AWS VPC IPv6 Addressing and Egress-Only Internet Gateways

Study guide

Technical reference and lesson notes

This lesson explains how IPv6 works inside an Amazon VPC and how it differs from traditional IPv4 networking. For the AWS Certified Solutions Architect – Professional SAP-C02 exam, IPv6 is important because AWS treats IPv6 traffic differently from IPv4 traffic, especially around routing, public addressability, NAT, and outbound-only internet access.

The key exam idea is this: IPv6 addresses in a VPC are globally routable, and AWS does not use NAT Gateway for IPv6 outbound access. Instead, AWS provides an egress-only internet gateway when you need IPv6 instances to initiate outbound connections without allowing unsolicited inbound internet traffic.

Key Concepts

IPv4 Refresher

IPv4 addresses use dotted decimal notation, such as:

192.168.0.1

An IPv4 address is 32 bits long. Each dotted decimal value represents 8 bits, also known as an octet.

IPv4 provides roughly 4.3 billion possible addresses. That sounds like a large number, but it is not enough for the modern internet, especially with the growth of cloud services, mobile devices, edge computing, and Internet of Things devices.

Because public IPv4 addresses are limited, private IPv4 addressing and Network Address Translation have been widely used to extend IPv4 usability.

Why NAT Exists in IPv4

In IPv4 architectures, many internal devices use private IP addresses that are not directly routable on the public internet.

Examples of private IPv4 ranges include:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

To allow those private devices to reach the internet, a NAT device translates their private source IP addresses into a public IP address.

In AWS, this is commonly done using:

NAT Gateway
NAT Instance, though this is now less common and operationally heavier

For SAP-C02, remember that NAT is primarily an IPv4 solution. It solves the problem of limited IPv4 addresses by allowing many private resources to share one or more public IPv4 addresses for outbound internet access.

IPv6 Overview

IPv6 was designed to solve the address exhaustion problem by providing a dramatically larger address space.

IPv6 addresses are:

128 bits long
Written in hexadecimal
Much larger than IPv4 addresses
Designed to provide globally unique addressing at massive scale

An IPv6 address looks very different from IPv4 because it uses hexadecimal notation and colons instead of dotted decimal notation.

Example IPv6-style format:

2001:db8:1234:5678::1

IPv6 still has a network portion and a host or node portion, similar to IPv4. However, the address space is so large that AWS can assign large address ranges to VPCs and subnets without needing NAT for normal internet-routable addressing.

IPv6 in an Amazon VPC

An Amazon VPC can use:

IPv4 only
Dual-stack IPv4 and IPv6

In a dual-stack VPC, resources can have both IPv4 and IPv6 addresses.

When using Amazon-provided IPv6 addressing, AWS assigns the VPC a /56 IPv6 CIDR block. Subnets receive /64 IPv6 CIDR blocks from that VPC range.

This means:

VPC IPv6 CIDR: /56
Subnet IPv6 CIDR: /64
Up to 256 /64 IPv6 subnets can be created from a /56 VPC IPv6 block

The reason 256 subnets are possible is that the difference between /56 and /64 is 8 bits. Eight bits provides 256 possible values.

IPv6 Subnet Sizing

IPv6 subnet sizes in AWS are extremely large compared to IPv4 subnets.

A /64 IPv6 subnet provides an enormous number of possible addresses. In practical AWS design, you are not usually concerned about running out of IPv6 addresses inside a subnet.

This is different from IPv4, where subnet sizing is a major design decision because IPv4 space is limited and AWS reserves some addresses in every subnet.

For SAP-C02, the important point is not the exact number of possible IPv6 addresses in a subnet. The important point is that AWS uses /64 IPv6 subnets and IPv6 capacity is generally not the limiting design factor.

IPv6 Route Tables in a VPC

VPC route tables can contain both IPv4 and IPv6 routes.

For IPv4, the default route to the internet is:

0.0.0.0/0

For IPv6, the equivalent default route is:

::/0

The route ::/0 means “all IPv6 destinations.”

Example route table logic:

Destination	Target	Meaning
VPC IPv4 CIDR	local	Route IPv4 traffic inside the VPC
VPC IPv6 CIDR	local	Route IPv6 traffic inside the VPC
`0.0.0.0/0`	Internet Gateway or NAT Gateway	Route IPv4 internet traffic
`::/0`	Internet Gateway or Egress-Only Internet Gateway	Route IPv6 internet traffic

The target selected for ::/0 determines whether IPv6 instances can be reached from the internet or can only initiate outbound traffic.

