IPv6 Router Settings Explained
Enabling Native IPv6 on a modern router eliminates NAT translation overhead for over 70% of US internet traffic to Google, Apple, Netflix, and Cloudflare networks. Configuring IPv6 correctly requires matching your router's WAN DHCPv6 Prefix Delegation (DHCPv6-PD) hint to your ISP's allocation size (/56, /60, or /64) while ensuring the stateful SPIv6 firewall blocks unsolicited inbound connections.
- Use Native DHCPv6-PD: Nearly all major USA ISPs (Xfinity, AT&T Fiber, Verizon Fios, Spectrum, Cox) use Native IPv6 with DHCPv6 Prefix Delegation—never legacy 6to4 or 6rd tunnels.
- Match your ISP prefix size: Request a
/60on Comcast Xfinity, a/56on Verizon Fios and Cox, or a/64per VLAN on AT&T Fiber. - Enable SLAAC + Stateless DHCPv6 on LAN: Android devices do not support Stateful DHCPv6 (managed address assignment); always enable SLAAC so Android phones receive IPv6 connectivity.
- Never disable the IPv6 firewall: Because every device gets a globally routable GUA address (
2000::/3), your router's stateful IPv6 firewall is the only barrier blocking external port scans.
1. How Native DHCPv6 Prefix Delegation (DHCPv6-PD) Works
Unlike IPv4—where your ISP assigns a single public IP address to your router's WAN port and relies on Network Address Translation (NAT) to share it across private 192.168.x.x devices—IPv6 delegates an entire block of globally unique addresses (GUAs) to your router using DHCPv6 Prefix Delegation (DHCPv6-PD).
When your router boots with IPv6 set to Native (or DHCPv6), it sends a DHCPv6 Solicit message with an IA_PD option out the WAN port. Your ISP responds by assigning a routed prefix—such as 2601:640:4000:1a00::/60. From that delegated block, your router slices one /64 subnet (containing 18.4 quintillion addresses) for your primary LAN, and optionally additional /64 subnets for Guest or IoT VLANs. Always disable legacy transition mechanisms like 6to4, 6in4, or Teredo, which introduce severe latency and packet loss on modern dual-stack networks.
2. Exact IPv6 Settings for Comcast Xfinity, AT&T Fiber, and Verizon Fios
Each major USA broadband provider uses slightly different DHCPv6-PD prefix lengths and WAN solicitation rules. Entering the wrong prefix size can cause your router to fail delegation or drop multi-VLAN routing:
- Comcast Xfinity (Residential): Select Native / DHCPv6, enable Prefix Delegation, and set the Prefix Length hint to
60(provides 16 separate/64LAN subnets) or64on single-subnet consumer routers. - Verizon Fios & Cox Communications: Select Native / DHCPv6, set WAN IPv6 address assignment to Stateless / Prefix Delegation Only (Fios ONTs do not assign a separate WAN IA_NA address), and request a
56prefix length (256/64subnets). - AT&T Fiber (BGW320 / BGW210 in IP Passthrough): AT&T assigns a
/60to its own gateway and delegates individual/64prefixes downstream. Set your third-party router to Native DHCPv6 with a Prefix Length of64. - Spectrum (Charter): Select Native DHCPv6 with Prefix Delegation enabled and Prefix Length set to
56(or64on standard single-LAN routers).
3. LAN Auto-Configuration: SLAAC vs. Stateful DHCPv6
Once your router holds a valid /64 LAN prefix, it must assign IPv6 addresses and DNS resolvers to your client devices. In your router's LAN IPv6 settings, you will see three assignment modes:
- SLAAC (Stateless Address Autoconfiguration) + RDNSS: The router periodically broadcasts ICMPv6 Router Advertisements (RAs) with the
A(Autonomous) flag set. Clients generate their own 64-bit interface identifier using RFC 7217 stable privacy extensions and RFC 8981 temporary privacy addresses. - SLAAC + Stateless DHCPv6 (Recommended): RAs set both the
AandO(Other Configuration) flags. Clients self-assign IPv6 addresses via SLAAC and query DHCPv6 for DNS server lists and search domains. - Stateful DHCPv6 Only (Avoid on Mixed WiFi): Sets the
M(Managed) flag. Because Google Android explicitly refuses to implement Stateful DHCPv6, enabling Stateful-only mode breaks IPv6 on all Android phones, tablets, and Google TV devices.
4. Stateful IPv6 Firewall Rules and ICMPv6 Requirements
A dangerous misconception is that IPv6 eliminates the need for a firewall, or conversely, that IPv6 is inherently insecure because every laptop and phone receives a public GUA address. In reality, modern routers enforce a Stateful Packet Inspection (SPI) IPv6 Firewall (ip6tables or nftables) enabled by default.
