IPv6 is enabled by default on every modern Linux system, and most people have never configured it. That combination is how a machine ends up carefully firewalled on IPv4 and wide open on IPv6.

Reading the addresses

ip -6 addr show

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
    inet6 2001:db8:1234:5678:a1b2:c3d4:e5f6:7890/64 scope global dynamic
    inet6 2001:db8:1234:5678:1a2b:3c4d:5e6f:7a8b/64 scope global temporary
    inet6 fe80::a1b2:c3d4:e5f6:7890/64 scope link

Three addresses on one interface, which is normal.

fe80::/10, link-local. Every IPv6 interface has one, configured automatically, valid only on that network segment. Used for neighbour discovery and routing. Because the same link-local address can exist on several interfaces, you must specify a scope:

ping6 fe80::1%eth0

Global, stable. Routable on the internet, derived from the prefix the router advertised.

Global, temporary. A privacy address that rotates periodically and is used for outgoing connections, so your traffic is not trivially linkable to one machine over time.

Other prefixes worth recognising: fc00::/7 is unique local, the rough analogue of RFC 1918 private space, and ::1 is loopback.

Autoconfiguration

The default model is SLAAC. The router periodically broadcasts a Router Advertisement containing the network prefix, and hosts generate their own addresses from it.

No server tracks assignments, which is a real architectural difference from DHCP.

ip -6 route show
sysctl net.ipv6.conf.eth0.accept_ra

DHCPv6 also exists for networks that want central control, and many networks run both: SLAAC for addressing and DHCPv6 for DNS servers and other options.

Our IP addresses guide covers the IPv4 side for comparison.

The firewall problem

This is the section that matters.

IPv4 and IPv6 rules are separate. In the older tooling, iptables and ip6tables are different commands managing different tables. A rule added with iptables does absolutely nothing for IPv6 traffic.

So a server with a carefully configured IPv4 firewall can be fully reachable over IPv6, and everything looks fine because IPv4 testing passes.

# Check both
sudo iptables -L -n
sudo ip6tables -L -n

# Or with nftables, where inet covers both
sudo nft list ruleset

The fix is nftables with the inet family, which handles both protocols in one table so rules cannot diverge. This is the strongest practical argument for nftables over iptables and our rule builder generates the inet form by default.

ufw applies rules to both protocols by default, provided IPV6=yes is set in /etc/default/ufw, which it is on modern versions. firewalld also handles both.

No NAT means the firewall is load-bearing

On IPv4, NAT accidentally provided a firewall. An internal machine with a private address was unreachable from outside because there was no route to it, regardless of whether you had thought about firewalling.

IPv6 gives every device a globally routable address. The router forwards rather than translating. There is a real route to your laptop, your NAS, and your printer.

That is architecturally cleaner and it removes the accidental protection. A stateful firewall is now doing deliberately what NAT did by accident, and it has to be configured.

Check what is actually exposed:

sudo ss -tlnp | grep -E '\*:|\[::\]'

Anything bound to [::] is listening on all IPv6 interfaces.

Testing

ping6 2001:4860:4860::8888          # Google DNS over IPv6
curl -6 https://ifconfig.co          # your public IPv6 address
curl -4 https://ifconfig.co          # your public IPv4 address
dig AAAA example.com                 # IPv6 records

Our dig guide covers the AAAA lookups, and note that a host with both A and AAAA records will usually be reached over IPv6 first by a dual-stack client. That is why a service that works “sometimes” can be an IPv6 path problem.

Please do not disable it

Disabling IPv6 is a very common recommendation and almost always the wrong fix. It breaks software that expects it, it does not solve the underlying problem, and it leaves you unprepared for networks that are IPv6-only.

If IPv6 is causing trouble, configure the firewall properly or diagnose the specific failure. Turning it off is treating a symptom by removing half the network stack.

Frequently Asked Questions

Why does my machine have several IPv6 addresses?

Because IPv6 expects it. There is always a link-local address for the local segment, usually a stable global address, and often a temporary privacy address that rotates for outgoing connections. All coexist normally.

What is a link-local address?

An address starting fe80 that every IPv6 interface configures automatically and that is only valid on the local network segment. It is used for neighbour discovery and routing protocols, and it requires a scope identifier when you use it because the same address can exist on several interfaces.

How is IPv6 autoconfiguration different from DHCP?

A router advertises the network prefix and hosts generate their own addresses from it, so no server tracks assignments. DHCPv6 also exists for cases where central control is needed, and many networks use both together.

Why is my firewall not blocking IPv6 traffic?

Because IPv4 and IPv6 have separate rule tables in the older iptables model, and rules added with iptables do nothing for IPv6. This is the single most common IPv6 security mistake, and using nftables with the inet family avoids it entirely.

Is there NAT in IPv6?

It exists and is not the normal model. There are enough addresses for every device to have a globally routable one, so the router forwards rather than translating. That means a firewall is doing the work NAT accidentally did on IPv4, and it must be configured deliberately.

Should I disable IPv6?

No, in almost all cases. Disabling it breaks things that expect it and is often recommended as a cargo-cult fix for unrelated problems. If it is causing trouble, configure it correctly or fix the specific issue rather than turning it off.