Set up IPv6 on your VPS

Check what you have first

Not every server comes with IPv6. Look at your order details and control panel for an IPv6 address or subnet, and for the gateway to use, before changing anything. This guide assumes you have an address and, if needed, a gateway from your provider. If the provider assigns IPv6 automatically, the server may already be configured and you can skip to the tests.

The addresses below use the documentation prefix 2001:db8::/32. Replace them with the values you were given, and keep your recovery console available when changing network settings.

ip -6 addr show scope global
ip -6 route
ping -6 -c 3 2606:4700:4700::1111

Understand the pieces

An IPv6 setup has an address with a prefix length, such as 2001:db8:100::2/64, a default route through a gateway, and DNS resolvers that can be reached over IPv6 or IPv4. Some providers give a single address, some a whole /64 or larger subnet. Some use a gateway that is link-local, beginning with fe80::, and needs the interface named in the route.

Ubuntu: configure with netplan

Ubuntu 24.04 uses netplan. Add the IPv6 address and route to the file for your interface, keeping the existing IPv4 settings. Use netplan try, which reverts automatically if you lose connectivity and do not confirm. Find the interface name with ip link first.

Select the actual file shown by ls; image providers use different filenames. Do not copy the documentation-prefix addresses unchanged. Use the provider-assigned address, prefix and gateway, and preserve the existing IPv4 configuration.

ip -br link
ls /etc/netplan/
NETPLAN_FILE=/etc/netplan/YOUR_EXISTING_FILE.yaml
sudo cp "$NETPLAN_FILE" "$NETPLAN_FILE.bak"

      addresses:
        - 2001:db8:100::2/64
      routes:
        - to: "::/0"
          via: 2001:db8:100::1

sudo netplan try
ip -6 addr show scope global
ip -6 route

AlmaLinux: configure with NetworkManager

AlmaLinux uses NetworkManager. Modify the existing connection with nmcli, then bring it up again. Connection names vary, so list them first. A mistake can cut your connection, so use the console if you can.

Use the active connection name from nmcli connection show; it may differ from the interface name. Keep a console available before bringing that connection back up.

nmcli connection show
sudo nmcli connection modify "YOUR_CONNECTION_NAME" ipv6.method manual ipv6.addresses 2001:db8:100::2/64 ipv6.gateway 2001:db8:100::1
sudo nmcli connection up "YOUR_CONNECTION_NAME"
ip -6 addr show scope global

Test connectivity

Check that the address is present, the gateway answers, and the internet is reachable over IPv6. Then test from outside: from another machine with IPv6, ping and connect to the server's address. Remember that a firewall can block incoming tests.

ip -6 route get 2606:4700:4700::1111
ping -6 -c 4 2001:db8:100::1
curl -6 -s https://ifconfig.me; echo
curl -6 -sI https://example.com/ | head -n 1

Update the firewall

IPv6 needs its own firewall rules unless your tool covers both. UFW needs IPV6 enabled in its configuration, and then its rules apply to both protocols. firewalld applies its zones to IPv4 and IPv6 together. After changes, check the rules for IPv6 as well, because an open IPv6 port can bypass a careful IPv4 setup.

grep ^IPV6 /etc/default/ufw
sudo sed -i 's/^IPV6=no/IPV6=yes/' /etc/default/ufw
SSH_PORT=$(sudo /usr/sbin/sshd -T | awk '/^port /{print $2;exit}')
sudo ufw allow "$SSH_PORT/tcp"
sudo ufw reload
sudo ufw status verbose

sudo firewall-cmd --list-all
sudo nft list ruleset | grep -c ip6

Make services listen on IPv6

Many services listen on both protocols by default, but some need a line for IPv6. In Nginx, add listen [::]:80 and listen [::]:443 next to the IPv4 lines. Check what actually listens: [::] means IPv6, and on most systems that also accepts IPv4 connections.

sudo ss -lntp | grep -E "\[::\]"
sudo nginx -T 2>/dev/null | grep -n "listen"

Publish AAAA records, carefully

An AAAA record is the IPv6 equivalent of an A record. Add one only after you have confirmed that the server answers on that address for the service, because visitors with IPv6 will try it first. A wrong or stale AAAA record also breaks certificate validation even when IPv4 works. Add it for each name, then test over both protocols.

dig +short AAAA example.com
curl -6 -sI https://example.com/ | head -n 1
curl -4 -sI https://example.com/ | head -n 1

Reverse DNS and troubleshooting

If you send email from the address, ask for a PTR record for it, as in the email guide. If IPv6 stops working, check that the route is still present, that the address has not expired, that a router advertisement is not overriding your configuration and that the provider-level firewall allows it. The journal of the network service often explains.

sudo journalctl -u systemd-networkd --since "1 hour ago" --no-pager | tail -n 15

sudo journalctl -u NetworkManager --since "1 hour ago" --no-pager | tail -n 15