Using IPv6 in an AWS VPC

Purpose of This Lesson

This lesson explains why IPv6 is used alongside IPv4 in AWS VPCs and how IPv6 addressing and routing differ from IPv4. The key operational decision is whether IPv6 instances should support inbound and outbound internet traffic or outbound traffic only.

Key Concepts

• IPv4: A 32-bit address written in dotted-decimal notation, such as 192.168.0.1. IPv4 provides approximately 4.3 billion addresses.
• IPv6: A 128-bit address written in hexadecimal, with address groups separated by colons. Its much larger address space supports the continued growth of internet-connected devices.
• Dual addressing in a VPC: A VPC can have both an IPv4 CIDR block and an IPv6 CIDR block.
• VPC IPv6 range: AWS assigns a /56 IPv6 address range to the VPC.
• Subnet IPv6 range: Subnets receive /64 IPv6 ranges. The hexadecimal pair used for a subnet can range from 00 through FF, allowing 256 possible /64 subnet ranges from the VPC allocation.
• Local IPv6 routing: The VPC’s IPv6 CIDR block appears as a local route in a route table, just as the VPC’s IPv4 CIDR block does.
• IPv6 default route: ::/0 represents all IPv6 destinations, equivalent to 0.0.0.0/0 for IPv4.
• Internet Gateway: An internet gateway can provide internet connectivity for IPv6 traffic when the route table sends ::/0 to it.
• Egress-only Internet Gateway: This VPC component permits outbound IPv6 connections while preventing inbound connections initiated from the internet.

IPv4 Address Exhaustion and the Role of NAT

IPv4’s approximately 4.3 billion addresses are insufficient for the growing number of internet-connected systems, including IoT sensors, vehicles, and other edge devices. Network Address Translation (NAT) has helped organizations conserve public IPv4 addresses by allowing many private IPv4 hosts to share outbound internet access through a smaller number of public addresses.

NAT reduces the pressure on IPv4, but it does not create additional public IPv4 addresses. IPv6 addresses the scaling problem with a 128-bit address space that is vastly larger than IPv4’s address space.

Technical / Operational Context: IPv6 in a VPC

Address allocation

AWS assigns the VPC an IPv6 /56 range. Individual subnets receive /64 ranges. Within the /56 allocation, a hexadecimal pair identifies the subnet portion; values from 00 to FF provide 256 possible /64 subnet ranges.

IPv6 addresses use hexadecimal notation because the address is 128 bits long. Like IPv4, an IPv6 address still has portions representing the network and the node or host, but its representation and address size are different.

Route-table behavior

A VPC route table can contain both IPv4 and IPv6 routes. The important IPv6 entries are:

VPC IPv6 CIDR block  -> local
::/0                 -> internet gateway or egress-only internet gateway

The local route handles traffic within the VPC’s IPv6 range. The ::/0 route is the IPv6 default route and matches destinations outside the VPC.

Public routability and inbound control

IPv6 addresses in the VPC are publicly routable, so IPv6 does not require NAT to provide internet connectivity. However, public routability does not by itself mean that an instance must accept inbound connections. When the design requires outbound-only IPv6 connectivity, route ::/0 through an egress-only internet gateway rather than a standard internet gateway.

An egress-only internet gateway is needed specifically when inbound IPv6 traffic from the internet must be prevented while outbound IPv6 traffic remains available.

Exam- or Assessment-Relevant Takeaways

• Recognize IPv4 as a 32-bit dotted-decimal address and IPv6 as a 128-bit hexadecimal address.
• Associate IPv4 address scarcity with NAT and IPv6’s much larger address space with large-scale internet connectivity.
• Remember the AWS VPC IPv6 allocation relationship: /56 for the VPC and /64 for subnets.
• Identify ::/0 as the IPv6 equivalent of the IPv4 default route 0.0.0.0/0.
• Choose an internet gateway when IPv6 internet traffic should be routed normally.
• Choose an egress-only internet gateway when instances need outbound IPv6 connectivity but should not receive inbound IPv6 connections.
• Do not treat an egress-only internet gateway as an IPv6 version of NAT. Its purpose is directional access control for outbound-only IPv6 traffic.

