IPv6: check it, understand it, prefer IPv4 or turn it off
Every modern system runs IPv6 alongside IPv4, which is why ipconfig shows three or four IPv6 addresses you never configured. Most of the time it just works. When it does not, the symptoms are odd, and the fix is rarely "disable IPv6".
Do I have IPv6?
Three conditions must all be true: your interface has a global address (not just fe80::), there is an IPv6 default route, and the path to the internet actually works.
ipconfig | findstr /i "IPv6 Gateway"
netsh interface ipv6 show route | findstr ::/0
ping -6 2606:4700:4700::1111
ping -6 ipv6.google.comWorking: an IPv6 Address line starting 2xxx: or 3xxx: (a Temporary IPv6 Address too), a Default Gateway starting fe80::, and the ping replies. Only a Link-local IPv6 Address means no IPv6 from your router or ISP.
ip -6 addr show scope global
ip -6 route show default
ping -6 -c 3 2606:4700:4700::1111
curl -6 -s https://ipconfig.co.uk/ip
sysctl net.ipv6.conf.all.disable_ipv6 # 0 = enabledifconfig en0 | grep inet6
netstat -rn -f inet6 | grep default
ping6 -c 3 2606:4700:4700::1111
networksetup -getinfo "Wi-Fi" | grep IPv6
curl -6 -s https://ipconfig.co.uk/ipOr visit the IP checker: if it shows an IPv6 address, your browser reached this site over IPv6. Dedicated test sites (test-ipv6.com, ipv6-test.com) go further and score dual-stack behaviour. Most UK ISPs provide IPv6 (BT, Sky, EE, Zen, Hyperoptic, Community Fibre, Vodafone); Virgin Media, TalkTalk and Plusnet largely do not as of 2026, and many mobile networks do.
What all those addresses are
IPv6 Address. . . . . . . . . . . : 2a00:23c4:5f1a:8b00:1c3e:7a2f:9d4b:6e01(Preferred)
Temporary IPv6 Address. . . . . . : 2a00:23c4:5f1a:8b00:f0a1:2b3c:4d5e:6f70(Preferred)
Temporary IPv6 Address. . . . . . : 2a00:23c4:5f1a:8b00:8d2e:1a9f:3c7b:5e44(Deprecated)
Link-local IPv6 Address . . . . . : fe80::1c3e:7a2f:9d4b:6e01%12(Preferred)
Default Gateway . . . . . . . . . : fe80::1%12| Line | What it is | Used for |
|---|---|---|
| IPv6 Address 2a00:… | Your stable global address: the router's prefix (first 64 bits, from the ISP) plus an interface identifier that stays the same on this network | Inbound connections, and the address you would put in DNS |
| Temporary IPv6 Address (Preferred) | A privacy address with a random identifier, regenerated about daily (RFC 8981) | Outbound connections: websites see this one, so they cannot track the stable one |
| Temporary IPv6 Address (Deprecated) | Yesterday's temporary address, kept until existing connections finish | Nothing new |
| Link-local fe80:: | Automatic, always present, valid only on this segment | Talking to the router, neighbour discovery |
| Default Gateway fe80::1%12 | The router's link-local address; IPv6 routers are almost always reached this way | Everything off-link |
| fd00: or fc00: address | Unique local (ULA): private IPv6 handed out by some routers even without ISP IPv6 | LAN-only traffic |
| 2001:0: address on a "Teredo Tunneling" adapter | Legacy IPv6-over-IPv4 tunnel | Effectively nothing; safe to ignore or disable |
Linux shows the same with flags: mngtmpaddr on the stable address, temporary on the privacy ones, deprecated when past their preferred lifetime, dynamic for DHCPv6. macOS marks them secured, temporary and autoconf. More on address types →
Why there is no NAT, and what that means
With IPv6 every device gets a public address; your router does not translate anything. That is not a security hole by itself, because the router still runs a stateful firewall that blocks unsolicited inbound traffic by default, exactly as NAT did incidentally. It does mean: the address ipconfig shows is the address the internet sees; "port forwarding" becomes "allow inbound to this address" in the router's IPv6 firewall; and the prefix can change if your ISP does not give you a static one, so putting an IPv6 address in DNS at home is fragile.
