IPv6 is the newer version of internet addressing. It uses 128-bit addresses instead of IPv4's 32-bit ones, so there are enough for every device to have its own public address. Most business circuits can run both at once, called dual stack, and there is no need to switch IPv4 off. What you do need is an IPv6 block from your carrier and firewall rules written for IPv6 on purpose, because computers and phones will use it whenever it is available.
IPv6 has been "coming soon" for so long that many businesses have stopped listening. Meanwhile it has quietly arrived: modern operating systems prefer it, mobile networks rely on it, and large cloud and content providers serve it. You do not have to rebuild anything. You do have to make a few deliberate decisions.
Why IPv6 exists
IPv4 has about 4.3 billion possible addresses, which looked like plenty when it was designed. The regional registries that hand out addresses ran through their free pools years ago. ARIN, the registry for North America, exhausted its free pool in 2015. Since then, IPv4 addresses have been bought and sold on a transfer market, and that scarcity is one reason carriers are careful with large static IPv4 blocks.
The workarounds, mostly network address translation (NAT) layered on NAT, keep IPv4 going. They also add complexity, break some applications, and make it harder to reach devices directly. IPv6 removes the shortage outright. Its address space is so large that a single business site is routinely given more addresses than the entire IPv4 internet.
What actually changes
| IPv4 | IPv6 | |
|---|---|---|
| Address size | 32 bits, written like 203.0.113.10 | 128 bits, written like 2001:db8:1234::10 |
| Typical business allocation | A handful of static addresses, such as a /29 or /28 | A /48 or /56 prefix, containing thousands or millions of subnets |
| NAT | Almost always used inside the office | Normally not used; devices have public addresses |
| How devices get addresses | DHCP or manual | Stateless autoconfiguration (SLAAC), DHCPv6, or manual |
| Standard LAN subnet | Varies, often a /24 | A /64, always |
Dual stack, in one paragraph
Dual stack means the circuit, your router and your devices run IPv4 and IPv6 side by side. When a device connects to a service that supports IPv6, it will generally use IPv6. When the service does not, it falls back to IPv4. Users notice nothing. This is how nearly every business adopts IPv6, and it can stay that way indefinitely.
The security point most offices miss
Windows, macOS, iOS and Android all have IPv6 turned on by default. If your carrier starts handing out IPv6, or someone enables it on the router, every device on the network may pick up a public IPv6 address. Whether that is safe depends entirely on your firewall.
- NAT is not a firewall. With IPv4, NAT hides inside devices as a side effect. With IPv6 there is no NAT, so the firewall's rules are the only thing deciding what reaches a device from outside.
- IPv4 rules do not cover IPv6. On many firewalls the two are separate policy sets. A carefully built IPv4 policy and a blank IPv6 one is a real gap.
- Filters and logs need both. Web filtering, logging, intrusion prevention and monitoring should all see IPv6 traffic, or you are blind to part of your network.
The right default is the same as with IPv4: allow outbound, allow the replies, block unsolicited inbound, then open only what you host. The difference is that you have to set it deliberately. A managed network or security service should confirm this for you before IPv6 is switched on.
What your carrier gives you
Most carriers that sell dedicated internet access can provide IPv6 alongside IPv4, usually at no extra charge, but it is not always turned on by default. Things to pin down:
- Prefix size. A /48 is a common recommendation for a business site; some carriers assign a /56. Either is plenty for most offices, but a /48 gives more room to organise.
- Static or delegated. On dedicated circuits the prefix is usually static and routed to you. On some shared or cable services it may be handed out by prefix delegation and can change.
- Reverse DNS. If you run a mail server or anything that needs reverse lookups, ask how IPv6 reverse DNS is handled.
- BGP. If you hold your own address space and announce it, confirm the carrier supports IPv6 sessions too. See static IPs and BGP and, for networks that run their own routing, IP transit.
A worked example
A hypothetical office used to show the arithmetic, not a real client or a specific carrier's allocation.
