IPv6 and NAT VPS: Do You Still Need Port Forwarding?

If a VPS has a properly routed public IPv6 address, IPv6 clients may connect directly subject to firewall rules. IPv4 NAT port mappings still apply to IPv4 clients. Having a private IPv4 address does not establish that usable IPv6 is included.

Check what is actually assigned

Run ip -6 addr and ip -6 route to inspect the guest. A link-local address beginning with fe80: is not a globally reachable service address. A configured address also needs working routing and appropriate filtering to be reachable externally.

Test from a separate network with IPv6 connectivity. A local success does not prove external routing. Conversely, a failure from an IPv4-only client says little about the server's IPv6 configuration.

Publishing DNS records

Only add an AAAA record after validating the endpoint. Publishing a broken IPv6 route can cause slow or failed access for some users. An A record for shared IPv4 does not eliminate the need to handle assigned IPv4 ports separately.

Keep security consistent

Apply firewall rules to both IP families. An application secured only on IPv4 may still be exposed on IPv6. Check whether it listens on ::, 0.0.0.0 or only a local address, and understand the operating system's dual-stack behavior.

Do not assume Autdo includes routed public IPv6 simply because a tutorial discusses it. Confirm the current plan and instance details before designing around that capability. See NAT basics, firewall setup and DNS records.

Reference: RFC 4291: IPv6 addressing architecture.