Configure a static IPv6 address on a Linux VPS

If your server does not answer on IPv6 yet, the address is probably assigned but not configured in the system. This guide shows how to set it statically on Ubuntu, Debian and AlmaLinux, test connectivity and protect it with a firewall. It applies to any VPS Linux Infrawire with an IPv6 allocation.

📋 Prerequisites

• A VPS with root SSH access, running Ubuntu 24.04, Debian 12 or AlmaLinux 9 / Rocky 9. Your client area gives you the IP and the root password.
• Your IPv6 address, prefix length and gateway, written below as VPS_IPV6, PREFIX (often 64) and IPV6_GATEWAY.
• The interface name (eth0 in these examples):

Bash
1ip -br link
2ip -6 addr show
3ip -6 route show

Keep a second SSH session open while you edit network files, so a mistake does not lock you out.

🟠 Ubuntu 24.04: Netplan

Netplan files live in /etc/netplan/. On cloud images the file is often generated by cloud-init and can be overwritten at reboot, so disable its network management first:

Bash
1sudo nano /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

YAML
network: {config: disabled}

Then edit your Netplan file (for example /etc/netplan/50-cloud-init.yaml) and add the IPv6 address and route. Keep your existing IPv4 lines:

YAML
1network:
2  version: 2
3  ethernets:
4    eth0:
5      addresses:
6        - VPS_IP/IPV4_PREFIX
7        - VPS_IPV6/PREFIX
8      routes:
9        - to: default
10          via: IPV4_GATEWAY
11        - to: default
12          via: IPV6_GATEWAY
13      nameservers:
14        addresses: [1.1.1.1, 2606:4700:4700::1111]

Bash
1sudo chmod 600 /etc/netplan/*.yaml
2sudo netplan try

netplan try rolls back automatically after 120 seconds if you do not confirm, which protects you from a bad configuration. Validate with Enter, or use sudo netplan apply once you are sure.

🔴 Debian 12: /etc/network/interfaces

Bash
1sudo nano /etc/network/interfaces

Add a stanza for the same interface:

INI
iface eth0 inet6 static
    address VPS_IPV6/PREFIX
    gateway IPV6_GATEWAY
    dns-nameservers 2606:4700:4700::1111

The dns-nameservers line only works if the resolvconf package is installed; otherwise put the resolver in /etc/resolv.conf. Apply the change:

Bash
1sudo systemctl restart networking

Restarting the service may drop the connection for a moment. If the interface is managed by DHCP for IPv4 and you only want to add IPv6, you can also run sudo ifdown eth0 && sudo ifup eth0 from the console.

🔵 AlmaLinux 9 / Rocky 9: nmcli

NetworkManager manages the interface. List the connection names first:

Bash
1nmcli connection show

Use the name you see (CON_NAME, for example System eth0 or cloud-init eth0):

Bash
1sudo nmcli connection modify 'CON_NAME' ipv6.method manual \
2  ipv6.addresses VPS_IPV6/PREFIX \
3  ipv6.gateway IPV6_GATEWAY \
4  ipv6.dns 2606:4700:4700::1111
5sudo nmcli connection up 'CON_NAME'

The change is stored in the connection profile and survives reboots.

✅ Test the connection

Bash
1ip -6 addr show dev eth0
2ip -6 route show default
3ping -6 -c 3 IPV6_GATEWAY
4ping -6 -c 3 2606:4700:4700::1111
5curl -6 -I https://www.debian.org

On older systems ping6 does the same as ping -6. Also check from another machine that has IPv6, using your VPS address:

Bash
1ping -6 -c 3 VPS_IPV6
2ssh root@VPS_IPV6

🔥 Firewall for IPv6

A rule that exists only for IPv4 leaves the IPv6 side open. With UFW, make sure IPv6 support is on:

Bash
1grep IPV6 /etc/default/ufw   # must show IPV6=yes
2sudo ufw allow 22/tcp
3sudo ufw allow 80,443/tcp
4sudo ufw enable
5sudo ufw status verbose

Each rule then appears twice, once with (v6). On AlmaLinux, firewalld covers both families with the same commands:

Bash
1sudo firewall-cmd --permanent --add-service=ssh
2sudo firewall-cmd --permanent --add-service=https
3sudo firewall-cmd --reload

🛠️ Troubleshooting

The address is there but the ping to the gateway fails. Check the prefix length and the gateway. Some networks use a link-local gateway such as fe80::1; in that case set the gateway to this value and add dev eth0 to the route if your tool asks for it.

It works until the next reboot. Another tool rewrites the configuration: cloud-init on Ubuntu (see the first section), or a stray ip -6 addr add command that never reached the configuration files. Commands run with ip are temporary.

IPv6 works for pings but not for websites. The firewall or the service listens on IPv4 only. Check with ss -tlnp: a web server must show [::]:80, not just 0.0.0.0:80. In nginx, add listen [::]:80; to the server block.

---

🚀 Your VPS now speaks IPv6: publish an AAAA record and your services are reachable on both protocols.