Internet Gateway with IPv6

An Internet Gateway can be used for IPv6 internet connectivity.

If an instance has an IPv6 address, a route to ::/0 through an Internet Gateway allows IPv6 traffic to reach the internet.

Important distinction:

With IPv4, an instance usually needs a public IPv4 address to be reachable through an Internet Gateway.

With IPv6, the assigned IPv6 address is globally routable. There is no separate concept of public versus private IPv6 addressing in the same way there is with IPv4 inside a VPC.

That does not mean the instance is automatically open to the internet. Security groups, network ACLs, and route tables still control traffic. However, the IPv6 address itself is publicly routable.

No NAT Gateway for IPv6

A major exam point is that IPv6 does not require NAT for internet access.

For IPv4 private subnets, you commonly use:

Private subnet route table
0.0.0.0/0 route to NAT Gateway
NAT Gateway placed in a public subnet
Internet Gateway attached to the VPC

For IPv6, this NAT pattern does not apply in the same way.

You do not use NAT Gateway to provide outbound-only IPv6 access. Instead, AWS provides an egress-only internet gateway.

Egress-Only Internet Gateway

An egress-only internet gateway allows instances with IPv6 addresses to initiate outbound connections to the internet while blocking unsolicited inbound IPv6 connections from the internet.

This is conceptually similar to the outbound-only behavior many engineers associate with NAT Gateway in IPv4 designs, but it is not performing NAT.

Key characteristics:

Used only for IPv6
Allows outbound IPv6 internet traffic
Prevents unsolicited inbound IPv6 internet traffic
Does not perform address translation
Is attached to the VPC
Used as a route target for ::/0

Example route:

Destination	Target
`::/0`	Egress-Only Internet Gateway

Use this when instances need outbound IPv6 internet access but should not be directly reachable from the internet over IPv6.

Publicly Routable Does Not Mean Publicly Accessible

A common misunderstanding is thinking that because IPv6 addresses are publicly routable, every IPv6-enabled EC2 instance is exposed.

That is not automatically true.

Access still depends on:

Route table configuration
Security group inbound rules
Network ACLs
Operating system firewall rules
Whether ::/0 points to an Internet Gateway or an egress-only Internet Gateway

However, IPv6 changes the security mindset. With IPv4, private subnets often rely heavily on non-routable private addressing as part of the architecture. With IPv6, the address may be globally routable, so explicit routing and firewall controls become even more important.

Dual-Stack VPC Design

In many AWS environments, IPv6 is introduced alongside IPv4 rather than replacing IPv4 entirely.

This is called a dual-stack architecture.

A dual-stack resource may have:

Private IPv4 address
Optional public IPv4 address
IPv6 address

This allows applications and clients to use either protocol depending on support, routing, DNS, and security policy.

For SAP-C02, expect scenarios where an organization wants to support IPv6 clients, reduce IPv4 dependency, or provide outbound-only IPv6 access without NAT.

Exam-Relevant Takeaways

For the SAP-C02 exam, remember these points:

IPv4 addresses are 32-bit addresses written in dotted decimal format.
IPv6 addresses are 128-bit addresses written in hexadecimal format.
IPv6 was created to solve the public IP address exhaustion problem.
NAT is heavily used in IPv4 architectures to conserve public IPv4 addresses.
IPv6 addresses in a VPC are globally routable.
AWS does not use NAT Gateway for IPv6 internet access.
A VPC can receive an Amazon-provided /56 IPv6 CIDR block.
IPv6 subnets in AWS are typically /64.
A /56 VPC IPv6 block can provide 256 /64 subnet ranges.
The IPv6 default route is ::/0.
Use an Internet Gateway for inbound and outbound IPv6 internet connectivity.
Use an egress-only Internet Gateway for outbound-only IPv6 internet connectivity.
Security groups and NACLs still matter even though IPv6 addresses are publicly routable.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
Private IPv4 instances need outbound internet access	NAT Gateway	NAT Gateway translates private IPv4 addresses to a public IPv4 address for outbound internet access.
IPv6-enabled instances need outbound-only internet access	Egress-Only Internet Gateway	Allows outbound IPv6 traffic while preventing unsolicited inbound IPv6 traffic.
IPv6-enabled instances need direct internet reachability	Internet Gateway	Routes IPv6 traffic between the VPC and internet when route tables and security controls allow it.
VPC needs both IPv4 and IPv6 support	Dual-stack VPC	Allows resources to communicate using both IPv4 and IPv6.
Need a default route for all IPv4 destinations	`0.0.0.0/0`	Represents all IPv4 destinations outside more specific routes.
Need a default route for all IPv6 destinations	`::/0`	Represents all IPv6 destinations outside more specific routes.
Need to conserve public IPv4 addresses	Private IPv4 plus NAT	Many resources can share outbound access through NAT.
Need massive public address scalability	IPv6	IPv6 provides a much larger address space and avoids traditional IPv4 NAT requirements.

