IPv6 Not Working on Your Server? How to Troubleshoot

If IPv6 is not working on your server, the cause is almost always one of four things: the server’s network interface has no IPv6 address, the router or firewall is dropping IPv6 traffic, the ISP does not provide IPv6 connectivity, or a service is bound only to IPv4. This guide walks through each layer in order, from checking basic interface configuration to testing end-to-end connectivity, so you can isolate and fix the problem quickly.

Background: Why IPv6 Matters and How It Differs

IPv6 was designed to replace IPv4 because the 32-bit IPv4 address space (about 4.3 billion addresses) is exhausted. IPv6 uses 128-bit addresses, providing roughly 340 undecillion addresses. Besides the larger address space, IPv6 eliminates NAT (Network Address Translation) for most use cases, restores end-to-end connectivity, and includes built-in IPsec support (though it is optional in practice).

Unlike IPv4, which is almost always configured with DHCP, IPv6 uses two main configuration methods: SLAAC (Stateless Address Autoconfiguration) and DHCPv6. SLAAC lets a host derive its address from router advertisements (RAs) sent by the router, while DHCPv6 provides additional options like DNS servers. Many networks use both: SLAAC for addressing, DHCPv6 for DNS. Understanding this distinction is critical because a server may get an IPv6 address via SLAAC but still lack a DNS server, making it appear “not working” when it actually has connectivity.

Step 1: Verify the Interface Has an IPv6 Address

Start by checking whether the server’s network interface has an IPv6 address at all. The command differs by OS:

• Linux: ip -6 addr show (or ifconfig on older systems). Look for an inet6 line with a scope global (not link).
• Windows Server: netsh interface ipv6 show addresses or Get-NetIPAddress -AddressFamily IPv6 in PowerShell.
• FreeBSD/macOS: ifconfig and look for inet6 entries.

If you see only a fe80:: address (link-local), the interface has no global IPv6 address. Link-local addresses are only usable on the local subnet and cannot route to the internet. Causes include: the router not sending RAs, SLAAC disabled on the interface, or the ISP not providing IPv6.

If no global address exists:

1. Check the router’s IPv6 settings: is it set to “Native”, “Passthrough”, or “Tunnel”? For a server behind a typical home/office router, “Native” (or “DHCPv6-PD”) is correct.
2. On Linux, ensure the interface is configured for SLAAC: sysctl net.ipv6.conf.eth0.accept_ra=1 (replace eth0 with your interface). Some distributions set accept_ra=0 when using a static configuration.
3. If you use NetworkManager, check nmcli device show eth0 | grep ipv6 to see the method (auto, manual, disabled).

Step 2: Test Basic Connectivity (Ping and Traceroute)

Once you have a global address, test whether you can reach the IPv6 internet. Use a well-known, reliable target like Google’s public DNS (2001:4860:4860::8888) or Cloudflare’s (2606:4700:4700::1111).

• ping6 2001:4860:4860::8888 (Linux) or ping -6 2001:4860:4860::8888 (Windows).
• If ping fails, try traceroute6 (Linux) or tracert -6 (Windows) to see where packets stop. The first hop should be your router’s link-local address. If it stops at the router, the problem is on the router’s WAN side. If it stops later, it may be a firewall or ISP issue.

Also test the reverse: can external hosts reach your server? Use an online IPv6 connectivity test tool (like test-ipv6.com) from a machine on the same network. If the server itself passes the test but external access fails, the issue is the router’s firewall or the server’s firewall blocking inbound connections.

Step 3: Check Firewall and Security Group Rules

Firewalls are the most common culprit after basic addressing is confirmed. Both the server’s local firewall and any cloud provider’s security group must allow IPv6 traffic. Many default rules only cover IPv4.

• Linux (iptables/nftables): By default, iptables rules apply to IPv4 only unless you also configure ip6tables. If you have a rule that drops all INPUT without a matching IPv6 rule, IPv6 will fail. Check with ip6tables -L -n. If you use nftables, the ruleset may cover both families, but verify.
• ufw (Uncomplicated Firewall): ufw status shows IPv6 rules only if IPV6=yes in /etc/default/ufw. If it’s no, ufw silently ignores IPv6.
• Cloud providers (AWS, Azure, GCP): Security groups / network security groups are often IPv4-only by default. You must explicitly add IPv6 rules (e.g., allow TCP port 443 from ::/0).
• Windows Firewall: Rules apply to both IPv4 and IPv6 by default, but inbound rules may be scoped to specific addresses. Check the scope of any restrictive rules.

