IPv6 support
IPv6 support: how websites, L4 forwarding, origin addresses, kernel bans and TOA handle IPv6, and how to read a website IPv6 runtime state.
What it does
A summary of how each module handles IPv6, to help you plan websites, L4 forwarding and origins.
When to use it
- You want a website to accept both IPv4 and IPv6 visitors.
- Your origin has only an IPv6 address.
- L4 forwarding needs an IPv6 listener.
- You want to know whether a protection feature covers IPv6 visitors.
Where to configure it
| Module | Location |
|---|---|
| Websites | Sites, edit the site, "IPv6 switch"; the "IPv6 runtime state" in the list shows the result |
| L4 forwarding | "IPv6 enabled" on the forwarding rule |
| Origin addresses | The origin address of a site or L4 forwarding; write IPv6 as [2001:db8::1]:8080 |
Support by module
| Module | IPv6 |
|---|---|
| Website access | With the site's IPv6 switch on, the node listens on both IPv4 and IPv6 (0.0.0.0 and [::]) on the site's ports |
| L4 forwarding | A forwarding rule can enable an IPv6 listener |
| Origin addresses | IPv6 addresses can be used, in square brackets |
| Kernel bans | Counted per client: an IPv4 address, or an IPv6 /64 network |
| TOA | Carries IPv4 client addresses only; use PROXY protocol for IPv6 clients |
| PROXY protocol v1 | Carries both IPv4 and IPv6 clients |
| DNS records | DNS provider integrations support the AAAA record type |
| Lists and rules | Address fields in lists and rule conditions accept IPv6 addresses |
A website's IPv6 runtime state
| State | Meaning |
|---|---|
| Disabled | The site has IPv6 off |
| Pending | Enabled, waiting for nodes to apply it |
| Active | Nodes are listening on IPv6 |
| Failed | Nodes failed to apply it |
The switch says what you want; the actual state comes from the node runtime.
FAQ
IPv6 is on but visitors still use IPv4
Whether a visitor uses IPv6 also depends on whether the domain resolves to an IPv6 address and on the visitor's own network. Check that the IPv6 runtime state is Active, then check the domain's AAAA record.
My origin has only IPv6
Write the origin address with square brackets, for example [2001:db8::1]:8080.
L4 forwarding should pass the IPv6 client address to the origin
Use PROXY protocol v1. TOA carries IPv4 client addresses only.
The runtime state stays Pending
It is waiting for nodes to apply the latest publication. A node that is offline or runs an older version does not apply it; check the node list.