LFCE 13 🐧 IPv6 — Basic Configuration - KandZ

⏱️ Estimated read: 15 min | |

IPv6 configuration on Linux is not a single command. It is a sequence: verify the kernel has IPv6 enabled, assign addresses to interfaces, enable forwarding if the host is a router, and distribute prefixes to clients if the network uses stateless autoconfiguration. Every modern Linux kernel enables IPv6 by default and assigns a link-local address to every interface automatically, so the starting state is never “no IPv6.” The administrator’s task is to add global addressing, routing, and advertisement on top of that foundation. For the LFCE candidate, these are the operations that turn a Linux host into an IPv6 participant: an endpoint with a global address, or a router that forwards and advertises.

Key point: IPv6 forwarding and Router Advertisements are separate concerns. net.ipv6.conf.all.forwarding=1 makes the kernel forward packets between interfaces, but it does not tell clients on those interfaces what prefix to use. radvd sends Router Advertisements that let clients autoconfigure addresses via SLAAC, but it does not by itself make the kernel forward traffic. A functioning IPv6 router requires both.

Why basic configuration requires explicit steps

The default-enabled problem.

Linux kernels ship with IPv6 enabled. The loopback interface receives ::1/128, and every other interface receives a fe80::/10 link-local address derived from its MAC address or a stable privacy mechanism. This default is convenient but misleading: a host with only a link-local address can communicate on its local segment but cannot reach the internet. The link-local address is not routable, and no default route exists until one is configured or learned. The first configuration step is therefore not enabling IPv6 but verifying its current state and deciding what to add.

The forwarding side effect problem.

Enabling IPv6 forwarding changes the kernel’s behavior beyond packet forwarding. When net.ipv6.conf.all.forwarding=1 is set, the kernel stops accepting Router Advertisements on all interfaces by default . A host that was previously autoconfiguring its address from an upstream router will stop doing so once it becomes a router itself. This is correct behavior—a router should not be a SLAAC client—but it surprises administrators who enable forwarding on a host that still needs to receive RAs on one interface. Per-interface forwarding settings and accept_ra overrides are required for hybrid configurations.

The RA and forwarding separation problem.

Router Advertisements tell clients “here is a prefix, here is a default gateway.” They do not enforce forwarding. A Linux host can run radvd and advertise a prefix while net.ipv6.conf.all.forwarding remains 0. Clients will autoconfigure addresses and set the host as their default gateway, but the host will drop packets that are not addressed to itself. The configuration appears to work from the client’s perspective—the client has an address—but no traffic reaches the internet . Forwarding must be enabled separately, and it must be verified with a routing test, not inferred from the presence of radvd.

a. Verifying and assigning addresses

The ip command from the iproute2 suite is the primary tool for IPv6 configuration. Its -6 flag scopes every operation to IPv6 .

# Verify IPv6 is enabled and link-local addresses exist
ip -6 addr show
# Output includes fe80::.../64 scope link on every active interface
# If no inet6 lines appear, IPv6 is disabled on the interface

# Check the kernel parameter if IPv6 appears absent
sysctl net.ipv6.conf.all.disable_ipv6
# 0 means enabled; 1 means disabled

# Assign a global unicast address to an interface
# The /64 prefix is the standard for SLAAC-compatible LANs
ip -6 addr add 2001:db8:1::1/64 dev eth0

# Verify the assignment
ip -6 addr show dev eth0
# Output shows the new global address and the existing link-local address

The global address is not persistent across reboots unless it is written to a configuration file or managed by a network manager. The ip command modifies the running kernel state only. For persistence, the address must be added to the distribution’s network configuration—/etc/network/interfaces on Debian, a NetworkManager connection profile, or a systemd-networkd .network file. The LFCE exam tests the running configuration; production systems require the persistent configuration to match.

b. Enabling forwarding and adding routes

A Linux host becomes an IPv6 router when forwarding is enabled. This is a kernel parameter, not an interface property.

