How to Enable IPv6 on Debian 13?

IPv6 on Debian 13 (Trixie) delivers larger address space, better routing, and modern security. Many providers ship IPv6 ready but not fully configured. The steps below verify kernel support, enable sysctl, configure the correct network stack (systemd-networkd, ifupdown, or NetworkManager), set DNS, secure firewall, and test end-to-end IPv6.

Verify IPv6 support in the kernel

Confirm that IPv6 is not disabled and the kernel module is loaded.

lsmod | grep ipv6 || echo "ipv6 module not listed (may be built-in)"
sysctl net.ipv6.conf.all.disable_ipv6 net.ipv6.conf.default.disable_ipv6
grep -R "ipv6.disable" /etc/default/grub || true

net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0

Enable IPv6 via sysctl

Ensure the kernel network stack accepts IPv6 globally and by default.

sudo tee /etc/sysctl.d/99-ipv6.conf >/dev/null <<'EOF'
net.ipv6.conf.all.disable_ipv6=0
net.ipv6.conf.default.disable_ipv6=0
# Optional hardening for servers (keep RAs off when static)
net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.default.accept_ra=0
EOF
sudo sysctl --system

Identify your Debian 13 networking stack

Debian servers commonly use systemd-networkd, ifupdown, or NetworkManager. Configure only the active one.

systemctl is-active systemd-networkd
nmcli general status 2>/dev/null || true
if [ -f /etc/network/interfaces ] ; then grep -E "iface|source" -n /etc/network/interfaces; fi

STATE      CONNECTIVITY  WIFI-HW  WIFI  WWAN-HW  WWAN
connected  full          enabled  enabled  enabled  enabled

Configure IPv6 with systemd-networkd (SLAAC or Static)

Create a .network file for your interface (replace ens18 with your NIC). Use SLAAC if your router advertises IPv6, or set a static address and gateway from your provider.

sudo mkdir -p /etc/systemd/network

# SLAAC (automatic addressing via RA)
sudo tee /etc/systemd/network/10-ens18.network >/dev/null <<'EOF'
[Match]
Name=ens18

[Network]
DHCP=no
IPv6AcceptRA=yes
IPv6PrivacyExtensions=no
# Optional DNS over IPv6
# DNS=2606:4700:4700::1111
# DNS=2001:4860:4860::8888
EOF

# OR: Static configuration
# sudo tee /etc/systemd/network/10-ens18.network >/dev/null <<'EOF'
# [Match]
# Name=ens18
#
# [Network]
# Address=2001:db8:10::123/64
# Gateway=2001:db8:10::1
# DNS=2606:4700:4700::1111
# DNS=2001:4860:4860::8888
# IPv6AcceptRA=no
# EOF

sudo systemctl enable --now systemd-networkd
sudo systemctl restart systemd-networkd
networkctl status ens18
ip -6 addr show dev ens18
ip -6 route show

Configure IPv6 with ifupdown (/etc/network/interfaces)

Edit interfaces for SLAAC or static. Then restart networking or bounce the interface.

sudo cp /etc/network/interfaces /etc/network/interfaces.bak

# SLAAC
sudo tee -a /etc/network/interfaces >/dev/null <<'EOF'
auto ens18
iface ens18 inet manual
iface ens18 inet6 auto
    accept_ra 1
    privext 0
# dns-nameservers 2606:4700:4700::1111 2001:4860:4860::8888
EOF

# OR: Static
# sudo tee -a /etc/network/interfaces >/dev/null <<'EOF'
# auto ens18
# iface ens18 inet manual
# iface ens18 inet6 static
#     address 2001:db8:10::123/64
#     gateway 2001:db8:10::1
#     dns-nameservers 2606:4700:4700::1111 2001:4860:4860::8888
# EOF

sudo systemctl restart networking
ip -6 addr show dev ens18
ip -6 route show

Configure IPv6 with NetworkManager (nmcli)

Modify the active connection. Use auto for SLAAC or manual for static addressing.

nmcli con show
# SLAAC + stable privacy
nmcli con mod "Wired connection 1" ipv6.method auto ipv6.addr-gen-mode stable-privacy ipv6.ip6-privacy 2

# OR: Static
# nmcli con mod "Wired connection 1" ipv6.method manual \
#   ipv6.addresses "2001:db8:10::123/64" \
#   ipv6.gateway "2001:db8:10::1" \
#   ipv6.dns "2606:4700:4700::1111,2001:4860:4860::8888" \
#   ipv6.addr-gen-mode eui64 ipv6.ip6-privacy 0

nmcli con up "Wired connection 1"
ip -6 addr show
ip -6 route show

Add IPv6 DNS resolvers

Set resolvers via your network stack or systemd-resolved. For systemd-resolved, link the stub and verify.

sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
sudo systemctl enable --now systemd-resolved
resolvectl status | sed -n '1,80p'

If managing resolv.conf directly, add IPv6 resolvers.

sudo tee /etc/resolv.conf >/dev/null <<'EOF'
nameserver 2606:4700:4700::1111
nameserver 2001:4860:4860::8888
options edns0
EOF

Open firewall for IPv6 (nftables)

Use an inet table to filter IPv4 and IPv6 together. Allow SSH and vital ICMPv6, drop unsolicited traffic.

sudo tee /etc/nftables.conf >/dev/null <<'EOF'
flush ruleset
table inet filter {
  chains {
    input {
      type filter hook input priority 0; policy drop;
      ct state established,related accept
      iif lo accept
      ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, router-advertisement, neighbor-solicitation, neighbor-advertisement, packet-too-big, time-exceeded, parameter-problem } accept
      tcp dport 22 accept
    }
    forward { type filter hook forward priority 0; policy drop; }
    output  { type filter hook output  priority 0; policy accept; }
  }
}
EOF
sudo systemctl enable --now nftables
sudo nft -f /etc/nftables.conf
sudo nft list ruleset | sed -n '1,120p'

Test IPv6 connectivity

Validate address, routing, DNS, and external reachability.

ip -6 addr show scope global
ip -6 route get ::1
ping -6 -c3 2001:4860:4860::8888
ping -6 -c3 ipv6.google.com
curl -6 https://ifconfig.co
dig AAAA dropvps.com @2606:4700:4700::1111 +short
tracepath -6 2001:4860:4860::8888

Enable IPv6 privacy (optional)

For client-like hosts, rotate temporary addresses. For servers, keep stable addresses.

sudo tee /etc/sysctl.d/90-ipv6-privacy.conf >/dev/null <<'EOF'
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
EOF
sudo sysctl --system

# systemd-networkd: set in the .network file
# IPv6PrivacyExtensions=yes

# NetworkManager:
# nmcli con mod "Wired connection 1" ipv6.addr-gen-mode stable-privacy ipv6.ip6-privacy 2
# nmcli con up "Wired connection 1"

Troubleshoot common IPv6 issues

Check routes, router advertisements, neighbor discovery, and logs. Ensure your provider delegated prefix and gateway are correct.

ip -6 route show
ip -6 neigh
sysctl net.ipv6.conf.all.accept_ra net.ipv6.conf.all.forwarding
journalctl -b -k | grep -i ipv6
journalctl -u systemd-networkd -b | tail -n 80
sudo apt-get update && sudo apt-get install -y ndisc6
rdisc6 -1 -r 3 ens18
# MTU/path issues
ip -6 link show dev ens18
tracepath -6 ipv6.google.com

IPv6 on Debian 13 is straightforward once the active network stack is known. Configure addressing, DNS, and firewall, then validate with ping, curl, and tracepath. For more study, guidance, server purchases, and support, you can use dropvps. For more guides, visit dropvps.com