IPv6 in 2026: Why IPv4 Scarcity Now Shows Up on Your Cloud Bill, What Breaks on a Dual-Stack Network, and How to Turn It On Without Opening a Hole in Your Firewall
- Equipo de Internet Pros
- September 14, 2026
- Redes y Seguridad
Este artículo está disponible solo en inglés.
For twenty years IPv6 was the upgrade everyone agreed was inevitable and nobody had a reason to do this quarter. IPv4 kept working, NAT stretched the supply of addresses, and the new protocol looked like a project with cost and no visible payoff. In 2026 that calculation has quietly flipped. The major clouds charge for every public IPv4 address, addresses trade on a secondary market for tens of dollars each, and close to half of the users reaching large services like Google already arrive over IPv6. The question for a business is no longer whether to adopt it, but whether to do it deliberately or discover it by accident.
The Address Pool Ran Dry Years Ago
IPv4 has room for about 4.3 billion addresses, which sounded limitless in 1981. The central pool held by IANA was handed out in 2011, and the regional registries followed: APNIC in Asia almost immediately, ARIN in North America in 2015, and RIPE NCC in Europe ran out entirely in 2019. Since then a new organisation can only get meaningful IPv4 space by buying or leasing it from someone who already has it.
The internet did not stop growing, so providers stretched what they had. Carrier-grade NAT puts hundreds or thousands of customers behind a single public address. It works well enough for browsing, but it breaks incoming connections, complicates peer-to-peer calling and gaming, and means that one abusive user on a shared address can get everyone behind it blocked or buried in CAPTCHAs.
Why It Now Costs Real Money
The change most businesses felt first arrived on an invoice. Since February 2024 Amazon Web Services charges for every public IPv4 address, in use or idle, at half a cent per hour, roughly 44 dollars per address per year. Other cloud providers price public addresses in a similar way. A modest environment with a few dozen load balancers, NAT gateways and forgotten elastic IPs can carry an address bill in the thousands before anyone looks.
| Approach | How it works | Main cost or risk |
|---|---|---|
| IPv4 with NAT | Private addresses inside, a few public addresses at the edge | Paying for scarce public addresses; NAT gateways add cost and state |
| Dual stack | Every host speaks both protocols at once | Two sets of firewall rules, routes and monitoring to keep in sync |
| IPv6-only with NAT64 | Hosts use only IPv6; a translator reaches legacy IPv4 sites | Some old software and hardcoded IPv4 literals fail |
| IPv6-only mobile (464XLAT) | Phone translates locally so IPv4-only apps still work | Largely invisible; already standard on several large carriers |
Governments pushed from the other side. The United States federal mandate issued in 2020 set targets for most agency systems to run IPv6-only by the end of fiscal 2025, and Apple has required App Store apps to work on IPv6-only networks since 2016. Vendors that sell to those buyers had to make their products work without IPv4.
You Probably Already Run IPv6
Modern Windows, macOS, Linux, iOS and Android enable IPv6 by default and prefer it when a network offers it. Many broadband and mobile providers hand out IPv6 prefixes automatically, and most CDNs and managed hosting platforms publish IPv6 addresses for your site without asking. Browsers use an algorithm called Happy Eyeballs to try both protocols almost at once and keep whichever connects first, which is why a half-working IPv6 path usually shows up as mysterious slowness rather than an outright failure.
That is the real risk. A network where nobody planned for IPv6 is not an IPv4 network. It is a dual-stack network with half of its security policy missing.
The dangerous IPv6 deployment is not the one you plan. It is the one that switched itself on while every firewall rule, log parser and allow-list was still written for IPv4.
What Breaks on a Dual-Stack Network
The Usual Failure Points
- Firewall parity. A rule that blocks remote desktop on IPv4 does nothing if the same server has a public IPv6 address and no matching rule. Without NAT, internal hosts can be directly reachable unless the firewall denies inbound traffic by default.
- Blocking all ICMPv6. Old IPv4 habits of dropping ping break IPv6 outright, because neighbour discovery and path MTU discovery depend on ICMPv6. Filter it selectively instead.
- Rogue router advertisements. Any device on a LAN can announce itself as a router and redirect traffic. Switches with RA Guard block advertisements from ports that should not send them.
- Rate limiting and bans by single address. A single customer typically receives a whole /64 containing billions of addresses, so blocking one address stops nothing. Rate limit and ban by prefix.
- Code that assumes four numbers and dots. Database columns sized for IPv4 strings, regular expressions in log parsers and hardcoded allow-lists quietly truncate or reject IPv6 addresses.
What It Means for Your Website
For most sites the public side is the easy part. Publishing an AAAA record, or letting a CDN do it, makes the site reachable to IPv6-only visitors without translation, which removes a hop for many mobile users. The harder work sits behind it. Web server access controls, admin panel allow-lists, fraud and geolocation checks, analytics that deduplicate visitors by address and application code that stores client IPs all need to accept the longer format. Behind a CDN or reverse proxy, make sure the real visitor address is restored correctly for both protocols, or every IPv6 visitor will appear to come from the proxy.
Email deserves separate attention. Receiving providers apply stricter checks to mail arriving over IPv6, expecting valid reverse DNS and correct authentication for the exact sending address. Enabling IPv6 on a mail server without those records is a reliable way to land in spam.
A Rollout Plan That Does Not Hurt
- Find out what is already live. Check which offices, cloud networks, servers and domains already have IPv6 addresses or AAAA records. That inventory is usually larger than expected.
- Write the firewall policy first. Mirror every IPv4 rule for IPv6, deny unsolicited inbound by default and allow only the ICMPv6 types the protocol needs.
- Plan addressing around prefixes. Request a /48 or /56 from your provider, give every VLAN its own /64 and document it. IPv6 subnetting is simpler than IPv4 once you stop conserving addresses.
- Fix the software edges. Test logging, SIEM parsing, rate limiting, allow-lists and database fields with real IPv6 addresses before the traffic arrives.
- Go dual stack, then shrink IPv4. Enable IPv6 at the edge and on public services, monitor both paths, then release idle public IPv4 addresses and try IPv6-only for new internal workloads.
- Monitor both protocols separately. Uptime checks that only test IPv4 will report green while IPv6 visitors wait for a timeout.
En resumen
IPv6 stopped being a future project when IPv4 addresses became a recurring line item and operating systems began using the new protocol whether or not IT had signed off. The businesses that get burned are not the ones that adopt it late, but the ones that never notice it is already running. Plan the firewall, fix the code that parses addresses, and treat each public IPv4 address as a monthly cost worth justifying.
