How to Configure IPv6 Networking on RHEL 7

January 19, 2026
Linux
Comment off

How to Configure IPv6 Networking on RHEL 7

IPv6 is the successor to IPv4, offering a vastly larger address space (128-bit addresses versus 32-bit), improved routing efficiency, and built-in support for auto-configuration and security features like IPsec. As IPv4 address exhaustion becomes a practical reality for many networks, enabling and configuring IPv6 on RHEL 7 servers is an increasingly common requirement. RHEL 7 ships with full IPv6 support in the kernel and NetworkManager. This tutorial covers enabling IPv6 in the kernel, assigning static and dynamic IPv6 addresses using both nmcli and ifcfg files, testing connectivity, and opening IPv6 traffic in the firewall.

Prerequisites

RHEL 7 server with root or sudo access
NetworkManager running and managing the target interface
Basic familiarity with IP networking concepts
An IPv6 address or prefix from your network administrator (for static assignment) or a router advertising an IPv6 prefix (for SLAAC/DHCPv6)

Step 1: Verify IPv6 is Enabled in the Kernel

RHEL 7 may have IPv6 disabled via a sysctl parameter. Check the current state:

sysctl net.ipv6.conf.all.disable_ipv6

A value of 1 means IPv6 is disabled. To enable it persistently, edit /etc/sysctl.conf or create a drop-in file:

cat > /etc/sysctl.d/99-ipv6.conf <<'EOF'
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
EOF

sysctl --system

Verify the change took effect immediately without a reboot:

sysctl net.ipv6.conf.all.disable_ipv6
# Expected: net.ipv6.conf.all.disable_ipv6 = 0

Also check that ipv6 is not listed in the kernel module blacklist:

grep -r ipv6 /etc/modprobe.d/

If you see blacklist ipv6, remove or comment out that line and run dracut -f to rebuild the initramfs.

Step 2: List Available Network Interfaces

nmcli device status
ip link show

Identify the connection name used by NetworkManager (e.g., ens192, eth0). The connection name may differ from the device name; list all connections:

nmcli connection show

Step 3: Assign an IPv6 Address Using nmcli (Auto/SLAAC)

To enable IPv6 auto-configuration (Stateless Address Auto-Configuration, SLAAC), where the router provides the prefix:

nmcli con modify ens192 ipv6.method auto
nmcli con up ens192

For DHCPv6 (stateful, where a DHCPv6 server assigns the address):

nmcli con modify ens192 ipv6.method dhcp
nmcli con up ens192

Step 4: Assign a Static IPv6 Address Using nmcli

For servers, a static IPv6 address is preferred. Use CIDR notation (e.g., /64):

nmcli con modify ens192 
  ipv6.method manual 
  ipv6.addresses "2001:db8:1::10/64" 
  ipv6.gateway "2001:db8:1::1" 
  ipv6.dns "2001:db8:1::53 2001:4860:4860::8888"
nmcli con up ens192

Assign a second IPv6 address to the same interface (IPv6 supports multiple addresses natively):

nmcli con modify ens192 +ipv6.addresses "2001:db8:1::11/64"
nmcli con up ens192

Verify the assigned addresses:

ip -6 addr show dev ens192

Step 5: Configure IPv6 via ifcfg Files

If you prefer the traditional network-scripts method, edit or create the interface configuration file directly. Locate it at /etc/sysconfig/network-scripts/ifcfg-ens192:

cat >> /etc/sysconfig/network-scripts/ifcfg-ens192 <<'EOF'
IPV6INIT=yes
IPV6_AUTOCONF=no
IPV6ADDR=2001:db8:1::10/64
IPV6_DEFAULTGW=2001:db8:1::1
IPV6_FAILURE_FATAL=no
EOF

For multiple IPv6 addresses, use the IPV6ADDR_SECONDARIES directive:

IPV6ADDR_SECONDARIES="2001:db8:1::11/64 2001:db8:1::12/64"

Restart the interface after editing ifcfg files:

ifdown ens192 && ifup ens192

To enable SLAAC via ifcfg instead:

IPV6INIT=yes
IPV6_AUTOCONF=yes

Step 6: Test IPv6 Connectivity

Ping the IPv6 loopback address to verify the stack is active:

ping6 ::1

Ping the default gateway:

ping6 2001:db8:1::1

Ping a well-known IPv6 host (Google’s public DNS):

ping6 2001:4860:4860::8888

Perform an IPv6 DNS lookup:

dig AAAA google.com
host -t AAAA google.com

Show the IPv6 routing table:

ip -6 route show

Trace the IPv6 route to a remote host:

traceroute6 2001:4860:4860::8888

Step 7: Configure the Firewall for IPv6

RHEL 7’s firewalld manages both IPv4 (iptables) and IPv6 (ip6tables) rules simultaneously. Zones and rules apply to both protocol families unless explicitly restricted.

Allow SSH over IPv6 (usually already allowed if SSH is permitted in the active zone):

firewall-cmd --zone=public --add-service=ssh --permanent

Allow HTTP and HTTPS for IPv6 clients:

firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --reload

Allow ICMPv6 — this is essential for neighbour discovery (NDP) and path MTU discovery; do not block it entirely:

firewall-cmd --permanent --add-rich-rule='rule family="ipv6" protocol value="ipv6-icmp" accept'
firewall-cmd --reload

Verify active rules include IPv6:

firewall-cmd --list-all
ip6tables -L -n --line-numbers

Step 8: Disable IPv6 Per-Interface (Optional)

If you want to keep IPv6 enabled globally but disable it on a specific interface (e.g., a backend-only interface that should never use IPv6):

sysctl -w net.ipv6.conf.eth1.disable_ipv6=1

Make it persistent in /etc/sysctl.d/99-ipv6.conf:

net.ipv6.conf.eth1.disable_ipv6 = 1

Conclusion

IPv6 is now enabled and fully configured on your RHEL 7 server, with a static IPv6 address assigned, firewall rules in place, and connectivity confirmed. RHEL 7’s NetworkManager makes it straightforward to manage IPv6 via nmcli, while the traditional ifcfg file approach remains fully supported for environments with configuration management tools that generate those files. As you roll out IPv6 across your infrastructure, ensure all application services bind to :: (all interfaces) rather than 0.0.0.0, and test with dual-stack clients to verify that both IPv4 and IPv6 code paths function correctly in parallel.

How to Configure IPv6 Networking on RHEL 7