IPv6 setup on Debian 9 Stretch

IPv6 isn’t new at all, but it’s stunning to see how much the web isn’t ready for it at all!

But that can change, and making your web server compatible with it is a great start!

Today I discovered that my server had a IPv6 address assigned, but was not configured by default.

Identify your IPv6 address and gateway

At OVH, two IPv6 informations are given along the IPv4:

Since only one address is available, the network prefix, alias netmask is 128.

Setting up the network

Using root access, you should edit /etc/network/interfaces:

sudo nano /etc/network/interfaces

By default, this file contains only the IPv4 settings:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens3
iface ens3 inet dhcp

You want to edit this file to add the IPv6 loopback and settings.
You can try auto settings; but in my case, I had to use the static network settings:

iface lo inet6 loopback

iface ens3 inet6 static
    address 2001:41d0:305:2100::10f2
    netmask 128

    post-up /sbin/ip -f inet6 route add 2001:41d0:305:2100::1 dev ens3
    post-up /sbin/ip -f inet6 route add default via 2001:41d0:305:2100::1
    pre-down /sbin/ip -f inet6 route del 2001:41d0:305:2100::1 dev ens3
    pre-down /sbin/ip -f inet6 route del default via 2001:41d0:305:2100::1

Testing the Networking configuration

First, you want to test the configuration to make sure your server is correctly set up, and will not end up unaccessible from the outside world at the first reboot.

sudo ifup -a --no-act ; echo "status: $?"

Expected output:

/bin/run-parts --exit-on-error /etc/network/if-pre-up.d
/bin/run-parts --exit-on-error /etc/network/if-up.d
status: 0

If the status is not at 0, the configuration file have error, and you might wanna correct it before going further.

Testing IPv6

Now that the configuration is correct, you can restart the networking service:

sudo service networking restart

And now you can test IPv6 using ping6:

ping6 -c 4 google.com

If the ping resolves, your network is correctly set up. Otherwise, your IPv6 settings are not okay.

Declare IPv6 support in your DNS entries

At your registar settings, you want to add a AAAA entry, corresponding to the IPv6 DNS resolution.

Your entry should look like something like that:

IN AAAA 2001:41d0:305:2100:0:0:0:10f2

(here the example for thomasdurand.fr)

Configure your HTTP server

Your HTTP server must listen to IPv6 address. You should make sure your HTTP server is correctly set up.

For example, with Nginx, your /etc/nginx/nginx.conf file should contains IPv6 declarations:

server {
  listen 80; # IPv4
  listen [::]:80; # IPv6

  # and/or (if you’re using SSL/TLS)

  listen 443 ssl; # IPv4
  listen [::]:443 ssl; # IPv6

  (...)
}

Testing your full configuration

If you’re network is not IPv6 ready, there are online tools to test if your website supports IPv6. They’re great for troubleshooting.

I’ve used IPv6-test.com.