Skip to content
AdminKit

IPv6

What is IPv6?

IPv6 is the successor to IPv4, using 128-bit addresses so every device can get its own globally routable address without NAT or CGNAT. Many networks still run IPv4-only firewall rules that never account for a device's IPv6 address, which AdminKit's subnet calculator and DNS lookup tools can help check alongside a device's IPv4 configuration.

By AdminKit team, Netbase JSC · Updated

See why IPv6 devices need their own firewall rules too

IPv6, defined in RFC 8200, is the successor to IPv4, using 128-bit addresses written as groups of hexadecimal digits (like 2001:db8::1) instead of IPv4’s 32-bit dotted-decimal format. Its address space is large enough — roughly 340 undecillion addresses — that every device can get its own globally routable public address without the address-sharing tricks like NAT or CGNAT that IPv4 scarcity forced; IANA’s IPv6 Global Unicast Address Assignments registry tracks which blocks of that space have actually been allocated. A home router typically receives its own routable block from the ISP via IPv6 prefix delegation before it can hand out addresses to devices on the LAN; the RIPE community’s best current operational practice for IPv6 prefix assignment strongly discourages giving end users anything longer than a /56, with a /48 or a /56 as the usual choices. One common way a device builds the last 64 bits of that address is EUI-64 (part of the addressing architecture RFC 4291 defines), deriving the interface identifier directly from its MAC address rather than generating a random one. Adoption is uneven: many ISPs and home routers now assign IPv6 alongside IPv4 (dual-stack), but plenty of networks and devices still default to IPv4-only firewall rules, including ones never configured with IPv6 in mind, which is a common, overlooked gap in home-network security — Google’s own IPv6 adoption statistics, tracked from real traffic reaching its services, still show substantial IPv4-only traffic years into the rollout. A device can also reach the IPv6 internet through legacy tunneling mechanisms like Teredo or 6to4 even when its own network provides no native IPv6 at all, which is exactly the kind of unexpected path an IPv4-only firewall was never configured to cover.

To expand, compress or classify a specific IPv6 address offline — including its prefix/interface-id split and any MAC address embedded in it — paste it into AdminKit’s IPv6 info tool.

See the full AdminKit glossary for other related terms.

Frequently asked questions

Do I need to disable IPv6 if my firewall only has IPv4 rules?

No -- disabling IPv6 removes the gap but also loses its benefits; the better fix is to extend your firewall rules to cover IPv6 addresses too, since a device on a dual-stack network is reachable over both protocols independently.

How many addresses does IPv6 actually provide?

IPv6's 128-bit address space is large enough -- roughly 340 undecillion addresses -- that every device can get its own globally routable address without NAT or CGNAT.

Can a device reach the IPv6 internet even if my ISP doesn't provide native IPv6?

Yes -- legacy tunneling mechanisms like Teredo or 6to4 can carry IPv6 traffic over an IPv4-only network, which is exactly the kind of unexpected path an IPv4-only firewall configuration was never set up to cover.

What's the difference between IPv6 prefix delegation and a device building its own address?

Prefix delegation is how an ISP hands a router its own routable address block; EUI-64 is a separate mechanism a device on that network can use afterward to build the last 64 bits of its own address from its MAC address.

Sources