Set Up IPv6 on Your VPS: AAAA Records & Firewall Rules

More networks are IPv6-only or IPv6-preferred than most admins realize, and if your VPS only answers on IPv4, a slice of your visitors are taking a slower path to reach you — or not reaching you at all. This guide walks through enabling IPv6 on a SkyServer VPS, adding the right DNS records, and the firewall and web-server steps people usually forget.

Symptom: Site Loads Over IPv4 but Fails or Times Out Over IPv6

You test your domain with curl -6 https://yourdomain.com and it hangs or refuses the connection, even though the site loads fine in a normal browser. Or a monitoring tool flags "no AAAA record found." Sometimes it shows up differently: outbound mail gets a soft bounce mentioning an IPv6 PTR mismatch, or a client on a mobile carrier's IPv6-only network reports your site "won't load" while it works for everyone else.

All of these point to the same root issue — your server is dual-stack capable in theory, but IPv6 isn't actually wired up end to end.

Cause: One Link in the Chain Is Missing

IPv6 needs every layer to cooperate: the network interface, DNS, the firewall, and the web server. Miss any one and you get a partial or broken setup. The usual culprits:

• No IPv6 address assigned to the VPS, or it's assigned but the interface was never configured to use it.
• No AAAA record in your DNS zone, so IPv6-only resolvers have nothing to connect to even if the server is ready.
• Firewall only has IPv4 rules. UFW, firewalld, and CSF all keep separate IPv6 rule sets by default — an IPv4 allow rule does nothing for IPv6 traffic.
• Web server isn't listening on the IPv6 socket. Nginx and Apache need an explicit listen directive for [::]; it isn't automatic just because the OS has an IPv6 address.

Fix: Enable IPv6 Layer by Layer

1. Confirm your VPS has an IPv6 address

Check the network interface first:

ip -6 addr show

If you see an address under inet6 with global scope (not just fe80:: link-local), you're allocated one. If nothing shows up, check your VPS control panel — on SkyServer VPS plans, IPv6 is assigned per server and may need to be enabled from the panel before it appears on the interface.

On Ubuntu/Debian with netplan, confirm the config includes the address:

cat /etc/netplan/*.yaml

You should see an addresses block listing both the IPv4 and IPv6 CIDR. If IPv6 is missing, add it, then apply:

sudo netplan apply

On CentOS/AlmaLinux/Rocky with NetworkManager, use nmcli or edit the connection profile directly, then restart networking:

nmcli con mod eth0 ipv6.addresses "2001:db8::10/64"
nmcli con mod eth0 ipv6.method manual
nmcli con up eth0

Reboot or restart the network service and re-check with ip -6 addr show.

2. Add the AAAA record

In cPanel, go to Domains → Zone Editor, pick the domain, and add a record: type AAAA, name @ (or the subdomain), value your server's IPv6 address. Add a second AAAA for www if you use that host too. In WHM, the same is under DNS Functions → Edit DNS Zone.

Give it a few minutes to propagate, then confirm:

dig AAAA yourdomain.com +short

3. Open the firewall for IPv6

Each firewall tool keeps IPv6 rules separately — don't assume your IPv4 rules carry over.

After changes, test from an IPv6-capable network or an online IPv6 checker — don't rely on a connection that's IPv4-only, since it won't tell you anything about the IPv6 path.

4. Make the web server listen on IPv6

For Nginx, add the IPv6 listen line next to your existing one in the server block:

server {
    listen 80;
    listen [::]:80;
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name yourdomain.com;
    ...
}

Then test and reload:

nginx -t && systemctl reload nginx

For Apache, add or confirm in your virtual host or ports.conf:

Listen [::]:80
Listen [::]:443

Restart Apache afterward. If you're on cPanel/WHM with Apache, this is usually already handled when the server has IPv6 configured at the OS level — check with apachectl -S to confirm the bindings show [::].

5. Test the full path

curl -6 -I https://yourdomain.com
ping6 yourdomain.com
traceroute6 yourdomain.com

If curl -6 returns a proper HTTP response, you're dual-stack and working end to end. If it hangs, work back through the steps above — interface, DNS, firewall, then web server — in that order, since each depends on the one before it.

Prevention: Keep IPv4 and IPv6 in Sync

The most common way IPv6 breaks again later is a config drift: someone updates the A record after a migration or IP change and forgets the AAAA record, or a firewall rule gets added to the IPv4 rule set only. A few habits keep that from happening:

• Whenever you change your server's IPv4 address, check whether the IPv6 address changed too, and update both DNS records together.
• When you add a firewall rule, add it to both the IPv4 and IPv6 rule sets in the same change, not as an afterthought.
• Add an IPv6 check to whatever uptime monitoring you already run — most monitoring tools let you force an IPv6-only check per endpoint.
• Document your server's IPv6 address in the same place you keep the IPv4 one, so it doesn't get missed during migrations or DNS audits.

Frequently Asked Questions

Do I actually need IPv6 on my VPS?

It's not mandatory, but a growing share of mobile and residential networks are IPv6-first, and some of those fall back to IPv4 slowly or not cleanly. If your VPS has an IPv6 address allocated already, there's little downside to configuring it properly rather than leaving it half-set-up.

My site works over IPv4 but not IPv6 — what's the fastest way to find the break?

Run the four checks in order: ip -6 addr show (interface), dig AAAA yourdomain.com (DNS), your firewall's IPv6 rule list, then curl -6 against the server. Whichever one fails first is where the chain breaks.

Does a SkyServer VPS include IPv6 by default?

IPv6 is assigned per VPS plan and may need to be enabled from the control panel before the interface picks it up. Check your VPS dashboard for an IPv6 address listing, or open a support ticket if you don't see one and need it enabled.

How do I add an AAAA record if I'm on cPanel?

Go to Domains → Zone Editor, select the domain, and click "Add Record." Choose type AAAA, and enter the server's IPv6 address as the value. It works exactly like adding an A record, just with a longer address.

Should I disable IPv6 instead of fixing it?

Only as a last resort. Disabling it hides the symptom (connection failures) without removing the cause, and if the AAAA record is still published, IPv6-only clients will keep trying to reach a server that no longer answers. It's better to either fix the chain or remove the AAAA record entirely until you can.