Configure your /64 IPv6 subnet

Every DediJet server comes with a routed /64 IPv6 subnet at no extra cost, and the one-click installation sets up IPv6 for you. Use this guide to check that configuration, rebuild it after a custom install, or put more of the subnet to work.

How the routed /64 works

A /64 holds 2^64 addresses, about 18 quintillion. “Routed” means the upstream router sends all traffic for the subnet to your server, and you decide which addresses to use and where. There is nothing to request per address: add one from the prefix to the interface and it is reachable.

Your prefix is listed in your dashboard: open the server, then choose Network. This guide uses 2001:db8:1234:5678::/64 as the prefix, 2001:db8:1234:5678::1 as the server’s main address and enp1s0 as the interface; ip -br link shows your interface name. The IPv6 gateway is the link-local address fe80::1. Check the value in your dashboard, and use that one if it differs.

See what is configured already:

ip -6 addr show dev enp1s0 scope global
ip -6 route show default

If your address and a default route via fe80::1 appear, IPv6 is set up and you can go straight to the checks further down.

Configure the address and gateway

Use the tool that already manages your IPv4 configuration: YAML files in /etc/netplan/ mean Netplan (standard on Ubuntu, also used on some Debian images), /etc/network/interfaces means ifupdown (classic Debian), and AlmaLinux and Rocky Linux use NetworkManager.

Ubuntu: Netplan

Edit the existing file in /etc/netplan/ (its name varies) and add the IPv6 address and default route next to the IPv4 settings:

network:
  version: 2
  ethernets:
    enp1s0:
      addresses:
        - 203.0.113.10/24
        - 2001:db8:1234:5678::1/64
      routes:
        - to: default
          via: 203.0.113.1
        - to: default
          via: fe80::1

The IPv4 lines are examples: keep your own address, routes and any nameservers section exactly as they are. Then apply with a safety net:

netplan try

netplan try applies the change and rolls it back after 120 seconds unless you press Enter to keep it. If a mistake cuts your SSH session, wait two minutes and reconnect. If Netplan warns that permissions are too open, run chmod 600 /etc/netplan/*.yaml.

Debian: ifupdown

In /etc/network/interfaces, add an inet6 stanza for the same interface below the IPv4 one:

iface enp1s0 inet6 static
    address 2001:db8:1234:5678::1/64
    gateway fe80::1

Rather than restarting the interface over SSH, apply the same settings live; the file takes over at the next boot:

ip -6 addr add 2001:db8:1234:5678::1/64 dev enp1s0
ip -6 route add default via fe80::1 dev enp1s0

AlmaLinux and Rocky Linux: NetworkManager

nmcli connection show
nmcli connection modify enp1s0 ipv6.method manual ipv6.addresses 2001:db8:1234:5678::1/64 ipv6.gateway fe80::1
nmcli connection up enp1s0

Replace enp1s0 in the last two commands with the connection name from the first one, in quotes if it contains spaces. Re-activating the connection re-applies IPv4 too, so expect a short pause in your SSH session.

Whatever the tool, reboot once at a quiet moment to confirm that the configuration survives.

Check that IPv6 works

ping -6 -c 4 2606:4700:4700::1111
curl -6 -sI https://www.debian.org
ip -6 route get 2606:4700:4700::1111

The ping, to a public DNS resolver, should get replies, and curl should print HTTP headers. The last command shows the source address the server uses for outgoing traffic, after src. Then test from outside: from a machine that has IPv6, ping or SSH to 2001:db8:1234:5678::1.

Use more addresses from the /64

Add addresses as you need them, for example one per website or service. Use the same /64 prefix length and do not add a second gateway:

• Netplan: another line under addresses, such as - 2001:db8:1234:5678::25/64.
• ifupdown: another stanza, iface enp1s0 inet6 static, containing only address 2001:db8:1234:5678::25/64.
• NetworkManager: nmcli connection modify enp1s0 +ipv6.addresses 2001:db8:1234:5678::25/64, then nmcli connection up enp1s0.

To try an address before making it permanent, ip -6 addr add 2001:db8:1234:5678::25/64 dev enp1s0 works immediately and disappears at reboot.

Virtual machines and containers behind a bridge need the host to route their addresses (see Install Proxmox VE). Enabling forwarding for that makes Linux ignore router advertisements, which does not matter with the static gateway configured here. If you want separate networks, such as one /64 per bridge or per customer, a /56 (256 subnets of /64) is available free on request: open a ticket.

Keep addresses stable

Servers need fixed addresses: DNS records, firewall allowlists and reverse DNS all point to them. Privacy extensions, designed for laptops, add temporary addresses that rotate, and SLAAC derives addresses automatically. The static configurations above avoid both. If ip -6 addr lists extra addresses marked temporary or mngtmpaddr, turn privacy extensions off for the interface and for new interfaces, in /etc/sysctl.d/60-ipv6.conf:

net.ipv6.conf.enp1s0.use_tempaddr = 0
net.ipv6.conf.default.use_tempaddr = 0

Load it with sysctl --system. With NetworkManager, set ipv6.ip6-privacy 0 on the connection instead.

Firewall IPv6 too

Your IPv6 addresses are reachable from the internet just like your IPv4 address, and services listening on [::] or * accept connections on both. ss -tlnp shows what listens where. Make sure your firewall covers IPv6:

• ufw filters IPv6 as long as IPV6=yes is set in /etc/default/ufw, the default.
• firewalld zones apply to IPv4 and IPv6 alike.
• nftables tables of the inet family match both protocols.
• iptables rules do not cover IPv6: add matching ip6tables rules, or move to nftables.

Next steps

Add AAAA records for your services, set reverse DNS for every address that sends mail, and read Add additional IPv4 addresses if you also need more IPv4. Still stuck? Open a ticket from Support with the output of ip -6 addr and ip -6 route.