Disabling IPv6 on Linux is one of those operations that is easy to half-do. The sysctl approach (ipv6.disable=0 → ipv6.disable=1 at runtime) is the right one for most cases; the GRUB approach (ipv6.disable=1 on the kernel command line) is the fallback for the cases where sysctl is too late.
Table of contents
- Before you disable it
- The sysctl approach (runtime)
- The GRUB approach (boot-time)
- What usually breaks
- Verifying it’s off
- Why IPv6 sometimes has to be off
- Verifying the change actually took effect
- FAQ
Before you disable it
The honest question first: do you actually need to disable IPv6? Most modern applications work fine with IPv6 enabled; the team’s apps will prefer IPv6 when available and fall back to IPv4 when it is not. The legitimate reasons to disable it:
- A legacy application that breaks on dual-stack.
- A network appliance that does not understand IPv6.
- A regulatory or compliance requirement.
If the reason is “I don’t understand IPv6 and it scares me”, the right answer is to learn IPv6, not to disable it.
The sysctl approach (runtime)
The sysctl is the right tool because it does not require a reboot:
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1The all setting disables IPv6 on all interfaces; default disables it on future interfaces. The team that wants this to survive a reboot puts it in /etc/sysctl.d/99-disable-ipv6.conf.
The GRUB approach (boot-time)
The right tool for “I want it off, period, even if it breaks things”:
# /etc/default/grub
GRUB_CMDLINE_LINUX="ipv6.disable=1"Then sudo update-grub and reboot. The team that uses this approach should also set the sysctl, because the GRUB approach only handles the boot-time, and some user-space tools may still try to use IPv6.
What usually breaks
The three things that break:
aptis slow or fails. Debian’s mirror discovery uses IPv6 first; the team that disables IPv6 mid-update gets a stalled apt.- SSH listens on
::only. The team that hard-codedAddressFamily inetin sshd_config and then disabled IPv6 has no SSH. localhostresolution. Some applications assume::1resolves to localhost; with IPv6 disabled, the resolution has to fall back to127.0.0.1. The fix is in/etc/hosts.
Verifying it’s off
The right test:
ip -6 addr show # should show no addresses
cat /proc/net/if_inet6 # should be empty
ss -tlnp # should show no IPv6 listenersThe team that sees IPv6 addresses still bound to the loopback is fine; loopback IPv6 is harmless and several tools depend on it.
Why IPv6 sometimes has to be off
The four real reasons to disable IPv6, ranked by how often they come up:
- A legacy application breaks. The team that has a 10-year-old ERP system that hard-codes IPv4 socket binding has no choice but to disable IPv6 on the host.
- Compliance. Some compliance frameworks (PCI-DSS v3.2.1 had IPv6 requirements) require explicit IPv6 disablement. The team that has compliance audits picks the safest option.
- Network appliance incompatibility. The team that runs a firewall or load balancer that doesn’t understand IPv6 has to disable it on the hosts that talk to the appliance.
- Debugging. The team that has a hard-to-diagnose network issue sometimes disables IPv6 to rule it out. This is a debugging step, not a permanent configuration.
The team that disables IPv6 because “it’s scary” has a learning opportunity, not a permanent configuration.
Verifying the change actually took effect
The right tests to confirm IPv6 is off:
ip -6 addr show # should show no non-loopback addresses
cat /proc/net/if_inet6 # should be empty or only contain ::1
ss -tlnp # should show no IPv6 listeners
curl -6 https://example.com # should fail with network unreachableThe team that sees ::1 on the loopback is fine; loopback IPv6 is harmless. The team that sees a global IPv6 address (2000::/3 range) on an interface has IPv6 still active.
The team that uses systemd-resolve --status to check DNS resolution sees whether the resolver is returning AAAA records (which is fine; the resolver returning AAAA doesn’t mean the host will use them).
FAQ
Should I disable IPv6?
Probably not. Most apps work fine with IPv6 enabled. Disable it only if a specific app or compliance requirement demands it.
Will disabling IPv6 speed up my network?
Negligibly, if at all. The team that disables IPv6 hoping for a performance gain is disappointed.
How do I disable IPv6 on a specific interface only?
sudo sysctl -w net.ipv6.conf.eth0.disable_ipv6=1. The team that wants to keep IPv6 on the loopback (for ::1 resolution) but disable it on the public interface uses this.
How do I re-enable IPv6?
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0 and remove the GRUB cmdline. The team that removed ipv6.disable=1 from GRUB and ran update-grub has it back on next reboot.
Does disabling IPv6 improve performance?
Negligibly, if at all. The team that disables IPv6 hoping for a performance gain is disappointed. The real performance work is elsewhere.
What about IPv6-only networks?
Some mobile carriers and modern data centers are IPv6-only. The team that disables IPv6 on a server that needs to reach IPv6-only networks has a connectivity problem. The fix: re-enable IPv6, or use a NAT64 gateway.
Can I disable IPv6 per-application?
Not directly. The team that wants an application to not use IPv6 sets AI_ADDRCONFIG or filters AAAA records at the resolver. The cleaner solution: re-enable IPv6 and fix the application.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: