IPv6 in the VPC

Globally unique addresses change the rules

IPv6 addresses are 128 bits long, so address scarcity, the main reason NAT exists for IPv4, disappears. In AWS you can associate an IPv6 block with a VPC, typically a /56, and give each subnet a /64. These addresses are globally unique and publicly routable; unlike RFC 1918 space, the address itself does not keep an instance private, only routes and firewall rules do. That changes how you think about private subnets. If a subnet's route table sends ::/0 to an internet gateway, its instances are reachable from the internet over IPv6, subject to firewall rules. To give IPv6 instances outbound-only access, AWS offers an egress-only internet gateway, which allows connections that start inside and blocks connections that start outside, similar in effect to NAT but without translating addresses. Dual-stack VPCs carry IPv4 and IPv6 side by side, so every security group, NACL and route table needs rules for both families.

A /56 gives you 256 subnets

Each /64 holds 2^64 addresses, so subnet sizing stops being a concern; the number of /64s is what you plan.

import ipaddress

vpc6 = ipaddress.ip_network("2001:db8:1234:5600::/56")
subnets = list(vpc6.subnets(new_prefix=64))
print("subnets available:", len(subnets))
print("first subnet:", subnets[0])
print("addresses per /64:", subnets[0].num_addresses)

Output:

subnets available: 256
first subnet: 2001:db8:1234:5600::/64
addresses per /64: 18446744073709551616

Do not forget the ::/0 rules

A team adds IPv6 and only updates IPv4 rules. Now a security group allowing 0.0.0.0/0 on port 443 still rejects IPv6 clients (they need a ::/0 rule), or an IPv6 default route to an IGW exposes servers you thought were private. Audit both families together.

त्वरित जाँच: Which component gives IPv6-only instances outbound internet access while blocking inbound connections started from the internet?

• NAT gateway
• Elastic IP
• Transit gateway
• Egress-only internet gateway