Configure IPv6 addresses for instances and instance templates

You can configure IPv6 addresses on a Compute Engine instance if the subnet that the instance is connected to has an IPv6 range configured.

For more information about IPv6, see IPv6 subnet ranges.

Specifications

• Compute instances that have both IPv4 and IPv6 configurations are dual-stack. The IPv6 address is in addition to any IPv4 addresses that are configured on the network interface.

• Interfaces on dual-stack or IPv6-only instances are allocated a single /96 range of IPv6 addresses; the first IPv6 address in the range (/128) is configured on the interface.

• Any interface on the instance can have IPv6 addresses configured. For more information about configuring multiple network interfaces, see Multiple network interfaces.

• The stack type of an VM's network interface determines the type of subnets to which it can connect:

  • IPv4-only interfaces can connect to dual-stack and IPv4-only subnets.
  • Dual-stack interfaces can connect to dual-stack subnets.
  • IPv6-only interfaces can connect to dual-stack and IPv6-only subnets.

• To configure IPv6 addresses on a network interface, the interface must be connected to a dual stack or IPv6-only subnet.

• A subnet's IPv6 access type configuration determines whether the subnet has an internal or external IPv6 range. Connected instances inherit the IPv6 access type from the subnet.

• IPv6-only instances are supported with only Ubuntu and Debian OS images.

Accessing instances using IPv6 addresses

The implied IPv6 deny ingress firewall rule protects instances by blocking incoming connections to their IPv6 addresses. To access instances using their IPv6 addresses, you must have a higher priority rule that allows incoming access.

For more information about firewall rules, see VPC firewall rules and Hierarchical firewall policies.

For examples of VPC firewall rules, see Configure firewall rules for common use cases.

IPv6 address assignment

The following list describes how IPv6 addresses are assigned to compute instances.

• Compute instances are assigned an IPv6 address using DHCPv6. The metadata server responds to the instance's DHCPv6 requests and sends the first IPv6 address (/128) from the allocated /96 range in response.

• The metadata server uses route advertisement to publish the default route to the instance. The instance can then use this default route for all IPv6 traffic.

  You can find the default route for an instance's network interface by connecting to the instance and querying the metadata server for the gateway-ipv6 entry.

  curl http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/gateway-ipv6 -H "Metadata-Flavor: Google"
  

  For more information about the metadata server, see View and query instance metadata.

• Compute instances are configured with link local IP addresses, which are assigned from the fe80::/10 range, but they are used only for neighbor discovery.

• The MTU configuration on the instance's network interface applies to both IPv4 and IPv6 packets, but not all MTU values are supported in all circumstances. For more information, see Maximum transmission unit.

Create an instance that uses IPv6 addresses

You can create an instance that uses either a combination of IPv4 and IPv6 addresses (dual-stack), or you can create an instance that uses only IPv6 addresses.

For information about how to create a Compute Engine instance that uses IPv6 addresses, see the following tasks:

• Create a dual-stack instance
• Create an IPv6-only instance

Change the stack type of an instance

You can change the stack type of an existing Compute Engine instance. The stack type can be set to either of the following:

• IPv4 only (single stack)
• IPv4 and IPv6 (dual-stack)

If you are changing the stack type to dual-stack, the instance must be connected to a dual-stack subnet. If you need to change which subnet the instance is connected to, stop the instance and change the subnet. After the subnet is updated, you can change the instance's IP stack type.

You can't change the stack type of an IPv6-only instance.

gcloud compute instances network-interfaces update INSTANCE_NAME \
    --stack-type=STACK_TYPE \
    --zone=ZONE

PATCH https://compute.s3nsapis.fr/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME/updateNetworkInterface

{
    "stackType": "STACK_TYPE",
}

Create an instance template with IPv6 addresses

You can create a regional or global instance template that can be used to create dual-stack or IPv6-only instances. For more information, see Create instance templates.

You must use the Google Cloud CLI or REST to create an instance template that creates instances that use IPv6 addresses.

gcloud compute instance-templates create TEMPLATE_NAME \
    --subnet=SUBNET \
    --stack-type=STACK_TYPE

POST https://compute.s3nsapis.fr/compute/v1/projects/PROJECT_ID/global/instanceTemplates

{
  "name": "INSTANCE_TEMPLATE_NAME"
  "properties": {
    "machineType": "MACHINE_TYPE",
    "networkInterfaces": [
      {
        "subnetwork": "regions/REGION/subnetworks/SUBNET",
        "stackType": "STACK_TYPE",
      },
    ],
    "disks":
    [
      {
        "type": "PERSISTENT",
        "boot": true,
        "mode": "READ_WRITE",
        "initializeParams":
        {
          "sourceImage": "IMAGE_URI"
        }
      }
    ]
  }
}