IPv4 vs IPv6: the differences that matter when you run a server

Short answer: IPv4 and IPv6 are two versions of the Internet Protocol, the addressing system every device on the internet uses. IPv4 addresses are 32 bits long, written as four decimal numbers (203.0.113.10), which allows about 4.3 billion addresses — and they ran out. IPv6 addresses are 128 bits long, written in hexadecimal groups (2001:db8::10), which allows about 3.4 × 10³⁸. IPv6 also simplifies the packet header, drops broadcast and makes NAT unnecessary. The two are not compatible on the wire, so today’s internet runs both side by side.

IPv4 vs IPv6 at a glance

Why does IPv6 exist?

Because 4.3 billion addresses are not enough for every phone, laptop, server and sensor on earth. The global pool ran dry on 3 February 2011, when IANA handed the last five blocks of IPv4 space to the five regional registries. RIPE NCC, which serves Europe, the Middle East and parts of Central Asia, made its final regular allocation on 25 November 2019; since then, new networks there get small blocks from a waiting list or buy and lease addresses from others.

IPv4 survived that long through workarounds: NAT lets a whole home or office share one public address, and many mobile and broadband providers add carrier-grade NAT (the 100.64.0.0/10 range) so that thousands of customers share one. NAT breaks the end-to-end model — you cannot connect to a device behind it without port forwarding — and makes an IPv4 address a tradeable, increasingly expensive resource. IPv6 was designed in the 1990s to remove the shortage for good; its current specification is RFC 8200.

How do you read an IPv6 address?

An IPv6 address is eight groups of four hex digits. Two rules shorten it: leading zeros in a group can be dropped, and one run of all-zero groups can be replaced by ::.

2001:0db8:0000:0000:0000:ff00:0042:8329
2001:db8:0:0:0:ff00:42:8329
2001:db8::ff00:42:8329

The first half is normally the network: a provider routes a prefix such as a /48 or /56 to a customer, and a single LAN segment is a /64. The last 64 bits identify the interface. Because of the colons, an IPv6 address in a URL goes in square brackets: http://[2001:db8::10]:8080/. The subnet calculator takes IPv6 prefixes as well as IPv4 ones and shows the first and last address of a /56 or /64.

Is IPv6 faster than IPv4?

Not by design. Both carry data at the same speed over the same links. In practice IPv6 is sometimes slightly faster because it avoids carrier-grade NAT boxes, and sometimes slower because a network’s IPv6 route is less optimised. Clients hedge with Happy Eyeballs (RFC 8305): they try IPv6 and IPv4 almost in parallel and use whichever connects first, so a broken IPv6 path costs a fraction of a second rather than a failed page.

What changes for security?

NAT was never a firewall, but it hid devices by accident. With IPv6, every device can have a globally reachable address, so the firewall has to do the job deliberately. The most common mistake on servers is a carefully tightened IPv4 firewall next to an IPv6 side that allows everything.

• UFW: check that IPV6=yes is set in /etc/default/ufw; then each rule applies to both protocols.
• iptables: IPv6 has its own ip6tables rule set. nftables can cover both in one table of family inet.
• Do not block ICMPv6 wholesale. Neighbor Discovery and path MTU discovery depend on it; dropping it breaks IPv6 in confusing ways. Allow the types the protocol needs.
• Know what listens where. A service bound to [::] on Linux usually accepts IPv4 too, through IPv4-mapped addresses. ss -tlnp shows the real picture.

How do you use IPv6 on a server?

ip -6 addr show scope global      # your global IPv6 address(es)
ip -6 route show default          # the IPv6 default gateway
ping -6 -c 3 one.one.one.one      # can the server reach the IPv6 internet?
curl -6 https://ifconfig.co       # the IPv6 address others see

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
}

Then publish an AAAA record next to the A record — see what is DNS for how the two record types fit into a lookup. Test from outside before you rely on it: a published AAAA record that points at an address where the service does not listen sends IPv6 visitors into a timeout before Happy Eyeballs falls back. Our guide to pointing a domain to a VPS covers both records.

How does a server get its IPv6 address?

Three ways, and a server usually uses the first or second. With a static configuration you enter the address, prefix length and gateway yourself, as with IPv4. With SLAAC (stateless address autoconfiguration) the router announces the network prefix and the machine builds its own address in it; desktops add temporary “privacy” addresses on top so websites cannot track the device by its address. DHCPv6 hands out addresses centrally, like DHCP does for IPv4. On a server you want a stable address, because it ends up in DNS records and firewall rules.

How do IPv4 and IPv6 networks talk to each other?

• Dual stack: hosts and networks run both protocols side by side — the normal case for servers.
• NAT64 with DNS64: an IPv6-only network reaches IPv4 services through a translator; DNS64 synthesises AAAA answers that point at it. Many mobile networks work this way, with 464XLAT on the phone for apps that insist on IPv4.
• Proxies and CDNs: a dual-stack front end accepts both and talks to an origin over whichever it has.
• Tunnels such as 6in4 carry IPv6 across IPv4-only links; older automatic schemes like 6to4 are deprecated.

Do you still need IPv4?

Yes. A large share of the internet’s users and many networks reach the internet over IPv6 today, but plenty of ISPs, corporate networks, services and APIs are still IPv4-only. An IPv6-only server cannot be reached from them without a translation layer such as NAT64 or a proxy in front. For anything public, run dual stack: an IPv4 address for reach and IPv6 for everyone who has it. What is my IP shows the IPv4 address your connection uses, and how to find its IPv6 one.

IPv4 and IPv6 on a VMHeaven server

Each VMHeaven server gets its own IPv4 address, plus an IPv6 prefix when the location’s pool has one free — on Standard KVM, Hi-CPU KVM and the other KVM lines alike. The firewall advice above applies to both: set up IPv6 rules together with the IPv4 ones on the first day, not after something has been reachable that should not be.

Frequently asked