Enabling IPv6 on US Consumer ISPs

This guide focuses on enabling IPv6 using either the ISP‑supplied gateway or your own router behind it (bridge/IP‑passthrough), for major US providers. If content in here is incorrect, please email us with the corrections and we will make sure it gets updated.

Always confirm your ISP still offers residential IPv6 in your region; policies and availability change.

1. General IPv6 Concepts You’ll Need to know

Before provider specifics, there are three common deployment models:

• SLAAC (Stateless Autoconfiguration): Router receives a single /64 and advertises it to LAN; clients self‑configure.
• DHCPv6 with Prefix Delegation (PD): Router gets a WAN IPv6 plus a delegated prefix (/56, /60, /64) to assign to internal interfaces.
• Tunnels (6rd, HE, etc.): Used only when the ISP has no native IPv6.

Most US cable/fiber ISPs today use native dual‑stack with DHCPv6‑PD on consumer connections. Although a /56 is the recommended allocation for a residential deployment, Some providers chooase smaller options such as /60 or even /64. Providers such as AT&T and T-Mobile 5g and Verizon 5g may only delegate /64 of IPv6. While sub-optimal, a /64 is at least enough for a single LAN segment and is critical in the latter 2 cases because they may also employ CG-NAT for legacy IP.

On customer routers (pfSense, OPNsense, MikroTik, Ubiquiti, etc.), the pattern is usually:

1. Set WAN IPv6 type to DHCPv6.
2. Request a prefix delegation (commonly /56 or /60).
3. Set LAN IPv6 type to “Track interface” (or equivalent) using the WAN interface and chosen prefix ID.
4. Ensure RA (Router Advertisements) and (optionally) DHCPv6 server are enabled for LAN.

2. Comcast (Xfinity)

Comcast offers native dual‑stack IPv4+IPv6 on most residential tiers. They generally delegate a /60 to residential customer routers.

2.1 Using Comcast‑Supplied Gateway

Most recent xFi gateways have IPv6 enabled by default:

1. Log into the gateway’s web UI (typically http://10.0.0.1).
2. Navigate to Advanced / Connection / Local IP Network or similar.
3. Ensure IPv6 is enabled and mode is set to SLAAC or DHCPv6 for LAN.
4. Save and reboot if you change settings.

Clients should auto‑configure global IPv6 addresses if your area is fully enabled.

2.2 Using Your Own Router

On pfSense‑like routers, configuration typically looks like this for Comcast:

• WAN:

  • IPv6 Configuration Type: DHCPv6.
  • Prefix Delegation Size: 60 (Comcast commonly provides /60).
  • Request only a prefix, not an address (depending on platform).

• LAN:

  • IPv6 Configuration Type: Track Interface.
  • Track IPv6 Interface: WAN.
  • IPv6 Prefix ID: 0 (or another ID if you have multiple LANs).

• Routing:

  • Ensure an IPv6 default gateway is created/bound to WAN_DHCP6.

After applying, reboot router and test with an IPv6 test site.

3. AT&T (DSL and Fiber)

Residential AT&T historically used 6rd for some DSL, but modern AT&T gateways provide native dual‑stack with DHCPv6 and prefix delegation.

3.1 AT&T Gateway (BGW / NVG Series)

1. Log into the gateway (usually http://192.168.1.254).
2. Go to “Home Network” → “IPv6” or similar.
3. Ensure:
   • IPv6 is enabled.
   • DHCPv6 and Prefix Delegation are enabled.
4. Apply, then reboot the gateway.

LAN clients should receive IPv6 addresses via SLAAC/DHCPv6.

3.2 Using Your Own Router (Behind AT&T Gateway)

AT&T often requires their gateway in front, but you can:

• Use “IP Passthrough” or similar mode for IPv4.
• Keep IPv6 ON in the gateway so it still handles prefix delegation, or
• In some setups, configure your router to obtain a delegated prefix from the AT&T gateway via DHCPv6‑PD (router WAN plugged into AT&T LAN).

On a Cisco‑style router, an example pattern is:

• Configure an IPv6 DHCP client on the interface toward the AT&T gateway, enable PD, then use the delegated prefix on your LAN and set the default route via the gateway’s link‑local address.

Exact UI steps vary by router vendor; the key is: WAN as DHCPv6‑PD client, LAN uses delegated prefix, RA on for hosts.

