DMIT IPv6 Setup Guide: Address, SSH, Firewall and DNS

IPv6 is on by default

Per DMIT's official documentation, every instance is assigned a /64 IPv6 prefix by default — no extra request needed. You can find the assigned IPv6 address in the control panel's instance details.

A very small number of legacy instances may not have IPv6; in that case, submit a ticket to request allocation.

Finding your IPv6 address

To get your instance's IPv6 address:

1. Log in to the DMIT control panel
2. Go to the instance details page
3. Look in the network info area for the IPv6 address (usually alongside the IPv4 address)

You can also check from SSH after logging in:

ip -6 addr show

Or more concisely:

ip -6 addr show scope global

The output will show a global unicast address like 2001:xxxx:xxxx::xxxx/64.

SSH dual-stack

DMIT instances have SSH listening on both IPv4 and IPv6 by default. To connect via IPv6:

ssh -6 root@<ipv6-address>

To force IPv4 (avoiding IPv6 DNS resolution issues):

ssh -4 root@<ipv4-address>

Restrict SSH to IPv4 only

If you want SSH to listen on IPv4 only for security, edit /etc/ssh/sshd_config:

AddressFamily inet
ListenAddress 0.0.0.0

Then restart SSH: systemctl restart sshd

Firewall configuration

When using IPv6, you need both IPv4 and IPv6 firewall rules. Using iptables:

# IPv4 rules
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

# IPv6 rules (configured separately)
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -A INPUT -j DROP

Important: ICMPv6 is critical for neighbour discovery and path MTU discovery — do not block it entirely:

ip6tables -A INPUT -p icmpv6 -j ACCEPT

Web server IPv6 listeners

Nginx

Add IPv6 listening in your Nginx config:

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
}

Apache

In your Apache config:

Listen 80
Listen [::]:80

DNS AAAA records

To serve over IPv6, add an AAAA record in DNS pointing to your IPv6 address. The AAAA record sits alongside the A record; clients automatically pick the available protocol stack.

If your DNS provider supports it, configure both A (IPv4) and AAAA (IPv6) records so clients can choose the optimal path based on their network.

Disabling IPv6 when needed

If you only need an IPv4 egress, disable IPv6 via sysctl:

sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1

To make it permanent, add the above to /etc/sysctl.conf and run sysctl -p.

After disabling IPv6, check that DNS resolution still works — some systems may prefer IPv6 for DNS.

Common issues

Can't connect over IPv6?

• Check that your firewall allows ICMPv6 (required for neighbour discovery)
• Check that your service listens on [::] not just 0.0.0.0
• Check that your local network supports IPv6 (some ISPs still don't)

IPv6 slower than IPv4?

IPv6 and IPv4 may take different routing paths with different performance. If IPv6 is worse, force IPv4 at the application layer, or don't configure an AAAA record in DNS.

For more DMIT guides, see the beginner guide and FAQ.

Data checked 2026-08-18. IPv6 features follow the official DMIT documentation.