This website is IPv6-only.
If this page loaded for you, your network can access the modern Internet. Great. If it did not, you just hit a compatibility wall that should be torn down.
What this means
- No IPv4 fallback is configured for this host.
AAAArecords resolve,Arecords don't.- About half of all Internet clients globally can connect to this website.
Why do this?
NAT is not free. NAT traversal stacks (STUN/TURN/ICE), relays, and other hacks exist because we broke peer-to-peer connectivity. Large networks may even run out of port numbers. Moreover, having many clients behind one NATed address makes fine-grained rate-limits or blocks impossible, leading users straight into CAPTCHA hell.
IPv6 simplifies at scale. One protocol, globally unique addressing, and less stateful translation glue in the path. There's a reason large ISPs and cloud providers are increasingly moving towards IPv6-only in their internal networks.
With IPv6 you can
IPv6 enables effortless P2P connectivity. The best way to reduce dependence on centralized gatekeepers (cloud providers, CDNs, ...) is peer-to-peer connectivity. Remember the 90s, when everyone could run their BBS or early website from a home? Let's bring that back with IPv6.
Client-side IPv6-only is already production reality. Some large mobile APNs have been IPv6-only (+464XLAT) for over a decade. It just works. It simplifies maintenance. There is no downside.
Why this is also an activism issue
Policy follows usage patterns: The more people use IPv6 (client or server-side), the more will ISPs, cloud providers, lawmakers, and other key players be convinced that IPv6 is not an optional, additional feature, but the mandatory default for access to the Internet. But there also need to be some people who are vocal about it. Encourage and help with IPv6 support where you can. This work benefits society as a whole:
- IPv6 enables true ownership on the Internet. A /24 for your own IPv4 ASN is expensive. That blocks small orgs from real network independence. But obtaining a /48 is almost free. Not only does this give you true
ownership of your addresses, it also allows you to set up cool features such as global BGP anycast routing. - P2P needs reachability. Centralization grew partly because NAT made direct peer links fragile, expensive, or just more technically challenging to maintain. Where have the times gone when people would host services on their home computers? To keep the Internet free, independent, and in the hands of the people, we need to make self-hosting available for the masses.
- Policy follows architecture. ISPs and lawmakers like to claim that, although IPv6 is state-of-the-art, IPv4 is sufficient to provide access to
To prove them wrong, build morepractically all endpoints .IPv6-only endpoints and tell them why IPv6 should be considered the default, not an afterthought.
How to move forward
On your local network:
- Enable IPv6 on your router and LAN.
- Deploy IPv6-only or IPv6-mostly internally, with DNS64/NAT64 or 464XLAT to reach IPv4-only destinations.
- Automate DNS updates in case your ISP prefix changes. Use ULA internally where stability matters.
For your services:
- Publish
AAAArecords for your all your services. Switch backends to IPv6-only. - To keep compatibility with legacy users, configure a dual-stack reverse proxy at the edge.
- Document your setup publicly so others can copy it ;-)
Frequently Questioned Answers
IPv4 NAT keeps me safe, so IPv6 is less secure.
NAT is not more secure than a default-deny stateful firewall. If you have NAT on a modern system, you almost certainly already have a stateful firewall. Secure network operations require correct configuration, but that is equally true for IPv4 and IPv6.
IPv6 means every device is publicly reachable.
No. Publicly addressable does not mean publicly reachable. Reachability depends on firewall policy, which almost certainly denies incoming traffic by default, just like incoming IPv4 traffic is denied by default unless there is a port forwarding rule.
IPv6-only is impossible because some services or users are still IPv4-only.
That is exactly why transition mechanisms exist: dual-stack edges, DNS64/NAT64, and 464XLAT. IPv6 coverage keeps increasing; pressure should be on remaining IPv4-only services to catch up. But in the meantime, transition technologies have proven to work very reliably, as can be seen by mobile APNs switching to IPv6-only.
IPv6 is too hard.
IPv6 is likely only hard because you have been taught and/or have far more experience with IPv4 or because IPv6 support in certain software packages isn't quite as polished yet. If you were to learn IPv6 from scratch now, you'd likely find it just as easy or easier than IPv4. But it does require a different mindset, and making that switch as a network admin with extensive IPv4 experience isn't easy.
IPv6 addresses are ugly.
Use DNS. Modern infrastructure should not depend on memorizing raw addresses. Automate address assignment and the DNS entries as much as possible.
There is no business value.
IPv4 address space is pricey. Moreover, if your network is behind IPv4 NAT, it might run into more captchas etc. because rate limits and blocks affect your whole network. Reducing dependence on (CG)NAT complexity can also provide operational value.
Takeaway
Build IPv6-first, keep IPv4 compatibility only where needed! On your local access network, consider deploying IPv6-mostly. For your services, keep the backbone IPv6-only and deploy dual stack at the edge if necessary.