Step 4: Verify Services Are Listening on IPv6

Even if the network is fine, your web server, SSH, or database may be bound only to IPv4. On Linux, check what addresses a service is listening on:

• ss -tulpn (or netstat -tulpn). Look for tcp6 entries. A service listening on 0.0.0.0:80 is IPv4-only; [::]:80 means IPv6 (and usually IPv4 too if net.ipv6.bindv6only=0, the default).
• If you see only 0.0.0.0, the service is not listening on IPv6. Check its configuration. For example, in Apache, Listen 80 is enough for both; Listen 0.0.0.0:80 is IPv4-only. In Nginx, listen [::]:80; is needed for IPv6.
• For SSH, ensure AddressFamily any (or inet6) is set in /etc/ssh/sshd_config.

Step 5: DNS and Reverse DNS (PTR) Records

If you have IPv6 connectivity but a domain name doesn’t resolve to it, the problem is DNS. You need an AAAA record for your hostname pointing to the server’s IPv6 address. Check with dig AAAA example.com or nslookup -type=AAAA example.com.

Also verify that your server’s resolver can query IPv6 DNS servers. If your /etc/resolv.conf only has IPv4 DNS servers, that’s fine, but if you want to use IPv6 DNS (like Google’s 2001:4860:4860::8888), ensure the resolver can reach them. On some systems, you may need to enable IPv6 in the resolver configuration.

Reverse DNS (PTR) is often overlooked. While not required for connectivity, many mail servers reject incoming mail from IPs without a matching PTR record. If you run a mail server, set up PTR for your IPv6 address with your ISP or hosting provider.

Step 6: Common Misconceptions and Edge Cases

• “IPv6 is faster” — Not inherently. IPv6 has a smaller header, but routing and hardware matter more. You may see slight improvements, but don’t expect a major speedup.
• “I don’t need IPv6 if I have IPv4” — Increasingly, content providers and CDNs are IPv6-only internally. If your server can’t reach IPv6, you may be unable to connect to some services.
• “SLAAC is enough” — SLAAC provides an address and default route, but not DNS. If your network uses SLAAC-only, you must manually set DNS or use DHCPv6 for DNS. This is a common cause of “I have an IPv6 address but can’t resolve names.”
• Dual-stack vs. NAT64 — Most networks run dual-stack (both IPv4 and IPv6). If your ISP only provides IPv6 (rare but growing), you may need NAT64 or a tunnel broker like Hurricane Electric’s tunnelbroker.net (free, but adds latency).

Frequently Asked Questions

Why does my server have an IPv6 address but can’t ping the internet?

This usually means you have a global address but no default route. Check ip -6 route show; you should see a default route like default via fe80::1 dev eth0. If not, the router isn’t sending router advertisements properly, or the server’s accept_ra is disabled. Also check the firewall on the router — some routers block ICMPv6 by default, which breaks path MTU discovery and can cause connections to hang.

How do I enable IPv6 on a Linux server?

For most distributions, IPv6 is enabled by default. If it’s disabled, check the kernel module: modprobe ipv6 (though on modern kernels it’s built-in). Then set net.ipv6.conf.all.disable_ipv6=0 in /etc/sysctl.conf and apply with sysctl -p. For network configuration, use NetworkManager or netplan to set the method to auto (SLAAC) or dhcp (DHCPv6).

What’s the difference between SLAAC and DHCPv6?

SLAAC is stateless: the router advertises the prefix, and the host generates its own address (using EUI-64 or privacy extensions). DHCPv6 is stateful: the server assigns addresses and tracks them. SLAAC doesn’t provide DNS, while DHCPv6 can. Many networks use both — SLAAC for addressing, DHCPv6 for DNS. For a server, you might prefer a static IPv6 address to avoid changes.

How do I assign a static IPv6 address?

On Linux, edit your network config (e.g., /etc/network/interfaces or netplan) and specify the address, prefix length, and gateway. For example: address 2001:db8::10/64 and gateway 2001:db8::1. On Windows, use netsh interface ipv6 set address "Ethernet" 2001:db8::10. Make sure the address is within your ISP’s prefix and doesn’t conflict with SLAAC.

Why does my cloud server not have IPv6?

Many cloud providers (AWS, Azure, GCP) historically did not support IPv6 on all instance types or regions. Even when supported, you must explicitly assign an IPv6 address to the instance and add IPv6 rules to the security group. Check the provider’s documentation for your specific instance type. Some providers charge extra for IPv6 addresses.

Can I use a tunnel broker if my ISP doesn’t support IPv6?

Yes. Services like Hurricane Electric’s tunnelbroker.net provide a free 6in4 tunnel, giving you a public IPv6 /64 prefix routed over your IPv4 connection. You configure the tunnel on your router or server. The downside is added latency and dependence on the tunnel provider’s uptime. For production servers, native IPv6 is always preferable.

Related

• Hacker Class Guide: Unlock Cost & Abilities
• PSP Wi-Fi Connection & Fixes Guide
• Gold vs TIPS: Which Hedges Inflation Better?