4. Charter / Spectrum

Charter and Spectrum are related-ish; Spectrum cable offers native IPv6 to many residential customers.

4.1 With Spectrum‑Provided Modem/Router

1. Log into the router’s admin UI.
2. Locate IPv6 settings; many devices default to enabling IPv6 automatically.
3. Set IPv6 mode to “Automatic” or “DHCPv6” for WAN.
4. Ensure LAN has RA/DHCPv6 enabled so clients receive addresses.

Some all‑in‑one gateways simply require you to toggle IPv6 to “On” and they handle PD and RA automatically.

4.2 With Your Own Router

Users have reported that with Spectrum cable:

• Enabling DHCPv6 with IA_PD (prefix delegation) on the WAN is sufficient.
• The router then obtains a prefix and can run a DHCPv6 server for the LAN.

Typical steps:

• WAN: IPv6 = DHCPv6 (enable IA_NA/IA_PD as supported).
• LAN: Track WAN’s delegated prefix, enable RA, optional DHCPv6 server.

5. Verizon (Fios)

Verizon Fios has been rolling out IPv6 on residential fiber; support and behavior can vary by region and router brand. Some consumer routers auto‑detect IPv6 via an “Auto Config” option.

5.1 With Verizon‑Provided Router

1. Log into the Fios router (often http://192.168.1.1).
2. Enable IPv6 or set connection type to “Auto Config” or equivalent.
3. Ensure LAN IPv6 is enabled so clients get addresses.

On some routers, toggling IPv6 mode from Auto → Off → Auto can trigger the WAN to request IPv6 again.

5.2 Using Your Own Router

On your router:

• Configure WAN IPv6: DHCPv6 (with prefix delegation).
• Request an appropriate prefix size if possible; some users report /56 or /64 depending on region and modem configuration.
• LAN: Track interface, enable RA and DHCPv6 if needed.

You may need to experiment with router‑specific options like “Auto Config”, “DHCPv6‑PD”, or “Native IPv6” on consumer hardware attached to the ONT.

6. Frontier (DSL and Fiber)

Frontier’s IPv6 support is inconsistent; multiple reports indicate some fiber regions still lack native IPv6 and users rely on tunnels.

6.1 Frontier Fiber

• Some users report that Frontier claims to support IPv6 on fiber, but customers cannot obtain working addresses or prefixes on common routers.
• In regions without native IPv6, options include 3rd‑party tunnels (e.g., Hurricane Electric), configured on your router.

If Frontier enables native IPv6 in your area:

• WAN: Set IPv6 type to DHCPv6‑PD.
• LAN: Track interface, RA on.
• If nothing is delegated, you likely still lack native IPv6; fall back to a tunnel if required.

6.2 Frontier DSL

Frontier DSL historically has had very limited IPv6 deployment; check your modem or Frontier documentation. If the modem UI has no IPv6 options and DHCPv6‑PD yields nothing, assume IPv4‑only and consider a tunnel provider.

7. HughesNet

HughesNet satellite service primarily focuses on IPv4; IPv6 support is constrained and often not user‑configurable.

• On common HughesNet HT2000W modems, users report there is no way to configure IPv6 in the modem itself.
• You can set IPv6 DNS servers manually on devices that support IPv6, but the modem does not expose IPv6 routing controls.

Practically, HughesNet behaves as IPv4‑only from the customer perspective; native routed IPv6 to your LAN is not generally supported. If you require IPv6, you may need a tunnel service over IPv4 (subject to satellite latency and provider policies).

8. Viasat

Viasat explicitly states that subscriber IPs are IPv4 only and that they do not support IPv6.

• Viasat static IPs are provisioned as IPv4 /32; there is no IPv6 or IPv6 static option.
• Their documentation clarifies that subscriber IPs are IPv4‑only and IPv6 is unsupported.

If you need IPv6 on Viasat, your only option is a 3rd‑party IPv6‑over‑IPv4 tunnel (again, subject to latency, possible filtering (Netflix, Google), and any ISP limitations).

9. Starlink

Starlink provides native IPv6 to customers, delegating a prefix over the Starlink terminal connection; many users have successful deployments with standard routers.

9.1 With Starlink Router Only

If you use the Starlink router with no third‑party router:

• IPv6 is usually automatically enabled, and clients that support IPv6 will receive addresses via SLAAC.
• The Starlink app and administration features are limited, so there may be minimal IPv6 configuration options exposed; it generally “just works” for basic use.