With the IPv6 firewall enabled, outbound traffic from your LAN establishes stateful conntrack entries so return packets flow back in, while all unsolicited inbound TCP/UDP connections from the internet to your devices' global IPv6 addresses are silently dropped. However, never block all ICMPv6 traffic on your firewall: IPv6 relies on ICMPv6 Type 1 (Destination Unreachable), Type 2 (Packet Too Big for Path MTU Discovery), and Types 133–136 (Neighbor Discovery Protocol) to function. Blocking ICMPv6 Type 2 causes silent black-hole stalls on HTTPS websites.
USA ISP IPv6 Configuration Reference Matrix
| ISP Name | Connection Type | Delegated Prefix Size | Recommended Router WAN Settings |
|---|---|---|---|
| Comcast Xfinity | Native DHCPv6-PD | /60 (16 subnets) or /64 | Native, DHCP-PD Enabled, Prefix Length 60 |
| Verizon Fios | Native DHCPv6-PD | /56 (256 subnets) | Native, Stateless WAN (PD Only), Prefix Length 56 |
| AT&T Fiber (BGW320) | Native DHCPv6-PD | /64 per downstream request | Native, DHCP-PD Enabled, Prefix Length 64 |
| Spectrum (Charter) | Native DHCPv6-PD | /56 or /64 | Native, DHCP-PD Enabled, Release prefix on exit |
| Cox Communications | Native DHCPv6-PD | /56 | Native, DHCP-PD Enabled, Prefix Length 56 |
| T-Mobile 5G Home Internet | IPv6 Passthrough (/64) | Single /64 (464XLAT) | IPv6 Passthrough / Relay Mode (No PD slicing) |
IPv6 Router Setup & Security Verification Checklist
- Router IPv6 connection type set to Native (DHCPv6-PD) and legacy 6to4/6rd tunnels disabled.
- WAN Prefix Delegation length matched to ISP specification (/56, /60, or /64).
- LAN IPv6 assignment mode set to SLAAC + Stateless DHCPv6 for full Android, iOS, and Windows support.
- Stateful IPv6 Firewall enabled in router settings to block unsolicited inbound WAN connections.
- ICMPv6 Path MTU Discovery (Packet Too Big) allowed through the IPv6 firewall.
- End-to-end dual-stack routing verified via test-ipv6.com (10/10 score) and ping -6.
Frequently Asked Questions
Does enabling IPv6 expose my computers and phones directly to hackers since there is no NAT?
No, provided your router's Stateful IPv6 Firewall is enabled (which is the default on ASUS, Netgear, TP-Link, eero, and UniFi routers). NAT is an address-conservation mechanism, not a security feature; a stateful IPv6 firewall blocks all unsolicited inbound internet traffic just as effectively as IPv4 NAT while also using temporary randomized privacy addresses (RFC 8981) for outbound connections.
Why do Android phones fail to get an IPv6 address when Stateful DHCPv6 is enabled?
Android's network stack intentionally omits a Stateful DHCPv6 client (IA_NA) and relies exclusively on SLAAC (Stateless Address Autoconfiguration) and RDNSS for IPv6 addressing. Switching your router's LAN IPv6 setting from 'Stateful' to 'SLAAC + Stateless DHCPv6' immediately restores IPv6 on Android devices.
Should I disable IPv6 if I use a commercial VPN app on my computer?
If your VPN provider only tunnels IPv4 traffic and lacks an IPv6 leak blocker, disabling IPv6 on that specific device or routing VLAN prevents traffic from leaking outside the VPN tunnel over IPv6. However, modern VPN clients using WireGuard (such as Mullvad, ProtonVPN, and Tailscale) natively tunnel or block IPv6 without requiring you to turn off IPv6 on your whole router.
What is the difference between a fe80:: address and a 2600:: or 2601:: address?
An address starting with fe80:: is an IPv6 Link-Local address automatically generated on every active network interface for local Neighbor Discovery and router communication; it cannot route to the internet. An address starting with 2000:: through 3fff:: (such as 2601:: on Xfinity or 2600:: on AT&T) is a Global Unicast Address (GUA) used for public internet routing.
Related Router Setup & Engineering Guides
- How to Set Up a Router — Set up a home or small office router from scratch: connect WAN/ONT cables, release ISP DHCP leases, configure WPA2/WPA3 WiFi, and harden admin access.
- Subnet Mask Beginner Guide (CIDR /24, /23 & /16) — Understand IPv4 subnet masks, CIDR notation (/24, /23, /16, /30), binary bitmasking, usable host formulas, and RFC 1918 private IP ranges for home and office.
- AT&T Fiber BGW320 IP Passthrough Setup Guide — Configure AT&T Fiber BGW320 IP Passthrough at 192.168.1.254 using DHCPS-fixed mode, disable WiFi and packet filters, and eliminate Double NAT on your router.
- Verizon Fios CR1000A & G3100 Bridge Mode & ONT Guide — Bypass your Verizon Fios CR1000A or G3100 router by plugging directly into the fiber ONT Ethernet port, or configure MoCA coax bridge mode for Fios TV boxes.