Suppose an office has a /29 of IPv4. That is 8 addresses, of which typically 5 are usable once the network, broadcast and gateway addresses are taken out. Those 5 are shared carefully between the firewall, a VPN and a couple of published services, and everything inside sits behind NAT.
The same carrier assigns a /48 of IPv6. Because every LAN subnet in IPv6 is a /64, a /48 contains 216, or 65,536, separate /64 subnets. A /56 would contain 256 of them. Each /64 holds more addresses than anyone will ever use.
A sensible plan for this office might give one /64 to each network segment: staff, guest Wi-Fi, voice, cameras, printers, servers and management. That is seven subnets out of 65,536. The spare space lets them number each floor or each future site in a predictable pattern, which makes firewall rules and troubleshooting easier later.
Nothing about the IPv4 side changes. The office runs both, and the firewall has two policies that match in intent.
Who should care now
- Anyone enabling IPv6 by accident. If your carrier or router vendor turns it on, you want the firewall ready first.
- Businesses hosting public services. Offering IPv6 lets users on IPv6-heavy networks, including many mobile networks, reach you without translation along the way.
- Anyone building a new network or moving office. Designing both at the start costs little. Retrofitting later costs more. If you are moving, add it to the office move checklist.
- Government contractors. US federal agencies are under an OMB directive, M-21-07, to move their networks towards IPv6-only, and vendors to those agencies may be asked about support.
Turning it on without surprises
- Inventory first. List the firewall, routers, switches, Wi-Fi controller, phones and any cameras or door systems, and check which support IPv6 and at what software version.
- Write the IPv6 firewall policy to match the IPv4 intent: outbound allowed, replies allowed, unsolicited inbound blocked, published services opened one by one.
- Plan the subnets. One /64 per segment, numbered in a pattern someone else could follow.
- Enable it on one segment, such as a staff test group, before the whole office.
- Check the basics: devices get addresses, IPv6 test sites load, logs and filters show IPv6 traffic, and nothing inside is reachable that should not be.
- Roll out segment by segment, leaving guest Wi-Fi and anything with doubtful support until last.
- Add IPv6 to DNS for published services only once they have been tested over it.
Most offices can do this over a few weeks of normal change windows, without a single disruptive cutover. The work is mostly planning, not configuration.
What to check on your own equipment
Older firewalls sometimes support IPv6 routing but not IPv6 inspection features, such as web filtering or intrusion prevention, at the same level as IPv4. Some older desk phones and building systems do not support it at all, which is fine, because dual stack lets them carry on over IPv4. The thing to avoid is a device that gets an IPv6 address and then sits outside your security tools. If a device cannot be managed properly over IPv6, keep it on an IPv4-only segment until it is replaced.
Common myths
- "We have to switch off IPv4." No. Dual stack can run for as long as you like.
- "IPv6 is faster." Not inherently. It can avoid translation steps, but speed depends on the circuit and the path.
- "IPv6 is less secure." It is as secure as the policy you give it. The risk is an unmanaged policy, not the protocol.
- "Our old equipment will not cope." Sometimes true of older firewalls and phones. Check before enabling, and plan replacements into normal refresh cycles.
Questions to ask your carrier
- Do you support IPv6 on this circuit, and is it on by default?
- What prefix size will I get, and is it static?
- Is it routed to my firewall, or delegated dynamically?
- Does your DDoS protection and monitoring cover my IPv6 addresses as well as IPv4?
- How do you handle IPv6 reverse DNS?
- If I use BGP, can we run an IPv6 session alongside IPv4?
Getting it right on the next circuit
IPv6 support is one of the things we check when several carriers bid on your address, along with price, install date and SLA, so you know what you are getting before you sign. If your current carrier already does it well, that is a point in its favour at renewal. The quote is free with no obligation and you usually hear back the same day. Send us your address, call 478-758-8091 or text (347) 870-0965.
