1. Why IPv6?
Dual-stack (IPv4+IPv6) often masks hidden IPv4 dependencies—like fetching obscure Ubuntu PPAs or shipping logs to third-party services. Relying on IPv4 as a fallback hides problems until an outage occurs.
Dual-stack also doubles operational complexity: security groups, NACLs, WAF rules, and S3 policies must permit both IPv4 and IPv6. Automation, DNS (A & AAAA records), and troubleshooting must handle two protocol stacks—and browser behaviors like Happy Eyeballs add unpredictability.
Finally, dual-stack doesn’t solve IPv4 exhaustion. Even AWS’s massive IPv4 pool can’t reach IPv6-only endpoints. New IPv4 addresses come at high cost or via NAT. Going IPv6-only reduces complexity, improves security, and future-proofs your infrastructure.
2. Prerequisites
- AWS account with EC2 & networking admin rights
- IAM permission for VPCs, subnets, IGWs, EC2
- Existing EC2 instance in a custom VPC
3. Enable IPv6 in AWS Console
3.1 Assign IPv6 CIDR Block to VPC
- Console: VPC → Your VPCs → Edit CIDRs → Add IPv6 CIDR
- Select Amazon-provided CIDR (usually /56)
3.2 Associate IPv6 CIDR to Subnet
- Console: Subnets → Select Subnet → Edit CIDRs → Add IPv6 CIDR
- Enable auto-assign IPv6 for new instances (optional)
3.3 Attach Internet Gateway (IGW)
- Ensure an IGW is attached to your VPC
- If missing, create & attach via AWS Console
3.4 Update Route Tables
- Add route:
::/0→ Target: your IGW
3.5 Enable IPv6 on EC2 Instance
- Manually assign or auto-assign IPv6 addresses in EC2 settings
- Verify under Network Interfaces (ENI)
4. Instance-Level Configuration
4.1 Check IPv6 Address
ip -6 addr show
4.2 Check IPv6 Routing Table
ip -6 route show
4.3 Check Kernel IPv6 Status
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
Should output 0 (enabled).
4.4 Enable Router Advertisements
sysctl -w net.ipv6.conf.all.accept_ra=1 sysctl -w net.ipv6.conf.default.accept_ra=1
5. Configure Security for IPv6
5.1 Security Groups
- Inbound: ICMPv6 (ping), TCP 80/443
- Outbound: allow
::/0
5.2 Network ACLs
- Inbound & outbound rules: allow all IPv6 (
::/0)
6. Troubleshooting IPv6 Issues
6.1 No IPv6 Address
Confirm subnet IPv6 CIDR and assignment settings.
6.2 Can’t Reach IPv6 Internet
ping6 2606:4700:4700::1111
6.3 Kernel & RA Checks
cat /proc/sys/net/ipv6/conf/all/disable_ipv6 cat /proc/sys/net/ipv6/conf/eth0/accept_ra
Should output 0 and 1 respectively.
7. Testing IPv6 Functionality
7.1 Ping Test
ping6 -c 4 2606:4700:4700::1111
7.2 External IP Check
curl -6 https://ifconfig.co
7.3 Online Tools
8. Final Recommendations
After enabling IPv6, monitor your environment, update security policies, and consider dual-stack only if needed for legacy support. For critical systems, professional DevOps services can ease management and ensure robust IPv6 operations.