# Enable IPv6 forwarding immediately
sysctl -w net.ipv6.conf.all.forwarding=1

# Verify the setting
sysctl net.ipv6.conf.all.forwarding
# Output: net.ipv6.conf.all.forwarding = 1

# Make the setting persistent across reboots
echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-ipv6-forwarding.conf
sysctl -p /etc/sysctl.d/99-ipv6-forwarding.conf

Forwarding alone is not sufficient for routing. The host needs a default route to reach destinations beyond its directly connected networks, and the clients need a route back to the host. On the router, the default route points to the upstream gateway, typically learned via a link-local address on the external interface.

# Add a default route via the upstream gateway
# The gateway is often a link-local address on the external interface
ip -6 route add default via fe80::1 dev eth0

# Verify the route
ip -6 route show default
# Output: default via fe80::1 dev eth0 metric 1024

# Check forwarding on the internal interface
# The kernel will forward packets between eth0 and eth1
ip -6 route get 2001:db8:2::1

When forwarding is enabled, the kernel stops accepting Router Advertisements on all interfaces. If the router itself needs to autoconfigure an address on an upstream interface, the accept_ra parameter must be overridden.

# Allow the router to accept RAs on eth0 despite global forwarding being enabled
sysctl -w net.ipv6.conf.eth0.accept_ra=2
# Value 2 means "accept RAs even if forwarding is enabled"

c. Advertising prefixes with radvd

radvd (Router Advertisement Daemon) sends Router Advertisements on an interface, telling clients the network prefix and the router’s link-local address as the default gateway . It is the standard tool for SLAAC on Linux. The configuration lives in /etc/radvd.conf.

# Install radvd
apt install radvd    # Debian/Ubuntu
dnf install radvd    # Fedora/RHEL

# Create the configuration
cat > /etc/radvd.conf <<'EOF'
interface eth1
{
    AdvSendAdvert on;          # Enable advertisements on this interface
    MinRtrAdvInterval 30;      # Minimum seconds between RAs
    MaxRtrAdvInterval 100;     # Maximum seconds between RAs
    prefix 2001:db8:1::/64
    {
        AdvOnLink on;          # Clients treat the prefix as on-link
        AdvAutonomous on;      # Clients use the prefix for SLAAC
    };
};
EOF

# Start and enable the service
systemctl enable --now radvd

The AdvAutonomous on flag is what enables SLAAC. Without it, clients see the prefix but do not generate addresses from it . The AdvOnLink on flag tells clients that destinations within the prefix are reachable directly on the link, without going through the router.

Verify that advertisements are being sent and received.

# On a client, check for a global address derived from the advertised prefix
ip -6 addr show dev eth0 | grep "scope global"
# Output should include an address within 2001:db8:1::/64

# On the client, check the default route learned from the RA
ip -6 route show default
# Output: default via fe80::... dev eth0 proto ra
# The "proto ra" confirms the route came from a Router Advertisement

If the client does not receive an address, check the firewall. ICMPv6 must be permitted for Neighbor Discovery and Router Advertisements to function. A default DROP policy on the INPUT chain will silently block RAs .

# Allow ICMPv6 on the client
ip6tables -A INPUT -p icmpv6 -j ACCEPT

Complete Example Session

# ============================================
# PART 1: VERIFY THE STARTING STATE
# ============================================
# Check that IPv6 is enabled and link-local addresses exist
ip -6 addr show
# Every active interface should have a fe80:: address
# If not, check sysctl net.ipv6.conf.all.disable_ipv6

# ============================================
# PART 2: ASSIGN GLOBAL ADDRESSES
# ============================================
# Router: internal interface with the LAN prefix
ip -6 addr add 2001:db8:1::1/64 dev eth1
# Router: external interface (address may be learned via SLAAC or static)
ip -6 addr add 2001:db8:0::1/64 dev eth0

# Client: no static address needed if SLAAC will be used
# The client will generate an address from the advertised prefix

# ============================================
# PART 3: ENABLE FORWARDING ON THE ROUTER
# ============================================
sysctl -w net.ipv6.conf.all.forwarding=1
# The router now forwards packets between eth0 and eth1

# ============================================
# PART 4: ADD THE DEFAULT ROUTE
# ============================================
# The router needs a path to the internet via the upstream gateway
ip -6 route add default via 2001:db8:0::ffff dev eth0

