Enable IPv6 for a VPC-IPv6 Gateway(IPv6 Gateway)-阿里云帮助中心

By default, when you enable IPv6 for a Virtual Private Cloud (VPC) and its vSwitches, they only support private communication. For internet access, you can enable IPv6 internet bandwidth.

Enable or disable IPv6

IPv6 is available only in regions that support the IPv4/IPv6 dual stack.

Console

Enable IPv6

When you create a VPC and a vSwitch, you can enable IPv6 by using one of the following methods:
- Select Allocated by system and choose BGP (Multi-ISP). The system automatically creates an IPv6 Gateway and assigns an IPv6 CIDR block.
- To centrally manage your IP address resources, select Allocated by IPAM. Choose an address pool with a preconfigured IPv6 CIDR block and specify a mask length or a CIDR block to assign an IPv6 CIDR block from the address pool.
For an existing VPC, in the IPv6 CIDR column, click Enable IPv6. Then, perform the following steps:
- Select Allocated by system or Allocated by IPAM.
- If you select Automatically Enable IPv6 for All vSwitches, you can also select the Automatically Enable IPv6 for All vSwitches check box. If you do not select this check box, or if you select IPv6 CIDR, you must enable IPv6 for each vSwitch individually. To do this, click Enable IPv6 in the IPv6 CIDR block column for the target vSwitch.

Disable IPv6

In the IPv6 CIDR column for the target VPC or vSwitch, click Disable IPv6. Before you can disable IPv6 for a VPC, you must first disable IPv6 for all of its vSwitches and delete the associated IPv6 Gateway.

API

Unlike the console, the API does not automatically create an IPv6 Gateway when you enable IPv6 for a VPC and its vSwitches. You must call the CreateIpv6Gateway operation to create one.

When you create a VPC or a vSwitch, set the EnableIPv6 parameter in the CreateVpc and CreateVSwitch operations to enable IPv6. For a VPC, you can also set the Ipv6IpamPoolId and Ipv6CidrMask parameters to assign an IPv6 CIDR block from a specified address pool.
For an existing VPC or vSwitch, set the EnableIPv6 parameter in the ModifyVpcAttribute and ModifyVSwitchAttribute operations to enable or disable IPv6. To assign an IPv6 CIDR block to the VPC from a specified address pool, call the AssociateVpcCidrBlock operation.

Check security group and network ACL configurations

Important

After you enable IPv6 for a VPC and its vSwitches, ECS security groups and network ACLs do not automatically allow IPv6 traffic. If the inbound security group rules or the network ACL rules are not correctly configured, IPv6 communication may fail.

Check security group rules

By default, a security group does not contain inbound rules that allow IPv6 traffic. After you enable IPv6, you must add IPv6 rules to the security group based on your business requirements. Otherwise, inbound IPv6 traffic is denied.

Log on to the ECS console. In the left-side navigation pane, choose Network & Security > Security Groups.
Find the security group that is associated with the instances in the VPC, click Manage Rules in the Operation column, and then check whether the Inbound tab contains IPv6-related rules.
If no IPv6 rules exist, click Add Rule and add rules based on your business requirements. The following are common configuration examples:
- Allow ICMPv6 traffic (used by ping6 to test connectivity): set Protocol to All ICMP-IPv6 and Source to ::/0.
- Allow IPv6 HTTP/HTTPS access: set Protocol to Custom TCP, Destination (Current Instance) to 80/80 or 443/443, and Source to ::/0.
- Allow IPv6 SSH access (Linux): set Protocol to Custom TCP, Destination (Current Instance) to 22/22, and Source to your IPv6 address or ::/0.

Note

The authorization object for IPv6 uses the format ::/0 (all IPv6 addresses) or a specified IPv6 CIDR block (such as 2408:xxxx::/32). Do not confuse it with the IPv4 format (such as 0.0.0.0/0).

Check network ACL rules

If the vSwitches in the VPC are associated with a network ACL, you must also check whether the network ACL allows IPv6 traffic. A network ACL applies to both IPv4 and IPv6 traffic and takes precedence over security groups.

Log on to the VPC console. In the left-side navigation pane, click Network ACL.
Find the network ACL that is associated with the vSwitch, click the instance ID to go to the details page, and then check whether Inbound Rules and Outbound Rules contain rules that allow IPv6 traffic.
If no IPv6-related rules exist, click Manage Inbound Rule or Manage Outbound Rule to add rules that allow IPv6 traffic. For example, add a rule with Policy set to Allow, the source address set to ::/0, and Protocol set to ALL.