All Products
Search

This Product

    IPv6 Gateway:Enable internet access for resources in an IPv6 VPC

    Document Center

    IPv6 Gateway:Enable internet access for resources in an IPv6 VPC

    Last Updated:Oct 12, 2026

    After you enable IPv6 for a VPC, you can enable IPv6 Internet bandwidth for the IPv6 address of a cloud resource to provide Internet access. This tutorial walks you through the end-to-end setup, from creating an IPv6 VPC to verifying that an ECS instance can send and receive IPv6 traffic over the Internet.

    Business scenario

    As its business grows, a company needs the ECS01 instance to access the Internet through an IPv6 address, and needs the Internet to reach the ECS01 instance over that IPv6 address.

    Proper network planning avoids CIDR block conflicts and ensures network extensibility. Improper network planning can result in very high reconstruction costs later. Therefore, plan your network before you create a VPC.

    Solution architecture

    The ECS01 instance reaches the Internet over IPv6 through the IPv6 Internet bandwidth that you enable for its IPv6 address. Inbound access from the Internet to the ECS01 instance is controlled by the security group rules of the instance. The following figure shows the network architecture.

    image

    This solution uses the following resources:

    • VPC with an IPv6 CIDR block — When you enable IPv6 for a VPC, the system automatically creates an IPv6 gateway and assigns an IPv6 CIDR block with a /56 prefix.

    • vSwitch with an IPv6 CIDR block — The default prefix for the IPv6 CIDR block of a vSwitch is /64.

    • ECS instance with an IPv6 address — The IPv6 address that is assigned to the ECS instance carries the Internet traffic.

    • IPv6 Internet bandwidth — Provides Internet access for the IPv6 address of the ECS instance.

    • Security group rules — Determine which inbound traffic can reach the ECS instance over IPv6.

    Prerequisites

    • An Alibaba Cloud account that can log on to the VPC console, the ECS console, and the IPv6 gateway management console.

    • This tutorial uses Alibaba Cloud Linux 3.2104 64-bit as the example operating system for the ECS instance.

    Procedure

    Step 1: Create an IPv6 VPC and vSwitch

    1. Go to the Create VPC page in the VPC console.

    2. Configure the VPC:

      • Region: Select the region where you plan to create cloud resources.

      • IPv4 CIDR block: Select a recommended CIDR block provided by the console, or enter a custom CIDR block as needed. In scenarios such as multi-VPC connectivity, configure a CIDR block that does not overlap with existing VPCs to prevent CIDR block conflicts during VPC connectivity. To avoid CIDR block conflicts and ensure network extensibility, create a VPC with IPAM.

        Note

        Use the private IPv4 addresses specified in RFC 1918 as the VPC CIDR block, with a network mask of 16 to 28 bits. Examples include 10.0.0.0/16, 172.16.0.0/16, and 192.168.0.0/16.

        Important

        Do not use 100.64.0.0/10, 224.0.0.0/4, 127.0.0.0/8, or 169.254.0.0/16 as the IPv4 CIDR block of the VPC.

      • IPv6 CIDR block: Use Allocated by system and select Assign BGP (Multi-ISP) from the drop-down list. The system automatically creates an IPv6 gateway and assigns an IPv6 CIDR block with a /56 prefix.

    3. Configure the vSwitch:

      • Zone: Select the zone in which you will later create cloud resources. Select a zone based on the support status and inventory availability of the required resources in that zone.

      • IPv4 CIDR block: Select the default CIDR block provided by the console, or adjust the CIDR block range as needed.

      • IPv6 CIDR block: The default prefix for the IPv6 CIDR block of a vSwitch is /64. You can enter a decimal number from 0 to 255 to customize the last 8 bits of this CIDR block.

    Step 2: Create an ECS instance

    1. Go to the vSwitch page in the VPC console. In the Actions column of the target vSwitch, click Add Cloud Service > ECS Instance.

    2. On the Elastic Compute Service (ECS) purchase page, on the Custom Launch tab, configure the ECS instance and complete the creation.

      Only the configuration items that are closely related to this topic are described here.

      • IPv6: Select Assign IPv6 address free of charge.

    Step 3: Enable IPv6 Internet bandwidth

    IPv6 Internet bandwidth cannot be enabled directly for an entire IPv6 CIDR block. It can be enabled only for IPv6 addresses that are configured for ECS instances.

    1. Log on to the IPv6 gateway management console.

    2. Click the target IPv6 gateway instance ID, click the IPv6 Internet Bandwidth tab, and then in the Actions column for the target IPv6 address, click Activate Internet Bandwidth.

    3. On the IPv6 Internet Bandwidth (Pay-as-you-go) page, select Traffic, Bandwidth, and Billing Cycle as needed to configure Internet bandwidth, and complete the purchase.

        Step 5: Configure security group rules

        Check whether the current security group rules meet the IPv6 service requirements. If they do not, configure IPv6 security group rules separately for the ECS01 instance. The following security group rules are recommended:

        • Allow inbound ICMPv6 traffic for operations such as ping -6 on ECS servers.

        • Allow inbound Secure Shell (SSH) port 22 and RDP port 3389 for connections to ECS servers. Allow HTTP port 80 and HTTPS port 443 to access web services provided by ECS instances.

        To configure the security group rules for the ECS01 instance:

        1. Log on to the ECS console.In the left-side navigation pane, choose Network & Security, and click Security Group. In the Actions column of the target security group, click Manage Rules.

        2. Allow ICMP traffic and authorize all IPv4 addresses and IPv6 addresses.

        Step 6: Test network connectivity

        1. Remotely log on to the ECS01 instance.

        2. On the ECS01 instance, run ping -6 aliyun.com to test whether IPv6 Internet communication is working properly. Receiving reply packets indicates that communication is normal.

        [root@xxx ~]# ping -6 aliyun.com
PING aliyun.com(2401:b180:xxx::5 (2401:xxx:xxx::5)) 56 data bytes
64 bytes from 2401:b180 xxx::5 (2401:xxx:xxx::5): icmp_seq=1 ttl=96 time=9.29 ms
64 bytes from 2401:b180 xxx::5 (2401:xxx:xxx::5): icmp_seq=2 ttl=96 time=9.30 ms
64 bytes from 2401:b180 xxx::5 (2401:xxx:xxx::5): icmp_seq=3 ttl=96 time=9.27 ms
64 bytes from 2401:b180 xxx::5 (2401:xxx:xxx::5): icmp_seq=4 ttl=96 time=9.29 ms
64 bytes from 2401:b180 xxx::5 (2401:xxx:xxx::5): icmp_seq=5 ttl=96 time=9.28 ms
64 bytes from 2401:b180:xxx::5 (2401:xxx:xxx::5): icmp_seq=6 ttl=96 time=9.28 ms

        After the test succeeds, the ECS01 instance can access the Internet over IPv6. Inbound access from the Internet to the ECS01 instance depends on the security group rules that you configured for the instance.

        Step 7: (Optional) Delete IPv6 Internet bandwidth

        After you delete IPv6 Internet bandwidth for the ECS instance, charges for IPv6 Internet bandwidth stop, and the instance has only private network communication permissions.

        1. Log on to the IPv6 gateway management console.

        2. Click the target IPv6 gateway instance ID, click the IPv6 Internet Bandwidth tab, and then in the Actions column for the target IPv6 address, click Delete Internet Bandwidth.

        Billing

        • Enabling Internet bandwidth for an IPv6 address incurs Internet bandwidth fees.

        • Enabling IPv6 for a VPC or vSwitch is free of charge.

        • For pricing information about the ECS instance that you create in this tutorial, see ECS billing.