# ============================================
# PART 5: CONFIGURE RADVD ON THE INTERNAL INTERFACE
# ============================================
cat > /etc/radvd.conf <<'EOF'
interface eth1
{
    AdvSendAdvert on;
    MinRtrAdvInterval 30;
    MaxRtrAdvInterval 100;
    prefix 2001:db8:1::/64
    {
        AdvOnLink on;
        AdvAutonomous on;
    };
};
EOF

# ============================================
# PART 6: START RADVD
# ============================================
systemctl enable --now radvd
systemctl status radvd
# Confirm the service is active and listening on eth1

# ============================================
# PART 7: VERIFY ON THE CLIENT
# ============================================
# The client should have received an address from the advertised prefix
ip -6 addr show dev eth0 | grep "2001:db8:1"
# Output: inet6 2001:db8:1:0:xxxx:xxxx:xxxx:xxxx/64 scope global

# The client should have a default route pointing to the router
ip -6 route show default
# Output: default via fe80::... dev eth0 proto ra

# ============================================
# PART 8: TEST CONNECTIVITY
# ============================================
# From the client, ping the router's internal address
ping -6 -c 2 2001:db8:1::1

# From the client, ping an external address
ping -6 -c 2 2001:db8:0::ffff

# If the second ping fails but the first succeeds:
# - Check forwarding: sysctl net.ipv6.conf.all.forwarding
# - Check the router's default route: ip -6 route show default
# - Check the firewall on both hosts: ip6tables -L -n -v

# ============================================
# PART 9: PERSIST THE CONFIGURATION
# ============================================
# Addresses assigned with ip are not persistent
# Add them to the distribution's network configuration
# Forwarding must be written to a sysctl file
echo "net.ipv6.conf.all.forwarding=1" > /etc/sysctl.d/99-ipv6-forwarding.conf

# ============================================
# PART 10: VERIFY THE COMPLETE PATH
# ============================================
# The client has an address (SLAAC)
# The client has a default route (RA)
# The router forwards (sysctl)
# The router has a path upstream (default route)
# ICMPv6 is permitted (firewall)
# All five conditions must be true for end-to-end connectivity

The ten parts trace the complete configuration sequence: verify, assign, forward, route, advertise, and test. The most common failure is Part 3 missing—forwarding disabled—which produces a client with an address and a default route that leads nowhere.

Quick Reference

IPv6 Configuration Commands

Task	Command
Show IPv6 addresses	`ip -6 addr show`
Assign address	`ip -6 addr add <addr>/<prefix> dev <if>`
Enable forwarding	`sysctl -w net.ipv6.conf.all.forwarding=1`
Add default route	`ip -6 route add default via <gw> dev <if>`
Verify route	`ip -6 route get <dest>`
Allow RAs despite forwarding	`sysctl -w net.ipv6.conf.<if>.accept_ra=2`
Start radvd	`systemctl enable --now radvd`
Allow ICMPv6	`ip6tables -A INPUT -p icmpv6 -j ACCEPT`

radvd Configuration Essentials

Directive	Purpose
`AdvSendAdvert on`	Enable RAs on the interface
`prefix <prefix>/<len>`	Prefix to advertise
`AdvOnLink on`	Mark prefix as on-link
`AdvAutonomous on`	Enable SLAAC for the prefix
`MinRtrAdvInterval` / `MaxRtrAdvInterval`	RA timing bounds

Verification Checklist

Check	Command	Expected
Link-local exists	`ip -6 addr show`	`fe80::` on interface
Global address assigned	`ip -6 addr show dev <if>`	`2001:db8:` address
Forwarding enabled	`sysctl net.ipv6.conf.all.forwarding`	`= 1`
Default route exists	`ip -6 route show default`	`via <gw>`
Client has RA-derived address	`ip -6 addr show` on client	Address in advertised prefix
Client has RA-derived route	`ip -6 route show default` on client	`proto ra`
ICMPv6 permitted	`ip6tables -L INPUT -n`	`icmpv6 ACCEPT`

Best Practices

✅ Do This:

# Verify link-local addresses before configuring global addresses
ip -6 addr show | grep fe80                               # ✅

