A guide to enabling IPv6 on AWS EC2 instances, covering VPC and subnet configuration, instance-level setup, security groups, NACLs, troubleshooting, and testing IPv6 connectivity.
Enabling IPv6 on AWS EC2: Setup and Troubleshooting
Running dual-stack (IPv4+IPv6) sounds like the safe bet, but it often hides IPv4 dependencies you didn't know you had -- things like obscure Ubuntu PPAs that only resolve over IPv4, or third-party logging endpoints that don't support v6. You won't notice until something breaks.
There's also the operational overhead. With dual-stack, every security group, NACL, WAF rule, and S3 policy needs to account for both protocols. That's twice the surface area to audit. Going IPv6-only where possible cuts that complexity down and future-proofs the setup.
1. Why IPv6?
IPv4 addresses are running out. Getting new ones is expensive, and NAT adds complexity that nobody enjoys debugging. IPv6 gives you a massive address space, kills the need for NAT in most cases, and more services are starting to require it.
2. Prerequisites
- AWS account with EC2 and networking permissions.
- An existing VPC (or willingness to create one).
- An Ubuntu EC2 instance.
3. Enable IPv6 in AWS Console
3.1 VPC Configuration
- Open VPC Dashboard > select the VPC.
- Actions > Edit CIDRs > Add an IPv6 CIDR block (Amazon-provided or BYOIP).
3.2 Subnet Configuration
- Select the subnet > Edit IPv6 CIDRs.
- Assign a /64 block from the VPC's IPv6 range.
- Enable "Auto-assign IPv6 address" for the subnet.
3.3 Route Table
- Add a route:
::/0pointing to the Internet Gateway (IGW).
4. Instance-Level Configuration
4.1 Assign IPv6 Address
- EC2 Console > Instance > Networking > Manage IP addresses > Assign new IPv6 address.
4.2 Verify Inside the Instance
SSH in and confirm the address is there:
ip -6 addr show
4.3 Check Kernel IPv6 Support
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
You want 0 here. If it says 1, IPv6 is disabled at the kernel level -- which happens on some older AMIs or hardened images.
4.4 Enable Router Advertisements
sysctl -w net.ipv6.conf.all.accept_ra=1
sysctl -w net.ipv6.conf.default.accept_ra=1
5. Configure Security for IPv6
5.1 Security Groups
Don't forget to add IPv6 rules -- security groups don't automatically mirror your IPv4 rules for v6 traffic.
- Inbound: ICMPv6 (ping), TCP 80/443
- Outbound: Allow
::/0
5.2 Network ACLs
- Inbound and outbound rules: allow all IPv6 (
::/0)
6. Troubleshooting IPv6 Issues
6.1 No IPv6 Address
Go back and check: does the subnet have an IPv6 CIDR assigned? Is auto-assignment turned on? These are the two things people miss most often.
6.2 Cannot Reach IPv6 Internet
ping6 2606:4700:4700::1111
If this times out, check three things: the route table needs ::/0 pointing at the IGW, security groups need to allow outbound v6 traffic, and NACLs need matching rules.
6.3 Kernel and RA Checks
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
cat /proc/sys/net/ipv6/conf/eth0/accept_ra
You're looking for 0 and 1 respectively. Anything else and the instance isn't properly accepting IPv6 configuration from the VPC.
7. Testing IPv6 Functionality
7.1 Ping Test
ping6 -c 4 2606:4700:4700::1111
7.2 External IP Check
curl -6 https://ifconfig.co
This should return your instance's public IPv6 address. If it hangs or returns an IPv4 address, something's still misconfigured.
7.3 Online Tools
- test-ipv6.com
- tools.keycdn.com/ipv6-ping
8. Final Recommendations
Once IPv6 is working, keep an eye on it. Update your security policies to cover v6 traffic, and only run dual-stack if you actually need IPv4 for legacy services. For production environments, having someone who knows the networking side well makes a real difference -- IPv6 misconfigurations tend to cause subtle, hard-to-debug issues.
Frequently asked questions
How do I enable IPv6 on an AWS VPC and subnet?
