I set up a non-public-facing IPv6-only web server last night, so the issues are fresh in my mind! I'm fortunate enough to have an IPv6-capable home connection, and the hosting provider I use (Scaleway) charges extra for assigning IPv4 addresses to machines, so I thought I'd see how easy it would be to save a bit of money and make this machine IPv6-only. I've IP-filtered the host to only my home and my other servers, so having IPv4 support should be a waste.

The machine is now running fine, but I had a few roadblocks setting it up:

• My provisioning scripts download a release of 'dry'[0] from GitHub, which does not support IPv6. I ended up assigning my new machine a temporary IPv4 address and removing it later.

• The scripts also import a key from 'keyserver.ubuntu.com'[1], which, again, does not support IPv6. Attempting to connect just timed out, and if I hadn't just solved the other issue, I would have assumed the host was down.

• There seems to be a bug in Scaleway's cloud firewall (the things it calls Security Groups), where you cannot allow inbound ICMPv6, only standard ICMP (for IPv4). This meant my pings never responded and I thought the machine wasn't up when it was up.

Basically, what I want you to take away from this post is that if you disable IPv6, it's still the case that during maintenance, things are going to break, often mysteriously and with bad error messages, but outside of maintenance, things will likely run smoothly. My machine runs Sentry, and after the problems I had setting it up, I didn't dare run the Sentry './install.sh' script with IPv4 disabled as I didn't trust it to handle that case correctly — and even if the script reported no errors, I wouldn't have trusted there to actually be no errors. Since then, though, it's been running fine, so having an IPv6-only server is certainly possible, even if you have to give in and assign it an IPv4 address at the start, then take it away again later.

[0]: https://github.com/moncho/dry [1]: https://keyserver.ubuntu.com/

I have experimented with IPv6 only, but a lot of stuff still doesn't support it. For example Github and Discord webhooks fail to send.

Yes, I run a site with 4 IPv6 only VPS servers with around 9M requests per month with the help of cloudflare.

In the past, setting up the server was hard(npm, composer, docker) but it has become less of a problem now.

GitHub is the major pain point even now. Even though I use bitbucket for scm which supports IPv6, surprising number of developer tools is centralized on GitHub.

My private Wireguard network is IPv6 only. SSH on all my remote servers listens on a random statically configured IPv6 address dedicated only for ssh. Since every server has an entire /64 prefix, a random internet scanner is never going to find it (Of course I still secure ssh properly since a man in the middle still sees what IPs I'm connecting to). Some cloud server providers started offering IPv6 only servers at a cheaper price to save money on unnecessary IPv4 addresses, so there's also a financial incentive to move non-public things to IPv6 only.

All of the laptops/computers in my house have IPv6-only web servers with LetsEncrypt certificates. (These computers all share a single IPv4 address.)

To get IPv6 on all computers I just installed radvd on the router. On the router I also set up a VPN to give the IPv6 addresses over IPv4 even when they're not local.

It's great.

My first home server was IPv6-only, straight off of my ADSL router with a public static IPv6 address and domain dedicated to entirely to a Raspberry Pi. It worked perfectly on mobile and at home. What a pain in the ass when I discovered my university didn't support IPv6 in any capacity. Their ASN has v6 blocks but no v6 routes on campus.

I have a small ceph cluster over ipv6 and also a small OpenStack cluster with the daemons and web interface all running over V6 only. My network is dual stack since not all external networks are V6 compliant, and since I cannot seem to get cephadm's built in NFS service working over V6, so some of my local fileshares need v4.

BTW:

Original implementation of DirectAccess (Always-On, transparent VPN) in Windows Vista required working IPv6 connection, this was extended with HTTPS-over-v4 backup tunnel support later on when MS found out how hard it was to get consumer v6 in 2007. Inside of DirectAccess, connectivity is pure v6 still.

In fact, since NT6, Windows is IPv6-first system in many aspects, and Microsoft made news last year when they complained that they couldn't disable v4 on guest wifi at many offices due to non-Microsoft visiting workers having issues connecting to their VPNs due to software that didn't work with NAT64/DNS64.

My ISP (frontier) doesn't even give me IPv6 yet so if someone did this I wouldn't be able to access it.

You might be able to access it if you have an Apple device and Private Relay enabled. I only have IPv4 at home and was surprised to see an IPv6 address when I typed in "what is my ip" into Google. For the most part, Private Relay works pretty good.

Maybe the solution for more IPv6 adoption is for tech giants like Apple, Google, Microsoft to make proxies like Private Relay ubiquitous on every device/browser.

Yeah it's actually come up twice that I needed IPv6 and for that I just logged into my work VPN

You should definitely setup a 6to4 tunnel. HE gives them away.

https://www.tunnelbroker.net/

I set one up over a decade ago because Verizon said that they would need 6 months to deploy IPv6 on FiOS. I'm still using it.

Unfortunately in the meantime spammers have discovered HE tunnels and now I get a lot more CAPCHA's than I used to. I still check my FiOS link every month to see if Verizon has turned it on yet.

I had my personal home assistant instance exposed IPv6-only for a while a few years ago.

It worked perfect for that in almost every situation since my cell carrier supported v6 so any time I'm not home I could still access it.

I've used IPv6-only VPSes as jump boxes in the past.

Do IPv6-only sensor networks count?