# Use /64 for all LAN prefixes to support SLAAC
ip -6 addr add 2001:db8:1::1/64 dev eth1                  # ✅

# Enable forwarding separately from radvd
sysctl -w net.ipv6.conf.all.forwarding=1                  # ✅

# Allow RAs on the upstream interface if the router needs them
sysctl -w net.ipv6.conf.eth0.accept_ra=2                  # ✅

# Permit ICMPv6 on both router and client
ip6tables -A INPUT -p icmpv6 -j ACCEPT                    # ✅

# Verify the client received both an address and a route
ip -6 route show default | grep "proto ra"                # ✅

❌ Don’t Do This:

# Assume radvd alone makes the host a router
# Forwarding must be enabled separately                     # ❌

# Assign a prefix shorter than /64 on a SLAAC network
# SLAAC requires 64-bit interface identifiers               # ❌

# Forget the upstream default route on the router
# The router can reach its LAN but not the internet         # ❌

# Block ICMPv6 with a default DROP firewall
# Neighbor Discovery and RAs fail silently                  # ❌

# Expect ip addr add to persist across reboots
# It modifies running state only                            # ❌

# Enable forwarding on a host that must still receive RAs
# without setting accept_ra=2                               # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Client has address but no internet	Router forwarding disabled	`sysctl net.ipv6.conf.all.forwarding=1`
Client never receives an address	radvd not running or firewall blocks ICMPv6	Start radvd; allow ICMPv6
Router cannot receive RAs upstream	Forwarding disables RA acceptance	`accept_ra=2` on upstream interface
Address lost after reboot	`ip addr add` is not persistent	Write to network config or sysctl file
Client default route missing	radvd not advertising, or `AdvAutonomous` off	Check radvd config and service status
Ping to global address fails	No route to destination	`ip -6 route get <dest>` on both ends
radvd fails to start	Config syntax error or interface missing	`radvd -c /etc/radvd.conf` to test config

Real-World Examples

1. Assign a global address

ip -6 addr add 2001:db8:1::1/64 dev eth0

2. Enable forwarding

sysctl -w net.ipv6.conf.all.forwarding=1

3. Add a default route

ip -6 route add default via 2001:db8:0::ffff dev eth0

4. Verify the route

ip -6 route get 2001:db8:0::ffff

5. Allow RAs despite forwarding

sysctl -w net.ipv6.conf.eth0.accept_ra=2

6. Minimal radvd configuration

cat > /etc/radvd.conf <<'EOF'
interface eth1 {
    AdvSendAdvert on;
    prefix 2001:db8:1::/64 { AdvOnLink on; AdvAutonomous on; };
};
EOF

7. Start radvd

systemctl enable --now radvd

8. Verify client address

ip -6 addr show dev eth0 | grep "2001:db8"

9. Verify client route

ip -6 route show default | grep "proto ra"

10. Allow ICMPv6

ip6tables -A INPUT -p icmpv6 -j ACCEPT

Visual

IPv6 Configuration Sequence

┌──────────────────────────────────────────────────────────────┐
│  FROM DEFAULT STATE TO WORKING IPv6 ROUTER                   │
│                                                              │
│  Step 1: Verify                                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ip -6 addr show → fe80:: exists?                      │  │
│  │ sysctl disable_ipv6 → 0?                              │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│  Step 2: Assign global addresses                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ip -6 addr add 2001:db8:1::1/64 dev eth1 (LAN)        │  │
│  │ ip -6 addr add 2001:db8:0::1/64 dev eth0 (WAN)        │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│  Step 3: Enable forwarding                                   │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ sysctl -w net.ipv6.conf.all.forwarding=1              │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│  Step 4: Add default route                                   │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ip -6 route add default via 2001:db8:0::ffff          │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│  Step 5: Advertise prefix                                    │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ radvd: AdvSendAdvert on; prefix 2001:db8:1::/64       │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│  Step 6: Permit ICMPv6                                       │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ip6tables -A INPUT -p icmpv6 -j ACCEPT                │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│              Client autoconfigures address                   │
│              Client learns default route                     │
│              Router forwards traffic                         │
└──────────────────────────────────────────────────────────────┘

