Introduction to IPv6 on Windows Server 2019

IPv6 is the successor to IPv4, providing a vastly larger address space (128-bit addresses versus 32-bit), built-in IPsec support, improved routing efficiency, and support for features like stateless address autoconfiguration (SLAAC). Windows Server 2019 includes full IPv6 support and enables it by default on all network adapters. Organisations are increasingly deploying IPv6 due to IPv4 address exhaustion, and many modern cloud, mobile, and IoT environments require IPv6 support.

IPv6 addresses are expressed as eight groups of four hexadecimal digits separated by colons, for example 2001:0db8:85a3:0000:0000:8a2e:0370:7334, which can be abbreviated to 2001:db8:85a3::8a2e:370:7334. Windows Server 2019 supports dual-stack networking, where a server has both IPv4 and IPv6 addresses simultaneously, allowing it to communicate with both address families.

Understanding IPv6 Address Types

Before configuring IPv6, understand the address types. Link-local addresses (fe80::/10) are automatically assigned to every IPv6-enabled interface and are used only within a single network segment — they are never routed. Unique local addresses (fc00::/7, typically fd00::/8 for locally assigned) are the IPv6 equivalent of RFC 1918 private addresses. Global unicast addresses (2000::/3) are publicly routable IPv6 addresses assigned by your ISP or RIR.

View current IPv6 configuration on all interfaces:

Get-NetIPAddress -AddressFamily IPv6 | Select InterfaceAlias, IPAddress, PrefixLength, AddressState, PrefixOrigin

Assigning a Static IPv6 Address

Assign a static global unicast IPv6 address to a network adapter:

New-NetIPAddress -InterfaceAlias "Ethernet 1" -IPAddress "2001:db8:1:1::10" -PrefixLength 64 -DefaultGateway "2001:db8:1:1::1"

Add a static unique-local address for internal network use alongside the global address:

New-NetIPAddress -InterfaceAlias "Ethernet 1" -IPAddress "fd00:1234:5678:1::10" -PrefixLength 64

Configure DNS servers for IPv6:

Set-DnsClientServerAddress -InterfaceAlias "Ethernet 1" -ServerAddresses "2001:db8:1:1::53","2001:db8:1:1::54"

Verify the configuration:

Get-NetIPAddress -InterfaceAlias "Ethernet 1" -AddressFamily IPv6

Configuring IPv6 via DHCPv6

Windows Server 2019 includes a DHCPv6 server as part of the DHCP role. Install the DHCP role:

Install-WindowsFeature -Name DHCP -IncludeManagementTools

Create an IPv6 scope on the DHCP server:

Add-DhcpServerv6Scope -Prefix "2001:db8:1:1::" -Name "IPv6 Scope 1" -Description "Production IPv6 Subnet" -State Active

Add DNS server and domain options to the scope:

Set-DhcpServerv6OptionValue -ScopeId "2001:db8:1:1::" -DnsServer "2001:db8:1:1::53" -DomainSearchList "contoso.com"

Configure exclusion ranges within the scope (reserve addresses for static assignment):

Add-DhcpServerv6ExclusionRange -ScopeId "2001:db8:1:1::" -StartRange "2001:db8:1:1::1" -EndRange "2001:db8:1:1::ff"

Configuring DNS for IPv6

Add AAAA (quad-A) records to DNS for IPv6 address resolution:

Add-DnsServerResourceRecord -ZoneName "contoso.com" -AAAA -Name "fileserver01" -IPv6Address "2001:db8:1:1::10"
Add-DnsServerResourceRecord -ZoneName "contoso.com" -AAAA -Name "dc01" -IPv6Address "2001:db8:1:1::11"

Add PTR records for reverse IPv6 lookups. IPv6 reverse lookup zones use the ip6.arpa format:

Add-DnsServerPrimaryZone -NetworkId "2001:db8:1:1::/64" -ReplicationScope Domain
Add-DnsServerResourceRecord -ZoneName "1.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa" -PTR -Name "0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0" -PtrDomainName "fileserver01.contoso.com"

Configuring Windows Firewall for IPv6

Windows Firewall applies rules to both IPv4 and IPv6 traffic. Create a rule that allows ICMPv6 (required for IPv6 proper operation — Neighbor Discovery Protocol uses ICMPv6):

New-NetFirewallRule -DisplayName "Allow ICMPv6" -Direction Inbound -Protocol ICMPv6 -Action Allow

Create an IPv6-specific inbound rule for a service:

New-NetFirewallRule -DisplayName "Allow HTTPS IPv6" -Direction Inbound -Protocol TCP -LocalPort 443 -RemoteAddress "2001:db8::/32" -Action Allow

Testing IPv6 Connectivity

Test IPv6 connectivity with ping6 or the standard ping command with an IPv6 address:

ping -6 2001:db8:1:1::11
Test-NetConnection -ComputerName "2001:db8:1:1::11"

Test IPv6 DNS resolution:

Resolve-DnsName -Name "dc01.contoso.com" -Type AAAA

View the IPv6 routing table:

Get-NetRoute -AddressFamily IPv6 | Where-Object {$_.DestinationPrefix -ne "::/0"} | Sort-Object RouteMetric

Add a static IPv6 route:

New-NetRoute -InterfaceAlias "Ethernet 1" -DestinationPrefix "2001:db8:2::/48" -NextHop "2001:db8:1:1::1" -RouteMetric 10

IPv6 in Windows Server 2019 is a native, first-class capability. Microsoft strongly recommends leaving IPv6 enabled even in IPv4-only environments, as disabling it can cause unexpected failures in features that rely on IPv6 internally, such as DirectAccess and some Always On VPN configurations.