Ubuntu Server 22.04 and Raspberry Pi devices can obtain public IPv6 addresses automatically through Stateless Address Autoconfiguration (SLAAC) provided your router advertises the correct prefix. This setup eliminates the need for Network Address Translation (NAT), allowing direct inbound connections to your server from the internet without complex port forwarding rules.
Verifying Your Router Configuration
Before configuring the operating system, you must ensure that your network infrastructure is actually providing IPv6 connectivity. Most modern home routers support IPv6, but it is often disabled by default or configured in a way that restricts external access. The first step is to log into your router’s administration panel and locate the WAN or Internet settings. Look for an option labeled IPv6, PPPoE, or Static IP depending on your ISP connection type. You need to confirm two critical pieces of information: the IPv6 prefix delegation and the firewall settings. The router should be set to receive a /64 prefix from your ISP. This prefix is essential because it defines the block of addresses available to your local network. If your router only receives a smaller prefix, such as a /56 or /48, it can still delegate a /64 to your LAN, which is sufficient for most home setups. Additionally, check if there is a specific "IPv6 Firewall" or "SPI Firewall" setting. For a beginner-friendly setup where you want to host services, you may need to disable the router's built-in IPv6 firewall temporarily to test connectivity, though this is not recommended for long-term security without additional hardening. Once the router is configured, verify that your Ubuntu or Raspberry Pi device is receiving an address. You can do this by runningip -6 addr show. Look for an address that starts with your ISP's assigned prefix range rather than fe80::, which is a link-local address. If you see a global unicast address starting with 2a00:, 2001:, or similar ranges assigned by your provider, the DHCPv6 or SLAAC process is working correctly at the network layer.
For more details on troubleshooting network interface issues, you might find our guide on Doesn't ifconfig show IPv4 address? (IPv6 related) helpful, as understanding how interfaces report their status is crucial for diagnosing these problems.
Configuring NetworkManager for Automatic Assignment
Ubuntu Server 22.04 uses NetworkManager by default, which handles IPv6 configuration efficiently. In many cases, no additional configuration is required if your router is properly set up. However, if your device is not obtaining an address, you may need to explicitly enable IPv6 in the NetworkManager configuration files. These files are typically located in/etc/NetworkManager/system-connections/ or managed via nmtui (Network Manager Text User Interface).
If you prefer using the command line, you can edit the connection profile associated with your Ethernet or Wi-Fi interface. Use the command nmtui to select your connection, then navigate to the IPv6 CONFIGURATION section. Set the method to either Automatic or Link-local only if you are testing, but for public access, Automatic is preferred. This tells NetworkManager to request an address from the router using SLAAC and optionally use DHCPv6 for DNS servers.
After making changes, restart the NetworkManager service with sudo systemctl restart NetworkManager. Check the logs using journalctl -u NetworkManager to ensure there are no errors during the acquisition phase. A successful acquisition will result in an output showing a new global IPv6 address assigned to your interface.
It is important to note that Raspberry Pi OS (formerly Raspbian) also uses NetworkManager or systemd-networkd depending on the version. The principles remain the same: ensure the interface is set to auto-configure IPv6. If you are using a minimal install of Ubuntu Server, you might be using netplan. In /etc/netplan/, ensure your YAML configuration includes accept-ra: true under the network interface definition. This allows the kernel to accept Router Advertisements, which contain the necessary prefix information for SLAAC.
Testing Public Accessibility
Obtaining an address does not guarantee that it is publicly accessible. Many ISPs implement Carrier-Grade NAT (CGNAT) even for IPv6, although this is rare compared to IPv4. To test if your address is truly public, you can use online tools liketest-ipv6.com or simply try connecting to your server from a mobile data network (turn off Wi-Fi on your phone). If you can ping your IPv6 address from outside your local network, the path is clear.
However, even if the router allows traffic, the Linux kernel itself has a firewall. Ubuntu Server comes with ufw (Uncomplicated Firewall) enabled by default. By default, UFW blocks incoming connections. You must explicitly allow traffic on the ports you intend to serve. For example, to allow HTTP traffic, run sudo ufw allow 80/tcp. Similarly, for SSH, ensure sudo ufw allow 22/tcp is set.
If you encounter issues where packets are being dropped despite UFW rules, it might be due to other iptables rules or kernel parameters. For advanced users who need to debug packet drops specifically related to IPv6, reviewing guides on Explicitly Dropping IPv6 Packets with ip6tables - A Tech Support Guide can provide deeper insights into low-level packet filtering.
Security Considerations for Direct Exposure
Running a server directly on a public IPv6 address exposes it to the entire internet. Unlike IPv4, where attackers must scan millions of addresses to find one, IPv6 provides each device with a unique /64 subnet, making scanning easier if you have static addresses. Therefore, security is paramount. First, keep your system updated withsudo apt update && sudo apt upgrade. Second, use strong SSH keys instead of passwords. Third, consider using fail2ban to protect against brute-force attacks. Finally, while you may disable the router's firewall for testing, always re-enable it or configure it to allow only specific inbound ports. Never leave all ports open on a public interface.
For those experiencing connectivity issues after changing network configurations, especially when trying to access the server remotely, refer to our article on Troubleshooting SSH Connection Issues on a Fresh Install of Ubuntu Server 23.10 on a Raspberry Pi for common pitfalls in remote access setups.
Frequently Asked Questions
Why is my IPv6 address starting with fe80?
Addresses starting withfe80:: are link-local addresses, which are only valid within your local network segment and cannot be routed over the internet. To have a public IPv6 address, you must ensure your router is advertising a global prefix and that your device is configured to accept these advertisements via SLAAC or DHCPv6.
Do I need to forward ports on my router for IPv6?
No, traditional port forwarding is not used in IPv6. Instead, you rely on the global uniqueness of the IPv6 address. Any device with a public IPv6 address can be reached directly by anyone on the internet, provided that firewalls (both on the router and the server) allow the traffic.How can I hide my IPv6 address for privacy?
Linux systems use Privacy Extensions by default, which generate temporary IPv6 addresses for outbound connections to prevent tracking. These addresses change periodically. You can view them usingip -6 addr show. While this protects your identity for outgoing traffic, your stable address derived from the router's prefix remains visible for incoming connections unless you manually manage the addresses.