Forwarding and radvd Are Independent

┌──────────────────────────────────────────────────────────────┐
│  FOUR COMBINATIONS OF FORWARDING AND RADVD                   │
│                                                              │
│  Forwarding=0, radvd=stopped:                                │
│  ├─ Host is an IPv6 endpoint only                            │
│  └─ No routing, no advertisements                            │
│                                                              │
│  Forwarding=0, radvd=running:                                │
│  ├─ Clients get addresses and default routes                 │
│  ├─ Clients send traffic to the host as gateway              │
│  └─ Host drops forwarded packets (forwarding off)            │
│  └─ Result: clients have addresses but no connectivity       │
│                                                              │
│  Forwarding=1, radvd=stopped:                                │
│  ├─ Host forwards packets if routes are correct              │
│  ├─ No advertisements → clients need static config or DHCPv6 │
│  └─ Result: routing works, autoconfiguration does not        │
│                                                              │
│  Forwarding=1, radvd=running:                                │
│  ├─ Host forwards packets                                    │
│  ├─ Clients autoconfigure addresses and routes               │
│  └─ Result: complete IPv6 router                             │
└──────────────────────────────────────────────────────────────┘

The Forwarding Side Effect on RA Acceptance

┌──────────────────────────────────────────────────────────────┐
│  ENABLING FORWARDING DISABLES RA ACCEPTANCE                  │
│                                                              │
│  Before forwarding:                                          │
│  net.ipv6.conf.all.forwarding = 0                            │
│  net.ipv6.conf.eth0.accept_ra = 1 (default)                  │
│  → Host accepts RAs and autoconfigures its upstream address  │
│                                                              │
│  After forwarding:                                           │
│  net.ipv6.conf.all.forwarding = 1                            │
│  net.ipv6.conf.eth0.accept_ra = 0 (implied)                  │
│  → Host stops accepting RAs on all interfaces                │
│  → Upstream address may expire and not renew                 │
│                                                              │
│  Override:                                                   │
│  net.ipv6.conf.eth0.accept_ra = 2                            │
│  → Accept RAs even with forwarding enabled                   │
│  → Router keeps its upstream autoconfigured address          │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Primary tool	`ip -6` from iproute2
Default IPv6 state	Enabled; link-local on every interface
Global address assignment	`ip -6 addr add <addr>/64 dev <if>`
Forwarding	`sysctl net.ipv6.conf.all.forwarding=1`
Default route	`ip -6 route add default via <gw>`
RA daemon	`radvd` with `/etc/radvd.conf`
SLAAC enablement	`AdvAutonomous on` in radvd config
Forwarding side effect	Disables RA acceptance on all interfaces
RA acceptance override	`net.ipv6.conf.<if>.accept_ra=2`
ICMPv6 requirement	Must be permitted for Neighbor Discovery
Persistence	Network config files and sysctl files

Key takeaways:

IPv6 is enabled by default; configuration is additive. Every interface already has a link-local address. The administrator adds global addressing, routing, and advertisements on top of that foundation.
Forwarding and radvd are separate requirements. radvd advertises prefixes; sysctl enables packet forwarding. A host with radvd but forwarding disabled gives clients addresses that lead nowhere .
Enabling forwarding disables RA acceptance. A router that needs to autoconfigure its upstream address must set accept_ra=2 on that interface .
ICMPv6 is not optional. Router Advertisements, Neighbor Discovery, and Path MTU Discovery all depend on ICMPv6. A default DROP firewall policy blocks them silently .
ip addr add is not persistent. The command modifies running state only. Production systems require the address to be written to the distribution’s network configuration.
Verify both the address and the route on clients. A client with an address but no default route cannot reach the internet. ip -6 route show default with proto ra confirms the RA was processed.

Remember: IPv6 basic configuration is a chain of dependencies. The interface needs a link-local address before it can do anything. The host needs a global address before it can be reached. The kernel needs forwarding enabled before it can route. The router needs a default route before it can reach upstream. The client needs a Router Advertisement before it can autoconfigure. And ICMPv6 must be permitted at every step. Break any link in the chain and the symptom appears at the end—a client that cannot ping—while the cause is somewhere in the middle. Verify each step in sequence, and the configuration will work.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!