How to Troubleshoot IPv6 Connectivity

To troubleshoot IPv6, check each link in the chain in order: your ISP must provide IPv6, your router must request it on the WAN side and advertise it on the LAN side, your device must configure a global address and default route, and nothing in between, such as a firewall or VPN, may block it. Most failures come down to a router setting, a missing prefix delegation or a VPN that disables IPv6.

IPv6 problems are tricky because they rarely look like an outage. Most operating systems and browsers fall back to IPv4 automatically (a technique called Happy Eyeballs, RFC 8305), so a broken IPv6 path may show up only as an IPv6 test failing, some sites loading slowly, or certain apps timing out. This guide walks through the checks from the outside in.

Step 1: Test your current IPv6 status

Open our IPv6 connectivity test. It tells you whether your browser can reach an IPv6-only endpoint, which address you use, and whether your browser prefers IPv6 or IPv4 when both are available. Typical outcomes:

Step 2: Confirm your ISP supports IPv6

Not every provider offers IPv6, and some only enable it on newer equipment or specific plans. Check your ISP's support pages or ask. If the answer is no, nothing at home will give you native IPv6; your options are waiting, switching provider, or a tunnel service. If you are unsure which provider you have, What is my ISP identifies it from your IP address.

Step 3: Check the router's WAN (internet) settings

Log in to the router and find the IPv6 or internet settings. Look for:

• IPv6 enabled. Many routers ship with IPv6 off.
• Connection type. Common options are "Native" or "DHCPv6" (cable and fiber), "PPPoE" with IPv6 (many DSL and fiber lines, using the same login as IPv4), and transition modes such as 6rd or DS-Lite. Use whatever your ISP documents. "Auto" works on many networks.
• Prefix delegation (DHCPv6-PD). This is the most important setting. Your router requests a block of addresses from the ISP, typically a /56 or /60, and carves /64 subnets out of it for your LANs. If PD is disabled, the router may get an address for itself but have nothing to hand out to your devices.
• Prefix size hint. Some routers let you request a prefix length. Ask for what your ISP provides; requesting a size it does not support can cause it to give you none.

On the router's status page, a working WAN shows a global IPv6 address and a delegated prefix, for example 2001:db8:4a00:3c00::/56.

Step 4: Check the router's LAN settings

The router announces IPv6 to your devices with Router Advertisements (RA). Devices then configure addresses in one of two ways:

• SLAAC (Stateless Address Autoconfiguration): the device builds its own address from the advertised /64 prefix. This is the most compatible option, and Android supports only this method for address assignment, not stateful DHCPv6.
• Stateful DHCPv6: a DHCPv6 server assigns addresses, as DHCP does for IPv4.

Make sure Router Advertisements are enabled, the LAN uses a /64 prefix (SLAAC requires exactly 64 bits for the interface identifier), and DNS servers are advertised either through RA (the RDNSS option, RFC 8106) or stateless DHCPv6. A safe default is "SLAAC + stateless DHCPv6" or "SLAAC + RDNSS". You can check prefix boundaries with our subnet calculator.

Step 5: Check the device's addresses and routes

A device with working IPv6 needs a global unicast address (usually starting with 2 or 3, from 2000::/3) and a default route. A link-local address starting with fe80:: is always present and proves nothing about internet access.

Windows

ipconfig
netsh interface ipv6 show addresses
route print -6

Look for an "IPv6 Address" or "Temporary IPv6 Address" that does not start with fe80, and a "Default Gateway" with a fe80:: address (gateways are normally link-local). Also confirm that "Internet Protocol Version 6 (TCP/IPv6)" is ticked in the adapter's properties; in PowerShell, Get-NetAdapterBinding -ComponentID ms_tcpip6 shows it.

macOS

ifconfig en0 | grep inet6
netstat -rn -f inet6 | grep default

In System Settings > Network > Wi-Fi > Details > TCP/IP, "Configure IPv6" should be set to Automatically.

Linux

ip -6 addr show
ip -6 route show default

Expected output includes a line such as inet6 2001:db8:4a00:3c01:8e1f:12ff:fe3a:77b1/64 scope global dynamic and a route like default via fe80::1 dev wlan0 proto ra. If sysctl net.ipv6.conf.all.disable_ipv6 returns 1, IPv6 is disabled on the system.

Step 6: Test connectivity with ping and traceroute

Ping a well-known IPv6 address directly, which removes DNS from the equation. These are the IPv6 addresses of Cloudflare's and Google's public DNS resolvers:

• Ping by address fails: routing problem. Check the default route and the router's WAN status.
• Ping by address works, by name fails: DNS problem, or the name has no AAAA record.
• Both work, but sites hang: likely an MTU or firewall issue (next step).

Our guide to ping and traceroute explains how to read the output.

Step 7: Check firewalls and MTU

IPv6 depends on ICMPv6 far more than IPv4 depends on ICMP. Neighbor Discovery, Router Advertisements and Path MTU Discovery all use it. A firewall rule that blocks all ICMPv6 breaks IPv6 in confusing ways. Allow at least the message types recommended in RFC 4890, especially Packet Too Big, Neighbor Solicitation/Advertisement and Router Advertisement.

IPv6 routers never fragment packets in transit, so when a link has a smaller MTU, the sender must receive a Packet Too Big message and shrink its packets. If those messages are blocked, small requests work but large responses stall: pages start loading and then hang. This is common on PPPoE (MTU 1492) and tunnelled connections. Every IPv6 link must support at least 1280 bytes (RFC 8200), so lowering the router's IPv6 MTU or enabling MSS clamping usually resolves it.

Step 8: Check VPNs and security software

VPNs are a very common reason IPv6 tests fail. Many VPN clients do not route IPv6 through the tunnel, so to prevent your real IPv6 address from leaking they disable or block IPv6 entirely while connected. Others route only IPv4 and leave IPv6 untouched, which exposes your real address. Disconnect the VPN and test again to see which is happening, and read DNS and WebRTC leaks for the privacy side. Antivirus suites with network protection and corporate endpoint software can also block IPv6.

Frequently asked questions

Should I disable IPv6 if it causes problems?

Only as a temporary workaround. Disabling IPv6 can break features that rely on it, and an increasing share of the internet is reachable natively over IPv6. Fixing the router setting or MTU issue is better than turning it off.

Why do I have an IPv6 address but the test still fails?

Either it is only a link-local fe80:: address, or the router has no working upstream route. Check for a global address and a default route on the device, then the WAN status on the router.

Why does my IPv6 address keep changing?

Operating systems use temporary privacy addresses that rotate regularly, and some ISPs change the delegated prefix when the router reconnects. Both are normal.

Do I need to set up port forwarding for IPv6?

No. IPv6 does not use NAT, so instead you add a firewall rule on the router that allows inbound traffic to a specific device's address and port.