If you can subnet IPv4 in your head, you can be productive in IPv6 in about half an hour. The math is mostly the same, the notation is different, and there are a few one-time rules to memorize. This is the 80% you need.
The size of the thing
IPv4 has 4.3 billion addresses (2^32). IPv6 has 340 undecillion (2^128). To put that in perspective: there are roughly 50 billion billion IPv6 addresses for every grain of sand on Earth. We are never running out of IPv6.
How to read an IPv6 address
IPv6 addresses are 128 bits, written as eight 16-bit groups in hexadecimal, separated by colons:
2001:0db8:85a3:0000:0000:8a2e:0370:7334Two shortening rules apply:
- Drop leading zeros in any group.
0db8becomesdb8.0000becomes0. - Replace one run of all-zero groups with
::. Only once — you can't have two::in the same address (would be ambiguous).
So the address above shortens to:
2001:db8:85a3::8a2e:370:7334And 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1.
Prefix lengths
Same idea as IPv4: /N means N leading 1-bits. The common ones:
Why /64 is special
The standard IPv6 subnet is always /64. This isn't arbitrary — it's because of SLAAC (Stateless Address Autoconfiguration), which lets hosts auto-generate their address from the network prefix plus a 64-bit interface ID derived from their MAC. SLAAC requires exactly 64 host bits.
You almost never use anything else for a LAN. Carrying smaller subnets (like /127 for point-to-point) is a thing, but for any normal LAN, just use /64.
Address types you need to know
Link-local: fe80::/10
Every IPv6 interface auto-generates a link-local address starting with fe80::. It's used for neighbor discovery (the IPv6 equivalent of ARP) and is required for IPv6 to function at all. Not routed off the local link.
Unique local: fc00::/7 (usually fd00::/8)
The IPv6 equivalent of RFC 1918. Generate a random /48 from fd00::/8 for your org's internal use. Not routed on the public internet.
Global unicast: 2000::/3
Public, routable IPv6 addresses. Your ISP assigns you a prefix from here — typically a /48 for businesses, a /56 or /64 for residential. 2001:db8::/32 is reserved for documentation (use it in blog posts and tutorials, not on real networks).
Multicast: ff00::/8
IPv6 has no broadcast. Multicast replaces it. ff02::1 reaches all nodes on the local link, ff02::2 reaches all routers. Neighbor discovery uses multicast.
Loopback: ::1
Same as 127.0.0.1. Refers to the local machine.
Subnetting in IPv6 — practical
If your ISP gives you a /48 and you want to carve it up by region or department, use /56s (each contains 256 /64 subnets) or /60s (16 /64s). The math is just hex, but the principle is identical to IPv4.
Example: ISP assigns you 2001:db8:1::/48. You want 4 regions:
- Region A:
2001:db8:1:0000::/52(4,096 /64 subnets) - Region B:
2001:db8:1:1000::/52 - Region C:
2001:db8:1:2000::/52 - Region D:
2001:db8:1:3000::/52
Each region can carve its /52 into LAN-sized /64s without further coordination.
Dual-stack deployment
You don't have to choose. Modern best practice is dual-stack: run IPv4 and IPv6 in parallel. Hosts have both addresses. The application picks whichever is reachable.
AWS, Azure, and GCP all support dual-stack VPCs. On AWS you opt-in by enabling IPv6 on the VPC; AWS assigns you a /56 from its pool. Each subnet gets a /64.
No NAT — and that's good
IPv6 doesn't need NAT. Every host can have a globally routable address. Don't confuse "no NAT" with "no firewall" — you still need a stateful firewall to block unsolicited inbound. AWS calls this an Egress-only Internet Gateway, which is just the IPv6 equivalent of a NAT gateway: outbound allowed, unsolicited inbound denied.
What you can stop worrying about
- Running out of address space. A single /64 has more addresses than the entire IPv4 internet × 4 billion.
- Counting "usable hosts." Just use /64 for LANs. You have 2^64 addresses. Stop counting.
- NAT traversal. Direct addressing means no port-forwarding tricks.
- Broadcast storms. No broadcast in IPv6.
What you still need to plan
- Prefix allocation. Coordinate with your ISP and assign /48s or /56s sensibly.
- Firewall rules. Globally routable means globally reachable unless filtered.
- DNS records. Add AAAA records alongside A records.
- Monitoring tools. Make sure they speak IPv6.
The calculator handles IPv6 — switch to the IPv6 tab and drop in any address with a prefix. For a one-page reference, the cheat sheet PDF has the most-used IPv6 ranges on Page 5.