IPv6 address plan — /48 upstream, /64 per subnet, ULA for internal

A sloppy IPv4 address plan is recoverable. A sloppy IPv6 address plan is not — IPv6 prefixes are long, the subnet space per site is enormous, and the consequences of arbitrary assignment appear years later when an operator tries to write a firewall rule, aggregate a route, or migrate an ISP. The IPv6 address plan must be deliberate, documented, and stable from the day the firewall is installed.

This lesson covers the prefix sizes an IPv6 operator inherits from the upstream ISP, the /64-per-subnet rule, the role of Unique Local Addresses (ULAs) for internal-only addressing, and the gateway-address convention that keeps firewall rules readable.

The upstream delegation

Most residential and small-business ISPs delegate a /56 or /48 to a customer. A /48 has 65,536 possible /64 subnets; a /56 has 256. The operator subdivides the delegated prefix into /64s, one per subnet, and assigns each subnet a stable identifier.

The operator cannot change the delegation size; it is the ISP’s policy. The operator can — and must — decide how to subdivide what arrives.

$ ifconfig igb0 | grep -E 'inet6|prefix'

inet6 fe80::a65e:60ff:fedd:eeff%igb0 prefixlen 64 scopeid 0x2
inet6 2001:db8:abcd:e000::1 prefixlen 64
inet6 2001:db8:abcd:e100::1 prefixlen 64
inet6 2001:db8:abcd:e200::1 prefixlen 64
inet6 2001:db8:abcd:e300::1 prefixlen 64

The /64 per subnet rule

Every subnet in IPv6 must be a /64. This is not a convention; it is a protocol requirement. SLAAC, the mechanism by which hosts self-configure their interface identifiers, depends on the prefix being exactly 64 bits so the host can build its interface identifier into the remaining 64 bits. A subnet that is not /64 (a /65, /127, /128) breaks SLAAC entirely.

This rule produces a paradox: an enormous amount of address space per subnet. Each /64 holds 2^64 addresses — more than the entire IPv4 Internet. The address space is not scarce at the subnet level; it is scarce at the prefix level. An operator with a /48 has 65,536 subnets to use; the operator’s discipline is in spending those subnets deliberately.

Subdividing the delegated prefix

The subdivision pattern depends on the delegation size:

• /48 delegation: the operator has 16 bits of “subnet ID”. Use the high 4 bits as a region identifier and the low 12 bits as a per-region subnet number. Example: 2001:db8:abcd:RRSS::/64 where RR is a region (LAN=0, DMZ=1, guest=2) and SS is a per-region subnet.
• /56 delegation: the operator has 8 bits of “subnet ID”. Use the low byte of the sub-prefix as the subnet number. Example: 2001:db8:abcd:e0SS::/64 where SS is the subnet number (00=LAN, 01=DMZ, 02=guest, 03=management).
• /60 delegation: 4 bits of subnet ID; fewer subnets but still enough for a small estate.

The convention should be written down, applied from day one, and enforced on every subnet addition. The cost of inconsistency is invisible on day one and enormous on day 365.

The gateway address convention

Each subnet needs a gateway address — the address of the firewall’s interface on that subnet. The convention:

• The firewall’s address is 2001:db8:abcd:e0SS::1 for subnet SS (the first address in the /64).
• Reserved ranges inside the /64: ::0 is the subnet anycast address; ::1 is the gateway; the high 16 addresses (::ffff:ffff:ffff:ffff and below) are reserved for future use per RFC 6890; some operators also reserve the low addresses for static servers.

The first-address-as-gateway convention makes firewall rules readable. An operator who sees 2001:db8:abcd:e001::1 in a rule knows immediately that this is the LAN gateway.

$ ping6 -c 2 2001:db8:abcd:e001::1

PING6(56=40+8+8 bytes) 2001:db8:abcd:e002::50 --> 2001:db8:abcd:e001::1
16 bytes from 2001:db8:abcd:e001::1, icmp_seq=0 hlim=64 time=0.412 ms
16 bytes from 2001:db8:abcd:e001::1, icmp_seq=1 hlim=64 time=0.388 ms

--- 2001:db8:abcd:e001::1 ping6 statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.388/0.400/0.412/0.012 ms

Unique Local Addresses (ULAs)

ULAs are IPv6’s equivalent of RFC 1918 private space: fc00::/7 is the range, with the operator choosing a /48 inside it (typically derived from RFC 4193 random generation). ULAs are not routable on the public Internet; they are for internal addressing only.

The production pattern is dual-stack on every internal interface:

• Global address (the /64 from the upstream delegation): routable on the public Internet; used for outbound traffic and inbound from the Internet.
• ULA address (an RFC 4193 /48): routable only inside the site; used for internal services (DNS, NFS, internal HTTP, monitoring).

Why both? Three reasons:

1. Stability across ISP changes. The global prefix changes when the ISP changes the delegation or rotates a prefix. The ULA prefix is generated once and never changes; internal services stay reachable across ISP migrations.
2. No external exposure. A service bound only to the ULA is not reachable from the public Internet. A misconfigured firewall rule on the global address does not expose the internal service.
3. Documentation clarity. Internal services get ULAs; external-facing services get global addresses. The address type tells the operator the audience.

Putting it together — a complete address plan

A small production estate with a /48 delegation might look like:

The convention: each subnet has the same ID byte in the global prefix and the ULA prefix. The gateway is ::1 on both. The operator’s documentation says “subnet 0 is LAN, subnet 1 is DMZ, …” and applies to both address families.

What the plan protects against

A deliberate plan protects against three operational incidents:

1. ISP migration. The global prefix changes when the ISP changes; the ULA prefix is stable. Internal services bound to ULAs continue working without reconfiguration.
2. Firewall rule auditing. A rule that references 2001:db8:abcd:0001::/64 is auditable to “this is the DMZ subnet, the gateway is at ::1” without looking anything up.
3. Subnet exhaustion. The /48 (or /56) has more subnets than the operator will use in the foreseeable future; the discipline of /64 per subnet guarantees no subnet ever runs out of host addresses.

The plan is documentation. Documentation prevents incidents.

Summary

• The upstream ISP delegates a /48, /56, /60, or /64; the operator subdivides the delegated prefix into /64s.
• Every IPv6 subnet is /64 — never smaller. SLAAC depends on the /64 size.
• Each subnet has a stable identifier byte (subnet ID); the gateway address is ::1.
• ULAs (fd00::/8 with RFC 4193 random prefix) provide stable internal addressing that does not change when the ISP rotates the global delegation.
• Document the plan; apply it consistently from day one; flag every exception.