Symptoms of broken IPv6
A device that has an IPv6 address and route but no working IPv6 path (a router advertising a prefix whose upstream has failed, an ISP fault, a VPN leaking, a misconfigured firewall) behaves like this:
- Browsers mostly work but some sites take 5 to 20 seconds to start loading (Happy Eyeballs falls back to IPv4 after a delay).
apt,pip,git,curlandsshhang for a minute and then work, or fail with Network is unreachable, because they try the AAAA record first.ping example.comfails butping -4 example.comworks.- Windows shows the connection as "No internet access" while everything on IPv4 works.
curl -4 -I https://example.com # works?
curl -6 -I https://example.com # hangs or fails? then IPv6 is the problem
ping -6 2606:4700:4700::1111 # does the path work at all
tracert -6 2606:4700:4700::1111 # where does it stop
traceroute6 2606:4700:4700::1111If the trace dies at your router, the router's IPv6 WAN is down: reboot it, check its IPv6 status page, and if it persists, report it to the ISP. If it dies further out, it is the ISP. Meanwhile, prefer IPv4 rather than disabling IPv6.
Prefer IPv4 without disabling IPv6
This keeps IPv6 available for what needs it but makes the system try IPv4 first, which removes the delays.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0x20 /f
shutdown /r /t 00x20 = "prefer IPv4 over IPv6 in prefix policies". Also available as a Group Policy and in the Microsoft "Guided Fix" downloads. Undo by deleting the value or setting 0.
# /etc/gai.conf: uncomment or add
precedence ::ffff:0:0/96 100
# takes effect for new processes immediately; verify with
getent ahosts example.com | head -3 # IPv4 should now come firstmacOS has no supported switch to prefer IPv4 short of setting IPv6 to Link-local only per service (sudo networksetup -setv6linklocal "Wi-Fi"), which effectively disables global IPv6 for that service while keeping the stack running. Reverse with -setv6automatic.
Disable IPv6 (when you really must)
# one adapter (reversible, no reboot)
Disable-NetAdapterBinding -Name "Ethernet" -ComponentID ms_tcpip6
Enable-NetAdapterBinding -Name "Ethernet" -ComponentID ms_tcpip6
# every adapter
Get-NetAdapter | Disable-NetAdapterBinding -ComponentID ms_tcpip6:: system-wide, all except loopback (requires reboot; 0xFF is the Microsoft-documented value)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFF /f
:: only tunnels (Teredo, ISATAP, 6to4), keep native IPv6
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0x01 /f
:: re-enable
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /fThe GUI route is the checkbox Internet Protocol Version 6 (TCP/IPv6) in the adapter's Properties (ncpa.cpl), which is the same as the per-adapter binding above.
# until reboot
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
# persistent: /etc/sysctl.d/99-disable-ipv6.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# per NetworkManager profile (cleaner)
sudo nmcli con mod "Wired connection 1" ipv6.method disabled && sudo nmcli con up "Wired connection 1"
# per systemd-networkd link: LinkLocalAddressing=ipv4 and IPv6AcceptRA=no in the .network file
# kernel parameter as a last resort: ipv6.disable=1 on the command line (GRUB)sudo networksetup -setv6off "Wi-Fi" # macOS 12 and later
sudo networksetup -setv6linklocal "Wi-Fi" # older, or to keep link-local for AirDrop
sudo networksetup -setv6automatic "Wi-Fi" # restoreTurning temporary addresses off or on
Servers usually want no temporary addresses (so logs and firewall rules see one address); desktops want them on. Some corporate networks require EUI-64 identifiers for tracking.
netsh interface ipv6 show privacy
netsh interface ipv6 set privacy state=disabled # no temporary addresses
netsh interface ipv6 set privacy state=enabled
netsh interface ipv6 set global randomizeidentifiers=disabled # use EUI-64 for the stable address
netsh interface ipv6 set global randomizeidentifiers=enabledsysctl net.ipv6.conf.all.use_tempaddr # 0 off, 1 generate but prefer stable, 2 generate and prefer temporary
sudo sysctl -w net.ipv6.conf.all.use_tempaddr=0
sudo nmcli con mod "Wired connection 1" ipv6.ip6-privacy 0 # NetworkManager: 0 off, 1 prefer public, 2 prefer temporary
sudo nmcli con mod "Wired connection 1" ipv6.addr-gen-mode eui64 # or stable-privacy (default)
# systemd-networkd: IPv6PrivacyExtensions=no|yes|kernel in the .network filesysctl net.inet6.ip6.use_tempaddr
sudo sysctl -w net.inet6.ip6.use_tempaddr=0 # until reboot; persist in /etc/sysctl.confStatic IPv6 and DHCPv6
Home networks use SLAAC (router advertisements) and rarely DHCPv6. Windows will use stateful DHCPv6 if the router's advertisement sets the "managed" flag; Android never does DHCPv6 at all, which is why enterprise networks that require it exclude Android devices. To set a fixed address, use a ULA prefix from your router or a DHCPv6 reservation by DUID; the commands are on the static IP page.