Common Exam Traps

Trap 1: Using NAT Gateway for IPv6

Do not select NAT Gateway as the solution for outbound-only IPv6 access.

NAT Gateway is an IPv4-focused solution. For IPv6 outbound-only access, use an egress-only Internet Gateway.

Trap 2: Assuming IPv6 Requires Public IP Assignment Like IPv4

IPv6 does not use the same public/private model as IPv4 inside a VPC.

When an instance receives an IPv6 address, that address is globally routable. Access is controlled through routing and security rules, not by assigning a separate public IPv6 address.

Trap 3: Confusing `0.0.0.0/0` and `::/0`

These are both default routes, but they apply to different IP versions.

0.0.0.0/0 = all IPv4 destinations
::/0 = all IPv6 destinations

An exam question may include both route types in the same route table.

Trap 4: Thinking Publicly Routable Means Wide Open

IPv6 addresses can be globally routable, but traffic is still controlled by:

Route tables
Security groups
Network ACLs
Host firewalls

Do not assume IPv6 automatically means unrestricted inbound access.

Trap 5: Forgetting the VPC and Subnet IPv6 Sizes

For Amazon-provided IPv6 ranges:

VPC receives /56
Subnets receive /64
A /56 can be divided into 256 /64 subnets

This is a common exam detail.

Real-World Engineer Notes

In real AWS environments, IPv6 should be treated as a deliberate architecture decision, not just a checkbox.

From an operations and security perspective, enabling IPv6 can change your exposure model. Engineers who are used to relying on private IPv4 addressing may accidentally overlook the fact that IPv6 addresses are globally routable. That makes security group and NACL design very important.

When enabling IPv6, review:

Route tables for ::/0
Whether ::/0 points to an Internet Gateway or egress-only Internet Gateway
Security group inbound IPv6 rules
NACL IPv6 rules
DNS records, especially AAAA records
Application compatibility with IPv6
Monitoring and logging visibility for IPv6 traffic
Firewall and IDS/IPS support for IPv6
Hybrid network IPv6 support

For outbound-only workloads, an egress-only Internet Gateway is usually the clean IPv6 design. It gives instances the ability to reach IPv6 internet destinations without allowing unsolicited inbound traffic.

In migration scenarios, dual-stack is often the most practical approach because it lets teams support IPv6 without immediately removing IPv4 dependencies.

Quick Reference Summary

IPv4 uses 32-bit dotted decimal addresses and relies heavily on NAT because public IPv4 addresses are limited.

IPv6 uses 128-bit hexadecimal addresses and provides a massive address space. In AWS, IPv6 addresses assigned to resources are globally routable.

In a VPC, Amazon-provided IPv6 ranges are commonly assigned as /56 blocks to the VPC and /64 blocks to subnets. A /56 VPC IPv6 block can support 256 /64 subnets.

For IPv6 routing:

::/0 means all IPv6 destinations.
Route ::/0 to an Internet Gateway for internet-routable IPv6 access.
Route ::/0 to an egress-only Internet Gateway for outbound-only IPv6 access.

For the exam, remember: NAT Gateway is not the answer for IPv6 outbound-only internet access. Egress-only Internet Gateway is.

Flashcards

Q: What is the size of an IPv4 address?
A: IPv4 addresses are 32 bits long.

Q: What is the size of an IPv6 address?
A: IPv6 addresses are 128 bits long.

Q: What notation does IPv4 commonly use?
A: Dotted decimal notation, such as 192.168.0.1.

