IPv6 Design: The Habits to Unlearn From IPv4

1. No NAT: The Shift in Thinking

The biggest hurdle for IPv4 architects is losing network address translation (NAT) as the standard hiding place. In IPv6, devices that talk to the internet normally use global unicast addresses that can be routed publicly.

ULA or Global

Unique local addresses (ULA, fc00::/7) exist for internal only traffic and work much like the IPv4 private ranges. Running them alongside global addresses, though, creates awkward source address selection problems for operating systems.

Advice. Avoid ULA for general office LANs unless the network is genuinely air gapped, or you need stable internal addresses that survive a change of internet provider.

What It Means for Security

You can no longer lean on NAT as a pretend firewall.

• The perimeter does the work. Security moves to stateful firewall rules, and the policy must be an explicit default deny inbound.
• Endpoints are exposed. With no NAT in the way, host firewalls and endpoint detection become the last line of defence against a mistake in the perimeter rules.

2. The Atomic Unit: The /64

In IPv4 you size a subnet to fit its hosts. In IPv6, the /64 is the fixed size of a LAN segment.

Stateless address autoconfiguration (SLAAC) relies on a 64 bit interface identifier. Break the /64 boundary and you break compatibility with standard IPv6 stacks, IoT sensors and people's own phones and laptops.

The Exception: Infrastructure Links

For tightly controlled infrastructure links, such as a fibre between two routers, a /127 is widely accepted and recommended (RFC 6164).

Why. A /64 on a point to point link leaves billions of unused addresses that invite ping pong loops and neighbour cache exhaustion attacks. A /127 leaves exactly two addresses, one for each end.

3. Hierarchy and Nibble Boundaries

IPv6 addresses are written in hexadecimal. To keep routing tables and firewall logs readable during an incident, design the scheme around nibble boundaries: prefix lengths that are multiples of four bits, so each step is one hex character.

• Site allocation. An organisation typically receives a /48, which leaves 16 bits, 65,536 subnets of /64, for its own design.
• Make it readable. Put the VLAN ID straight into the subnet's hex characters so engineers recognise it at a glance:
  • VLAN 10: 2001:db8:abcd:10::/64
  • VLAN 20: 2001:db8:abcd:20::/64

Check any prefix in the subnet calculator, which handles IPv6.

4. Handing Out Addresses: SLAAC or DHCPv6

You choose how clients get addresses, and the choice is often made for you by the mix of devices on the network.

Option A: DHCPv6, for Control

Gives the fine control and the familiar logging of DHCP in IPv4.

The catch. Android does not support stateful DHCPv6 address assignment (as of October 2026). Relying on it alone will leave a large share of phones and IoT devices without an address.

Option B: SLAAC, for Compatibility

The router advertises the prefix and each device builds its own address. It works with nearly everything.

The catch. Privacy extensions make devices change their addresses regularly, so audit trails based on IP address are hard to keep without 802.1X authentication logs.

The Common Middle Ground

Many organisations let SLAAC handle addresses and supply DNS settings either through stateless DHCPv6 or through the RDNSS option in the router advertisement.

5. Do Not Block ICMPv6: Path MTU Discovery

In IPv4, security teams often block all ICMP out of habit. In IPv6, blocking ICMP without thinking breaks connections.

How It Works

IPv6 routers do not fragment packets. They drop a packet that is too big and send an ICMPv6 message telling the sender to use smaller ones.

The failure mode. If your firewall drops ICMPv6 type 2, "Packet Too Big", the sender never learns to shrink its packets and the connection simply hangs.

6. The Operational Tax: Dual Stack

Running IPv4 and IPv6 side by side doubles the rule sets you maintain. Every firewall rule, ACL and routing policy has to exist, and stay correct, for both protocols, and every gap between them is somewhere to attack.

Keep Going

• Read the IPv4 design guide.
• Test yourself on the IPv6 topic in the networking quiz.
• Planning an IPv6 rollout? Tell us about it.

Designing or Reviewing a Network Like This?

Our network and identity design work starts from a diagram and a conversation. Discuss an engagement.