Tool / Feature Decision Guide

Requirement	Appropriate routing target or concept	Reason
Provide normal IPv6 internet routing	Internet gateway	The route table sends external IPv6 traffic, typically ::/0, to the internet gateway.
Allow outbound IPv6 but prevent inbound internet connections	Egress-only internet gateway	It supports outbound-only IPv6 connectivity.
Conserve public IPv4 addresses for private IPv4 hosts	NAT	NAT addresses IPv4 scarcity by translating private IPv4 traffic; it is not required for IPv6 in the described VPC design.
Route traffic within the VPC’s IPv6 range	Local route	The VPC IPv6 CIDR block is represented as a local route in the route table.

Common Traps / Misconceptions

• Confusing ::/0 with a local route: ::/0 means every IPv6 destination and is the default route, not the VPC’s internal range.
• Assuming IPv6 requires NAT: The lesson states that IPv6 addresses in the VPC are publicly routable and do not need NAT.
• Assuming publicly routable means inbound access must be allowed: An egress-only internet gateway can provide outbound-only behavior.
• Using an internet gateway when inbound IPv6 must be blocked: For the stated outbound-only requirement, the egress-only internet gateway is the relevant choice.
• Mixing up VPC and subnet prefix lengths: The VPC receives /56, while subnets receive /64 ranges.
• Treating IPv6 notation as dotted decimal: IPv6 uses hexadecimal groups separated by colons, not four decimal octets.
• Assuming NAT solves IPv4 exhaustion completely: NAT helps share public IPv4 addresses but does not increase the number of available IPv4 addresses.

Real-World Engineer / Analyst Notes

• Evaluate IPv4 and IPv6 separately in route tables. A working IPv4 path does not automatically establish an IPv6 path.
• When reviewing an IPv6 connectivity issue, check whether the route table has the required ::/0 route and whether it points to the intended gateway type.
• Treat the choice between a standard internet gateway and an egress-only internet gateway as a connectivity-direction decision: bidirectional internet routing versus outbound-only IPv6.
• Preserve the distinction between address assignment and traffic authorization. Public routability describes addressing and routing; it does not remove the need to control unwanted inbound access.
• The large IPv6 address space is useful for scale, but the subnet allocation model still matters when designing and troubleshooting VPC routing.

Quick Reference Summary

• IPv4: 32 bits, dotted decimal, approximately 4.3 billion addresses.
• IPv6: 128 bits, hexadecimal, vastly larger address space.
• VPC IPv6 allocation: /56.
• Subnet IPv6 allocation: /64.
• Subnet hexadecimal selector: 00 through FF, providing 256 possible /64 subnet ranges from the described allocation.
• IPv6 default route: ::/0.
• Internal VPC IPv6 traffic: local route for the VPC IPv6 CIDR block.
• Normal IPv6 internet routing: internet gateway.
• Outbound-only IPv6 routing: egress-only internet gateway.
• NAT: useful for conserving public IPv4 addresses; not required for the described IPv6 routing model.

Flashcards

Q: A workload needs outbound IPv6 internet connectivity, but internet hosts must not initiate connections to it. Which AWS VPC feature should be used?

A: Use an egress-only internet gateway and route IPv6 default traffic through it. Its purpose is to permit outbound IPv6 traffic while preventing inbound traffic.

Q: When should a standard internet gateway be selected instead of an egress-only internet gateway for IPv6?

A: Select a standard internet gateway when the IPv6 design requires normal internet routing rather than specifically outbound-only connectivity.

Q: What does the IPv6 route ::/0 represent?

A: It is the IPv6 default route and matches any IPv6 destination outside more specific routes. It is equivalent in purpose to 0.0.0.0/0 for IPv4.

Q: A route table contains a route for the VPC’s IPv6 CIDR block with the target local. What traffic does this route handle?