Q: What notation does IPv6 use?
A: Hexadecimal notation separated by colons.

Q: Why is NAT commonly used with IPv4?
A: NAT allows private IPv4 resources to share public IPv4 addresses for internet access, helping conserve limited public IPv4 space.

Q: Does IPv6 require NAT Gateway for outbound internet access in AWS?
A: No. IPv6 does not use NAT Gateway for outbound-only access.

Q: What AWS component provides outbound-only IPv6 internet access?
A: An egress-only Internet Gateway.

Q: What is the IPv6 equivalent of the IPv4 default route 0.0.0.0/0?
A: ::/0.

Q: What IPv6 CIDR size does AWS commonly assign to a VPC when using Amazon-provided IPv6?
A: /56.

Q: What IPv6 CIDR size is commonly assigned to an AWS subnet?
A: /64.

Q: How many /64 subnets can be created from a /56 IPv6 VPC block?
A: 256.

Q: Are IPv6 addresses in a VPC publicly routable?
A: Yes, IPv6 addresses assigned in a VPC are globally routable.

Q: If IPv6 addresses are globally routable, are instances automatically open to the internet?
A: No. Route tables, security groups, NACLs, and host firewalls still control access.

Q: Which route target should be used when IPv6 instances need inbound and outbound internet connectivity?
A: An Internet Gateway.

Q: Which route target should be used when IPv6 instances need outbound-only internet connectivity?
A: An egress-only Internet Gateway.

Practice Questions

Question 1:
A company has IPv6-enabled EC2 instances that need to download updates from the internet. The instances should not accept unsolicited inbound IPv6 connections from the internet. Which AWS component should be used?

A. NAT Gateway
B. Internet Gateway
C. Egress-Only Internet Gateway
D. VPC Peering Connection

Correct Answer:
C. Egress-Only Internet Gateway

Explanation:
An egress-only Internet Gateway allows outbound IPv6 connections while blocking unsolicited inbound IPv6 traffic. NAT Gateway is used for IPv4 outbound internet access, not IPv6.

Question 2:
An architect is reviewing a VPC route table. The route table includes the destination ::/0. What does this route represent?

A. All IPv4 destinations
B. All IPv6 destinations
C. The local VPC IPv4 CIDR block
D. The local VPC IPv6 subnet only

Correct Answer:
B. All IPv6 destinations

Explanation:
::/0 is the IPv6 default route. It is equivalent in concept to 0.0.0.0/0 for IPv4.

Question 3:
A VPC is assigned an Amazon-provided /56 IPv6 CIDR block. Subnets are assigned /64 IPv6 CIDR blocks. How many /64 subnet ranges can be created from the /56 block?

A. 16
B. 64
C. 128
D. 256

Correct Answer:
D. 256

Explanation:
The difference between /56 and /64 is 8 bits. Eight bits provides 256 possible subnet values.

Question 4:
A solutions architect is designing a dual-stack VPC. IPv4 resources in private subnets need outbound internet access. IPv6 resources also need outbound internet access but should not receive unsolicited inbound IPv6 traffic. Which combination should be used?

A. NAT Gateway for IPv4 and NAT Gateway for IPv6
B. Internet Gateway for IPv4 and NAT Gateway for IPv6
C. NAT Gateway for IPv4 and Egress-Only Internet Gateway for IPv6
D. Egress-Only Internet Gateway for IPv4 and Internet Gateway for IPv6

Correct Answer:
C. NAT Gateway for IPv4 and Egress-Only Internet Gateway for IPv6

Explanation:
Private IPv4 resources use NAT Gateway for outbound internet access. IPv6 outbound-only access uses an egress-only Internet Gateway.

Question 5:
An engineer enables IPv6 on a VPC and assigns IPv6 addresses to EC2 instances. Which statement is correct?

A. The instances require NAT Gateway to use IPv6 internet access.
B. The IPv6 addresses are globally routable, but access is still controlled by routing and security rules.
C. IPv6 addresses are private by default and require Elastic IP addresses to become public.
D. IPv6 cannot be used in a dual-stack VPC.

Correct Answer:
B. The IPv6 addresses are globally routable, but access is still controlled by routing and security rules.

Explanation:
IPv6 addresses in a VPC are globally routable. However, route tables, security groups, NACLs, and operating system firewalls still determine whether traffic is allowed.