IPv6 works inside LAN, doesn't externally

IPv6 functions perfectly within a Local Area Network because devices communicate via link-local or unique local addresses that do not require routing through an upstream provider. External connectivity fails when the router does not advertise a global prefix, firewall rules block inbound traffic, or the ISP has not delegated IPv6 addresses to your connection.

Understanding Internal vs External Scope

To diagnose why your network works internally but fails externally, you must first distinguish between the address types assigned to your interfaces. Linux systems typically assign two types of IPv6 addresses: Unique Local Addresses (ULA) and Global Unicast Addresses (GUA). ULA addresses, which begin with fd, are analogous to private IPv4 ranges like 192.168.x.x. They allow devices on your LAN to talk to each other without needing any configuration from your Internet Service Provider (ISP). This is why pinging another computer on your Wi-Fi works immediately. External connectivity, however, relies on GUA addresses, which begin with 2001, 2400, or similar prefixes allocated by your ISP. If your system only has a ULA address and no GUA address, it can never initiate or accept connections from the public internet. You can verify this by running ip -6 addr show. If you see only scope global dynamic mngtmpaddr for a fd address, your system lacks the necessary global identity for external communication. For deeper insights into how Linux handles these multiple address configurations, you might find Configuring Two ULA Addresses on One Interface: A Guide to IPv6 Networking in Linux helpful. It explains the nuances of managing overlapping scopes on a single network interface card.

Router Prefix Delegation and RA Messages

Even if your PC requests an address, it will not receive a usable global IPv6 address unless your router actively participates in the delegation process. In IPv6, routers send Router Advertisement (RA) messages periodically. These messages contain the PrefLife and LTime fields, which tell hosts how long they can use the provided prefix. If your router is not configured to pass the prefix learned from the ISP down to your LAN, your devices will fall back to generating their own ULAs. Check your router’s administration panel for settings labeled "IPv6 Prefix Delegation" or "PD." Many consumer routers disable this by default to simplify setup, assuming users only need basic NAT-based connectivity. Ensure that the WAN interface is set to obtain its IPv6 address automatically, often via DHCPv6 or SLAAC, and that the LAN interface is set to advertise the delegated prefix. If you are seeing repeated log messages about link changes, such as ADDRCONF(NETDEV_CHANGE), it may indicate that the physical link state is fluctuating, causing the IPv6 stack to reset. For troubleshooting these specific kernel logs, refer to IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready message repeating every minute. This article details how to stabilize the interface state to prevent erratic address reassignment.

Firewall Configuration and Inbound Traffic

A common reason for external failure is an overly restrictive firewall. Unlike IPv4, where NAT often masks internal hosts, IPv6 is designed for end-to-end connectivity. This means your server’s firewall must explicitly allow incoming connections on the ports you wish to expose, such as port 443 for HTTPS. If you are running multiple web servers, you cannot rely on port forwarding in the traditional sense because IPv6 uses full addressing rather than port translation. You must ensure that your host firewall, whether it is iptables, nftables, or ufw, permits traffic from any source to your server’s GUA address. Additionally, check your router’s built-in firewall. Some routers have an "SPI" (Stateful Packet Inspection) or "Intrusion Prevention System" that might drop ICMPv6 packets. Since ICMPv6 is essential for Path MTU Discovery, blocking it can cause silent failures where large packets are dropped, making services appear unreachable even if small ping tests succeed.

DNS and Reverse DNS

Finally, external access often fails due to DNS misconfiguration. Your ISP should provide reverse DNS (PTR records) for the IPv6 prefix they delegate to you. If you are hosting a web server, ensure that your domain’s AAAA record points to the correct global IPv6 address of your server. Without a valid PTR record, some external clients or security scanners may reject connections or flag your server as suspicious. Verify that your DNS propagation is complete using tools like dig AAAA example.com. If the record resolves correctly but you still cannot connect, the issue likely lies in the routing path between your ISP and the client, or in intermediate firewalls along the internet backbone.

Frequently Asked Questions

Why can I ping my neighbor but not google.com?

This usually indicates that your device has a valid link-local or ULA address but lacks a Global Unicast Address (GUA). Check your router's DHCPv6 or RA settings to ensure it is advertising a public prefix from your ISP. Without a GUA, your traffic cannot be routed across the public internet.

Does IPv6 require NAT?

No, IPv6 was designed to eliminate the need for Network Address Translation. Each device should have a globally routable address. If you are using NAT64 or CGNAT, you are likely dealing with IPv4 limitations or specific carrier-grade deployments, not standard pure IPv6 networking.

How do I fix broken PMTU discovery?

Broken PMTU discovery occurs when intermediate firewalls drop ICMPv6 Type 3 Code 4 (Packet Too Big) messages. Ensure your firewall allows outbound ICMPv6 type 3 code 4 and inbound ICMPv6 type 2 messages. Disabling Path MTU Discovery on the client side is a workaround but reduces performance.

Can I use Cloudflare Proxy with IPv6?

Yes, but you must configure your origin server to accept connections from Cloudflare’s IPv6 ranges. You also need to ensure your DNS AAAA records point to your server’s actual IPv6 address, not just the proxied one, depending on your desired setup. Verify that your firewall whitelists Cloudflare’s IPv6 IP blocks.

What is the difference between SLAAC and DHCPv6?

SLAAC (Stateless Address Autoconfiguration) allows devices to generate their own addresses using the prefix from Router Advertisements. DHCPv6 is stateful and can provide additional information like DNS server addresses. Most modern networks use SLAAC for addressing and DHCPv6 for options, or just SLAAC entirely.