9.2 With Your Own Router (Bypassing Starlink Router)

Common pattern (example: MikroTik):

• Connect your router WAN to the Starlink terminal (via Ethernet adapter).
• On your router:
  • Enable IPv6 globally (if disabled by default).
  • Configure a DHCPv6 client on the WAN interface to request a prefix from Starlink.
  • Use the delegated prefix to configure LAN addresses and RA.

On MikroTik, a typical configuration script:

• Enables IPv6, sets DHCPv6 client on the Starlink interface, creates an address from the delegated pool on the LAN, and configures firewall and RA defaults.

Other router vendors (UniFi, pfSense, etc.) follow similar steps:

• WAN: IPv6 = DHCPv6 with prefix delegation.
• LAN: Track interface, RA + optional DHCPv6 server.
• Ensure firewall rules allow outbound IPv6 and inbound ICMPv6 for proper operation.

See here for commands.

10. T-Mobile 5G Home Internet

T-Mobile provides native IPv6 on their 5G Home Internet service. The service uses a 5G gateway device that handles both IPv4 (via CGNAT) and IPv6 connectivity.

10.1 With T-Mobile Gateway Only

T-Mobile’s 5G gateways (such as the Arcadyan KVD21, Sagemcom Fast 5688W, or Nokia 5G21) typically have IPv6 enabled by default:

1. Access the gateway’s web interface (usually http://192.168.12.1).
2. Navigate to Network → IPv6 or Advanced → IPv6 settings.
3. Ensure IPv6 is enabled (it usually is by default).
4. Clients should receive IPv6 addresses automatically via SLAAC.

Note that T-Mobile uses CGNAT for IPv4, so IPv6 is often the only way to get a publicly routable address on this service.

10.2 Using Your Own Router

T-Mobile gateways support “IP Passthrough” mode on some models, but IPv6 behavior varies:

• On gateways that support passthrough, you can configure your router’s WAN interface to request IPv6 via DHCPv6.
• Some users report success obtaining a /64 prefix via DHCPv6-PD.
• If passthrough is unavailable, you can place your router in a DMZ on the gateway and let it handle IPv6 directly, though this creates a double-NAT situation for IPv4.

Typical router configuration:

• WAN: IPv6 = DHCPv6 (request prefix delegation if available).
• LAN: Track interface, enable RA.
• Note: Prefix delegation behavior can be inconsistent; some users receive only a /64 without PD.

11. Google Fiber

Google Fiber provides excellent native IPv6 support with generous prefix delegation. IPv6 is enabled by default and works seamlessly for most customers.

11.1 With Google Fiber Network Box

If using Google’s provided Network Box:

1. IPv6 is enabled by default; no configuration is typically required.
2. Access the Network Box at http://192.168.1.1 if you need to verify settings.
3. Navigate to Network → Advanced Networking → IPv6.
4. Confirm IPv6 is set to “Automatic” or “Enabled.”

Clients on the LAN automatically receive IPv6 addresses via SLAAC.

11.2 Using Your Own Router

Google Fiber readily supports customer-provided routers and provides a /56 prefix via DHCPv6-PD:

• Connect your router directly to the Fiber Jack (no Network Box needed in many setups).
• On your router:
  • WAN: IPv6 = DHCPv6 with prefix delegation.
  • Request a /56 prefix (Google Fiber commonly provides /56).
  • LAN: Track interface, use a prefix ID (e.g., 0, 1, 2) for each VLAN/subnet.
  • Enable RA and optionally DHCPv6 server on LAN.

On pfSense/OPNsense:

• WAN IPv6 Configuration Type: DHCPv6
• DHCPv6 Prefix Delegation Size: 56
• LAN IPv6 Configuration Type: Track Interface
• Track IPv6 Interface: WAN
• IPv6 Prefix ID: 0

Google Fiber’s IPv6 implementation is considered one of the cleanest among US ISPs, with reliable PD and no quirks.

12. Verizon Wireless 5G Home Internet

Verizon’s 5G Home Internet (distinct from Verizon Fios fiber) uses fixed wireless access and provides IPv6, though configuration options are limited on their gateways.

12.1 With Verizon 5G Gateway

Verizon’s 5G Home gateways (such as the ASK-NCQ1338 or similar LTE/5G units):

1. Access the gateway at http://192.168.1.1 or via the My Verizon app.
2. Navigate to Network Settings → IPv6.
3. Ensure IPv6 is enabled (often on by default).
4. The gateway handles SLAAC for LAN clients automatically.

