are no inet (IPv4) lines at all, outbound IPv4 traffic goes only through NAT64

# Point at a public DNS64 resolver if the provider did not supply its own
nameserver 2001:67c:2b0::4

On such a server, some legacy services that strictly check the sender's outbound IPv4 address may refuse the connection — worth confirming with the provider before ordering the plan.

Common IPv6 Errors on a VPS

Symptom	Cause
connect: Network is unreachable on ping6	No IPv6 address is assigned to the interface at all, or the default route for ::/0 is missing from the routes section
RTNETLINK answers: File exists	The address is already assigned to the interface automatically via SLAAC and is being added again manually with the same command
sysctl: cannot stat .../disable_ipv6	IPv6 is fully disabled at the kernel level via ipv6.disable=1 in GRUB — sysctl cannot find the corresponding file under /proc
ip -6 addr shows only fe80::...	The provider has not assigned a global /64 block, or the block is missing from netplan; the link-local address always exists even without real IPv6 connectivity
The site does not open over IPv6 even though ping6 works	The web server is explicitly bound to an IPv4 address instead of `::` (all); change the listen address in its config

When IPv6 Is Not Needed Yet

The VPS provider does not offer an IPv6 block on this plan — with no address from the provider there is nothing to configure; request a separate /64 from support
The site's audience is almost entirely on IPv4 networks — this shows up in the web server logs; enabling IPv6 would add little benefit while adding surface area for firewall rules
Third-party services you depend on still lack IPv6 support (some payment gateways, legacy APIs) — outbound connections to them still need IPv4, dual stack does not replace it
There is no time to duplicate every firewall rule for IPv6 — open ports over IPv6 under an enabled dual stack create a false sense of security when the rules were only ever written for iptables and IPv4

Verifying the Result

IPv6 setup is closely tied to basic networking concepts and the server's identity — see the articles on IPv4 addressing and on changing the hostname. For the web server, also check the settings covered in the article on configuring Nginx — whether it listens on ::.

# Confirm the server responds over IPv6 from the outside
curl -6 -I https://example.com

# Check that port 80 is also listening on the IPv6 socket —
# the output should include a line with [::]:80, not just 0.0.0.0:80
ss -tlnp | grep ':80'