IPv6 on Servers: Enable Correctly with Dual Stack

IPv4 exhausted long ago, yet most servers still run IPv4-only. Enabling IPv6 on a server should be routine, but a botched rollout causes subtle failures. The key is dual stack: running IPv4 and IPv6 side by side so each application picks the best protocol automatically. Done correctly, dual stack is invisible. Done sloppily, it creates double failures where a single protocol problem used to exist.

How a Dual-Stack Interface Looks

A dual-stack server has both an IPv4 address and an IPv6 address on the same interface. The IPv6 address typically comes in two forms: a global unicast address used for internet traffic, and a link-local address that starts with fe80:: for on-link communication. Each exists independently, and the kernel maintains separate routing tables for the two families.

ip -6 addr show
ip addr show eth0
ip -6 route show

The first command shows only IPv6 addresses, including the link-local. The second shows both families. The third lists the IPv6 routing table, which should contain a default route via the link-local gateway address, since IPv6 gateways are almost always reached through their link-local address rather than a global one.

Configuring Dual Stack with systemd-networkd

A .network file can configure both protocols at once. The [Match] and [Network] sections apply to the whole interface, and you add both an address and a gateway for each family.

[Match]
Name=eth0

[Network]
Address=10.0.0.5/24
Address=2001:db8::5/64
Gateway=10.0.0.1
Gateway=fe80::1

The IPv6 gateway uses a link-local address. This is correct and expected. Your provider should hand you the IPv6 gateway as a link-local address, typically fe80::1 on the local segment. If you configure a global address as your gateway, traffic may fail for reasons that are hard to diagnose.

Configuring with Netplan

On Ubuntu, the same dual-stack config lives in a Netplan YAML file. The addresses block can hold both an IPv4 and an IPv6 address, and the routes block can carry the default routes for both.

network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 10.0.0.5/24
        - 2001:db8::5/64
      routes:
        - to: default
          via: 10.0.0.1
        - to: default
          via: fe80::1
      nameservers:
        addresses:
          - 1.1.1.1
          - 2606:4700:4700::1111

Notice the IPv6 route via the link-local gateway. The nameservers list includes an IPv6 DNS server. If your resolver only has IPv4, DNS over IPv6 will fail, so include both families in your nameservers for reliable dual-stack DNS.

Firewalling Both Families

A firewall that only covers IPv4 leaves your IPv6 address exposed. Many providers filter inbound IPv6 at the network edge, but you cannot rely on that. You must apply the same filter policy to IPv6 as IPv4, and remember that IPv6 has no NAT by default. Every globally reachable IPv6 address is directly exposed.

# nftables: include both address families
nft add rule inet filter input tcp dport 22 accept
nft add rule inet filter input drop

# iptables-nft for IPv6 is ip6tables
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -P INPUT DROP

The nftables inet family table covers IPv4 and IPv6 in one chain, which is one of the strongest reasons to prefer nftables on a dual-stack server. You write the firewall once and it protects both protocols.

The Happy Eyeballs Principle

Applications today use Happy Eyeballs, RFC 6555, to try both IPv4 and IPv6 and pick whichever connects first. If IPv6 is broken on your path but enabled on your host, Happy Eyeballs will still work, but it adds a small delay. If IPv6 is half-configured, some clients stall waiting for an IPv6 timeout.

sysctl net.ipv6.conf.all.disable_ipv6
curl -6 -v https://netbayhosts.in
curl -4 -v https://netbayhosts.in

The curl commands test each family explicitly. If curl -6 works and curl -4 works, dual stack is healthy. If either fails but the other succeeds, you have a half-configured stack, and that is worse than being IPv4-only because it wastes connection attempts.

Testing and Verifying Dual Stack

After configuring, verify connectivity per family and check that your default route resolves.

ping6 -c 3 2001:4860:4860::8888
traceroute6 netbayhosts.in
ip -6 route get 2001:4860:4860::8888

The ip -6 route get command shows which interface and gateway the kernel would choose for that destination. Run curl -6 to a known IPv6-capable host to confirm end-to-end connectivity. Then confirm DNS returns both A and AAAA records for your own domain; if your DNS lacks AAAA records, IPv6 clients cannot reach you regardless of host configuration.

When to Stay IPv4-Only

If your DNS, monitoring, or firewall tooling does not support IPv6, or your provider cannot supply stable IPv6 addressing, staying IPv4-only is perfectly valid. A correctly functioning IPv4-only host beats a broken dual-stack host. The decision should be based on what your infrastructure can actually support, not on a checkbox.

When your platform is ready, enabling IPv6 on a VPS with proper dual stack is a straightforward and reversible change. Netbay VPSes expose full network configuration, letting you enable or disable IPv6 cleanly in the console at netbayhosts.in.