IPv6 in VPC
Learn IPv6 address space, its importance, and features.
We'll cover the following
IPv6 is a successor of IPv4 that has a very large space of public IP addresses. We can enable IPv6 for our VPC and subnets initially enabled for IPv4 only. This way, our VPC will operate in dual-stack mode. IPv4 and IPv6 traffic flows without interacting, and the resources can communicate with each by using either IPv4 or IPv6 or both.
Why IPv6?
IPv4 address space is limited by its design and is getting exhausted quickly. With the increase in the usage of internet devices, it is impossible to meet the requirement of assigning IPv4 address to every device. Therefore, we must shift to the IPv6 addressing scheme to avoid running out of IPv4 addresses.
IPv4 vs. IPv6
IPv6 is quite different from IPv4 in design and working aspects. Let’s see some of their main differences in the table below:
IPv4 | IPv6 |
IPv4 is 32 bits long and makes a maximum of 4.3 billion addresses. | IPv6 is 128 bits long and has a pool of 2^{128} IP addresses. |
It consists of 4 blocks separated by a dot (.) | It consists of 8 blocks separated by colon. The higher 64 bits present the network part, and the lower 64 bits present the nodes. |
It is a dotted-decimal representation | It is a hexadecimal representation |
IPv4 supports both private and public addresses | IPv6 supports only public addresses and is internet-routable. |
Accesses the internet using the internet gateway | Also uses the internet gateway to access the internet and support egress traffic only with the help of an egress-only internet gateway |
Supports elastic interfaces (EIFs) | Does not support because IPv6 is static by default |
Note: We can’t disable IPv4 on our VPC and resources because it is a default addressing scheme for EC2 resources and VPC.
Setting up IPv6 for a VPC
To set up a VPC with an IPv6 address, we need to have a VPC with an IPv4 CIDR block. Then, we enable the IPv6 by allocating a CIDR block. If we have subnets in our VPC then we can create our IPv6 CIDR block for subnets within the range of VPC CIDR block. Once we enable IPv6 on the VPC, we must update the security groups accordingly.
Egress-only internet gateway
This is used only for IPv6 traffic to allow outbound traffic only. It works like a NAT gateway but is used only in IPv6 cases. Allows our private instances to initiate a connection to the internet but doesn’t allow the internet to initiate an IPv6 connection to the instances.
The diagram above shows instances provisioned in public and private subnets in a VPC.
The public instance accesses the internet using IGW.
The private instance uses Egress-only IGW to access the internet. The traffic flow on the IGW is two-way, while the incoming traffic from the internet is not allowed by the Egress-only IGW.
Get hands-on with 1300+ tech skills courses.