A: It handles traffic within the VPC’s IPv6 address range. The local route is the IPv6 counterpart to the VPC’s internal IPv4 route.

Q: What IPv6 CIDR range does AWS assign to a VPC in this lesson?

A: AWS assigns a /56 IPv6 address range to the VPC.

Q: What IPv6 CIDR range do subnets receive in the described VPC allocation model?

A: Subnets receive /64 IPv6 address ranges.

Q: How many /64 subnet ranges are described as possible from the VPC allocation, and how are they identified?

A: 256 /64 ranges are possible, identified by a hexadecimal pair ranging from 00 to FF.

Q: A team wants thousands of private IPv4 devices to share internet access through a smaller set of public IPv4 addresses. Which concept addresses this requirement?

A: NAT addresses this IPv4 requirement by translating private IPv4 traffic to public IPv4 addressing. It helps conserve IPv4 addresses but does not expand the IPv4 address space.

Q: How does IPv6 addressing differ from IPv4 addressing in size and notation?

A: IPv6 is 128 bits and uses hexadecimal groups separated by colons. IPv4 is 32 bits and uses four decimal octets separated by periods.

Q: Why was NAT useful before widespread IPv6 adoption?

A: IPv4 has a limited address space, so NAT allowed many private IPv4 systems to share public IPv4 connectivity. This partially mitigated public IPv4 scarcity.

Q: Does the described IPv6 VPC design require NAT for IPv6 internet access?

A: No. IPv6 addresses in the VPC are publicly routable, so NAT is not required for the described IPv6 connectivity model.

Q: What is the decisive clue for choosing an egress-only internet gateway in a scenario?

A: The decisive clue is the requirement for outbound IPv6 connectivity without inbound IPv6 connections initiated from the internet.

Practice Questions

Question 1

An application in a VPC must connect to external IPv6 services. The security requirement says external systems must not initiate IPv6 connections back to the application. Which route target best matches the requirement?

A. Local route
B. NAT
C. Internet gateway
D. Egress-only internet gateway

Correct answer: D. Egress-only internet gateway. The requirement explicitly calls for outbound-only IPv6 connectivity, which is the purpose of an egress-only internet gateway.

Question 2

A route table needs a default route for traffic destined for any IPv6 address outside the VPC. Which destination should be used?

A. 0.0.0.0/0
B. ::/0
C. The VPC’s /56 IPv6 CIDR only
D. A subnet’s /64 IPv6 CIDR only

Correct answer: B. ::/0. This is the IPv6 any-destination route and serves the same default-route role as 0.0.0.0/0 for IPv4.

Question 3

An engineer is allocating IPv6 ranges for a new AWS VPC and its subnets. Which allocation matches the lesson?

A. /32 for the VPC and /48 for each subnet
B. /56 for the VPC and /64 for each subnet
C. /64 for the VPC and /56 for each subnet
D. /128 for the VPC and /64 for each subnet

Correct answer: B. /56 for the VPC and /64 for each subnet. The lesson specifies the VPC /56 and subnet /64 relationship.

Question 4

A company says it needs NAT because all IPv6 addresses in its VPC are public. Based on the lesson, what is the best response?

A. NAT is mandatory for every IPv6 instance.
B. NAT is required only when the VPC uses a /64 range.
C. IPv6 addresses are publicly routable, so NAT is not required for the described IPv6 routing model.
D. NAT converts IPv6 addresses into IPv4 addresses automatically for all traffic.

Correct answer: C. The lesson states that IPv6 addresses in the VPC are publicly routable and do not require NAT.

WordPress Metadata

Suggested Slug:
aws-vpc-ipv6-addressing-routing-egress-only

Meta Description:
Study how IPv6 addressing, subnet allocation, route tables, internet gateways, and egress-only internet gateways work in an AWS VPC.

Tags:
AWS, AWS VPC, IPv6, IPv4, CIDR, Route Tables, Internet Gateway, Egress-Only Internet Gateway, NAT, SOA-C03