fren
Log In

Understanding IPv6 on a VPS

2 min read07 November 2026

Every NeoHeberg VPS includes a public IPv6 address. Unlike a private address, it is routable from the internet: any service listening on it is reachable by everyone, which makes a firewall essential. Understanding the address, route and listening socket avoids false diagnoses.

A public address, not a private one

The address looks like 2001:db8:... and belongs to you for the life of the service. It is not translated by NAT: the port you open is the port the client reaches. There is no port forwarding to configure, but also no implicit protection. A service bound to [::] is exposed immediately.

Check the address and route

Bash
ip -6 addr show
ip -6 route
ping -6 -c 3 2001:4860:4860::8888

ip -6 addr show must list the address on the network interface with a prefix and scope global. ip -6 route must show a default route through the gateway. If the ping fails, check the route and firewall before blaming the provider.

Make a service listen

A server must listen on a reachable address, not only on 127.0.0.1. With ss you see the real sockets:

Bash
ss -6 -tlnp

The local column shows [::]:80 for all IPv6 interfaces, or [::1]:80 for loopback only. Nginx usually listens on listen [::]:80; in addition to listen 80;. A Node.js service should use host: '::' or let the system choose, never localhost if you expect remote clients.

Firewall and IPv6

UFW filters IPv6 when IPV6=yes is set in /etc/default/ufw, which is the Debian default. Check it after enabling:

Bash
sudo ufw status verbose

Rules must appear with the (v6) marker. With nftables or iptables, confirm that the input chain handles ip6. An IPv4-only rule does not protect an IPv6 service.

AAAA DNS and testing

For a domain name to point at the IPv6 address, create an AAAA record at your DNS provider:

Bash
dig +short AAAA votre-domaine.fr

The answer must match the VPS address. An A record alone is not enough: IPv6 clients will not read it. Then test from the outside with curl -6 -I http://votre-domaine.fr/. The IPv6 test page shows which path your browser actually used.

Advertisement

Was this article helpful?

Read next