Open the VPC Dashboard, select the VPC and choose Actions > Edit CIDRs to add an IPv6 CIDR block, either Amazon-provided or BYOIP. Next, select the subnet, choose Edit IPv6 CIDRs, assign a /64 block from the VPC's range and enable "Auto-assign IPv6 address". Finally, add a ::/0 route pointing to the Internet Gateway in the route table.
How do I assign an IPv6 address to an existing EC2 instance?
In the EC2 Console, open the instance and go to Networking > Manage IP addresses > Assign new IPv6 address. Then SSH into the instance and run ip -6 addr show to confirm the new address is there. The instance's subnet must already have an IPv6 CIDR from the VPC.
Why is my EC2 instance not getting an IPv6 address?
Two subnet settings are the ones people miss most often. Check that the subnet has an IPv6 CIDR assigned and that auto-assignment of IPv6 addresses is turned on. Inside the instance, cat /proc/sys/net/ipv6/conf/all/disable_ipv6 should return 0. A value of 1 means IPv6 is disabled at the kernel level, which happens on some older AMIs and hardened images.
How do I enable IPv6 router advertisements on an Ubuntu EC2 instance?
Run sysctl -w net.ipv6.conf.all.accept_ra=1 and sysctl -w net.ipv6.conf.default.accept_ra=1. Check the result with cat /proc/sys/net/ipv6/conf/eth0/accept_ra, which should print 1, while cat /proc/sys/net/ipv6/conf/all/disable_ipv6 should print 0. Any other value means the instance is not properly accepting IPv6 configuration from the VPC.
Do AWS security groups apply IPv4 rules to IPv6 traffic automatically?
No. Security groups do not mirror IPv4 rules for IPv6, so v6 rules have to be added separately. The baseline is inbound ICMPv6 for ping plus TCP 80 and 443, with outbound traffic allowed to ::/0. Network ACLs need IPv6 (::/0) allowed on both inbound and outbound rules as well.
Why can't my EC2 instance reach the internet over IPv6?
When ping6 2606:4700:4700::1111 times out, three places need checking. The route table must send ::/0 to the Internet Gateway, the security groups must allow outbound IPv6 traffic, and the NACLs need matching rules. Fix whichever one is missing and run the ping again.
How do I test IPv6 connectivity on an EC2 instance?
Start with ping6 -c 4 2606:4700:4700::1111 for a basic connectivity check. Then run curl -6 against ifconfig.co, which should return the instance's public IPv6 address. If curl hangs or prints an IPv4 address, something is still misconfigured.
Is IPv6-only better than dual-stack on AWS EC2?
Going IPv6-only where possible keeps the setup simpler. Dual-stack can hide IPv4 dependencies, such as Ubuntu PPAs that only resolve over IPv4 or third-party logging endpoints without v6 support. Every security group, NACL, WAF rule and S3 policy also has to cover both protocols, which doubles the surface to audit. Run dual-stack only when legacy services actually need IPv4.
Read how we handle it in AWS Cloud Management.
Related Articles
How to Run Cron in Kubernetes So Jobs Never Overlap or Vanish
Scheduled work in Kubernetes fails in two quiet ways, a slow job that starts a second copy of itself and a schedule that silently stops firing. Both are configuration, not luck. This covers the CronJob fields that control concurrency, missed schedules, history retention and failure handling, with the actual defaults, so the nightly billing run is still there in the morning and there is a log to read when it is not.
Server & DevOpsHow to Move Off cPanel Without Breaking Mail
A web request that lands on the old server serves a slightly stale page. A message that lands on the old server sits in a mailbox the customer can no longer reach, and it never moves on its own. This is the migration order that keeps every message reachable throughout, with the inventory items that break silently, the TTL work that has to happen days ahead, repeated incremental imapsync passes across the cutover, and the authentication records that must travel with the mail. The DKIM private key does not come with the mailboxes, and that is the step most migrations discover afterwards.
Server & DevOpsThe GitHub to GitLab Migration Nobody Warns You About
GitLab imports your repositories, reviews and history almost completely. It imports none of your GitHub Actions. What moves, what you rewrite, and when.