Like T-Mobile, Verizon Wireless uses CGNAT for IPv4, making IPv6 important for direct connectivity.

12.2 Using Your Own Router

Verizon 5G Home gateways have limited bridge/passthrough options:

• Some gateways support “IP Passthrough” or DMZ modes; check your specific model.

• When passthrough is available:

  • Configure your router’s WAN for DHCPv6.
  • Request prefix delegation (results vary; some users get /64, others report /56).
  • LAN: Track interface, enable RA.

• If no passthrough is available:

  • Your router sits behind the Verizon gateway with double-NAT for IPv4.
  • IPv6 may still work if the gateway passes through the delegated prefix or you can request PD from the gateway’s LAN side.

Configuration varies significantly by gateway model; consult Verizon support or community forums for your specific hardware.

13. Provider Overview Table

14. Minimal Router‑Agnostic Checklist

When you know your ISP supports native IPv6:

1. Enable IPv6 on the ISP gateway (if using it) and reboot.
2. If using your own router:
   • WAN: set IPv6 to DHCPv6 and request a prefix (try /56 or /60, or “Auto”).
   • LAN: configure IPv6 to track the WAN interface and use part of the delegated prefix; enable RA and DHCPv6 if offered.
   • Allow ICMPv6 in firewall, and ensure IPv6 forwarding is on.
3. Test from a client with an IPv6 connectivity test site and verify you have a global unicast address and working DNS.

If the WAN never receives an IPv6 address or prefix, confirm with the provider whether IPv6 is enabled on your line; if not, consider an IPv6‑over‑IPv4 tunnel where latency and policy allow.

15. Relevant RFCs for IPv6 CPE and Filtering

The following RFCs provide authoritative guidance on IPv6 customer premises equipment requirements and proper filtering practices:

CPE Requirements

• RFC 7084 – Basic Requirements for IPv6 Customer Edge Routers Defines the essential IPv6 capabilities that residential gateway devices must support, including WAN‑side DHCPv6 client behavior, prefix delegation handling, LAN‑side router advertisement, and basic security defaults.

• RFC 8504 – IPv6 Node Requirements Updates and consolidates requirements for IPv6 nodes, covering addressing, ICMPv6, neighbor discovery, and other protocol elements that hosts and routers must implement.

Security and Filtering

Because IPv6 is “public” (i.e. not behind a NAT), concern about security with IPv6 is common. However, there are standards in place that recommend appropriate behavior, advocating for a “defeult-deny” policy and providing guidance on what must be alowed and what can be denied in a stateful packet filter firewall.

Remember, NAT is not a firewall, and a firewall is not a NAT. They are different tools that are frequently deployed (and conflated) together, but are not a unified process. Very sucessful filtering can exist on public addressing, both IPv6 and legacy IP. A NAT, or more coorectly a Natwork address port translation (masquierading, overload, NAP-T) does nothing but allow a set of addresses to operate behind a single or smaller set of addresses. It is not a security tool, it is a translation mechanism.

• RFC 6092 – Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service Provides security recommendations for residential IPv6 gateways, including default‑deny inbound policies, stateful filtering, and handling of specific traffic types while preserving end‑to‑end connectivity where appropriate.

• RFC 4890 – Recommendations for Filtering ICMPv6 Messages in Firewalls Details which ICMPv6 message types must be permitted for proper IPv6 operation (e.g., Packet Too Big, Neighbor Solicitation/Advertisement, Router Solicitation/Advertisement) and which may be safely filtered. Blocking essential ICMPv6 breaks Path MTU Discovery and Neighbor Discovery.

Additional References

• RFC 3315 / RFC 8415 – DHCPv6 RFC 8415 obsoletes RFC 3315 and defines the Dynamic Host Configuration Protocol for IPv6, including prefix delegation (IA_PD) used by most ISPs to assign address space to customer routers.

• RFC 4861 – Neighbor Discovery for IP version 6 (IPv6) Specifies the Neighbor Discovery protocol, including Router Advertisements (RA) and Neighbor Solicitation/Advertisement messages critical for LAN‑side IPv6 autoconfiguration.

• RFC 4862 – IPv6 Stateless Address Autoconfiguration (SLAAC) Defines how hosts generate their own IPv6 addresses from router‑advertised prefixes without requiring DHCPv6.