IPv6 is the successor to IPv4, offering a vastly larger address space and improved routing efficiency, and is increasingly required for modern infrastructure and public internet connectivity. On RHEL 9, NetworkManager is the primary tool for managing network configuration, and it fully supports both static IPv6 addressing and automatic assignment via SLAAC and DHCPv6. This tutorial covers checking the current IPv6 state, assigning a static IPv6 address with nmcli, configuring firewalld rules for IPv6 traffic, testing connectivity, and understanding the difference between SLAAC and DHCPv6 auto-configuration.

Prerequisites

  • RHEL 9 server with NetworkManager running (systemctl status NetworkManager)
  • Root or sudo access
  • Knowledge of the network interface name (run ip link to identify it)
  • An IPv6 address, prefix length, and gateway assigned by your network administrator or ISP
  • firewalld installed and running (systemctl status firewalld)

Step 1 — Check the Current IPv6 Configuration

Before making changes, inspect the existing network state to identify your interface name and any existing IPv6 addresses:

# List all IPv6 addresses assigned to interfaces
ip -6 addr

# Show full address info including interface names
ip addr show

# Check the current NetworkManager connection profiles
nmcli connection show

# Check IPv6 kernel parameter status
sysctl net.ipv6.conf.all.disable_ipv6
sysctl net.ipv6.conf.default.disable_ipv6

If disable_ipv6 returns 1, IPv6 is currently disabled at the kernel level and must be re-enabled before proceeding.

Step 2 — Enable IPv6 in the Kernel

If IPv6 was previously disabled, re-enable it by updating /etc/sysctl.conf and applying the change. This ensures IPv6 stays enabled across reboots:

# Add or update these lines in /etc/sysctl.conf
cat >> /etc/sysctl.conf << 'EOF'
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
EOF

# Apply immediately without rebooting
sysctl -p

# Verify IPv6 is now enabled
sysctl net.ipv6.conf.all.disable_ipv6

A return value of 0 confirms IPv6 is enabled.

Step 3 — Assign a Static IPv6 Address with nmcli

Use nmcli to configure a static IPv6 address on your interface. Replace ens3 with your actual interface name from Step 1, and substitute the example 2001:db8:: addresses with your real assigned addresses:

# Set IPv6 to manual (static) mode
nmcli con mod "ens3" ipv6.method manual

# Assign the static IPv6 address with prefix length
nmcli con mod "ens3" ipv6.addresses "2001:db8::1/64"

# Set the IPv6 default gateway
nmcli con mod "ens3" ipv6.gateway "2001:db8::fffe"

# Configure IPv6 DNS servers (use your DNS provider's IPv6 addresses)
nmcli con mod "ens3" ipv6.dns "2001:4860:4860::8888 2001:4860:4860::8844"

# Apply the changes by bringing the connection down and up
nmcli con down "ens3" && nmcli con up "ens3"

# Verify the new IPv6 address is assigned
ip -6 addr show ens3

The address will appear with scope global and the correct prefix length once the connection is brought back up.

Step 4 — Configure firewalld for IPv6 Traffic

firewalld on RHEL 9 manages both IPv4 and IPv6 rules simultaneously. Use rich rules to allow specific IPv6 traffic, such as ICMPv6 (required for neighbor discovery) and custom application ports:

# Allow ICMPv6 — required for IPv6 Neighbor Discovery Protocol (NDP)
firewall-cmd --permanent --add-rich-rule='rule family="ipv6" protocol value="ipv6-icmp" accept'

# Allow a specific IPv6 source range to access SSH
firewall-cmd --permanent --add-rich-rule='rule family="ipv6" source address="2001:db8::/64" service name="ssh" accept'

# Allow HTTP and HTTPS over IPv6
firewall-cmd --permanent --add-rich-rule='rule family="ipv6" service name="http" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv6" service name="https" accept'

# Reload firewalld to apply changes
firewall-cmd --reload

# Verify rules
firewall-cmd --list-all

Step 5 — Test IPv6 Connectivity

Use ping6 and curl with the -6 flag to verify outbound and inbound IPv6 connectivity:

# Test IPv6 loopback
ping6 -c 4 ::1

# Test IPv6 connectivity to a public IPv6 host (Google's public IPv6 DNS)
ping6 -c 4 2001:4860:4860::8888

# Test IPv6 connectivity to a dual-stack hostname
ping6 -c 4 ipv6.google.com

# Test HTTP over IPv6 using curl
curl -6 -I https://ipv6.google.com

# Check the routing table for IPv6
ip -6 route show

Step 6 — Configure DHCPv6 and Understand SLAAC vs DHCPv6

IPv6 supports two automatic address assignment methods. SLAAC (Stateless Address Autoconfiguration) uses Router Advertisements to assign addresses without a DHCP server. DHCPv6 provides centralized address management similar to IPv4 DHCP. To use automatic assignment instead of a static address:

# Use SLAAC (router advertisement based, no DHCPv6 server required)
nmcli con mod "ens3" ipv6.method auto
nmcli con down "ens3" && nmcli con up "ens3"

# Use DHCPv6 only (requires a DHCPv6 server on the network)
nmcli con mod "ens3" ipv6.method dhcp
nmcli con down "ens3" && nmcli con up "ens3"

# Use SLAAC for address but DHCPv6 for DNS/options (common in enterprise)
# This is handled by the router's RA flags (M=0, O=1)
# NetworkManager will use 'auto' method and still query DHCPv6 for options

# Verify the assigned address and method
nmcli con show "ens3" | grep ipv6
ip -6 addr show ens3

For most enterprise deployments, ipv6.method auto with SLAAC is sufficient. Use ipv6.method dhcp when your network requires centralized address tracking. Static addressing is preferred for servers where a predictable address is needed for DNS records and firewall rules.

Conclusion

You have configured IPv6 networking on RHEL 9 using NetworkManager, including static address assignment, kernel-level IPv6 enablement, firewalld rich rules for IPv6 traffic filtering, and both SLAAC and DHCPv6 auto-configuration modes. IPv6 readiness is increasingly important as IPv4 address exhaustion drives broader adoption, and RHEL 9’s NetworkManager and firewalld tooling make managing dual-stack environments consistent with existing IPv4 workflows. Remember to update any DNS records, monitoring systems, and application configurations to include the new IPv6 address.

Next steps: How to Set Up iSCSI Storage on RHEL 9, How to Configure GlusterFS Distributed Storage on RHEL 9, and How to Set Up a Ceph Storage Cluster on RHEL 9.