Remove IPv6 from Ubuntu two ways: per-interface via Netplan (the right way for a specific interface), or system-wide via sysctl (the right way for a clean IPv4-only box). The Netplan approach is safer - other interfaces and the loopback keep IPv6. The sysctl approach is more thorough but disables IPv6 everywhere.
Table of contents
- Per-interface via Netplan
- System-wide via sysctl
- The GRUB method (when sysctl is not enough)
- Re-enabling IPv6 later
- Verifying the disable worked
- How this fits the rest of the stack
- FAQ
Per-interface via Netplan
Edit /etc/netplan/01-netcfg.yaml (or the active config file). For an interface named enp0s3 that should be IPv4-only:
network:
version: 2
renderer: networkd
ethernets:
enp0s3:
dhcp4: yes
dhcp6: no
accept-ra: false
dhcp6: no disables DHCPv6. accept-ra: false ignores Router Advertisements (the IPv6 equivalent of DHCP). Apply with sudo netplan apply.
The team that has multiple interfaces and only wants IPv4 on the public one uses this pattern. The team that has a bond or bridge needs the same flags in the bond/bridge section.
System-wide via sysctl
Create /etc/sysctl.d/90-disable-ipv6.conf:
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
Note: lo.disable_ipv6 = 1 here is the intentional choice. If you want IPv6 on the loopback (some services need it), use lo.disable_ipv6 = 0 and set the others to 1.
Apply: sudo sysctl --system. Verify: ip -6 addr should be empty (or show only the loopback if lo.disable_ipv6 = 0).
The GRUB method (when sysctl is not enough)
Some services bind to IPv6 before sysctl can disable it (notably systemd-networkd on some configurations). The fix: disable IPv6 in the kernel command line.
Edit /etc/default/grub, set GRUB_CMDLINE_LINUX="ipv6.disable=1", then sudo update-grub && sudo reboot.
After this, the kernel itself does not initialize IPv6. The team that has a stubborn systemd-networkd that keeps bringing up IPv6 uses this method.
Re-enabling IPv6 later
To put IPv6 back:
sudo rm /etc/sysctl.d/90-disable-ipv6.conf
sudo sysctl --system
And remove ipv6.disable=1 from /etc/default/grub if you added it, then update-grub && reboot.
The team that adds a Cloudflare front-end or a CDN that uses IPv6 finds out the IPv6 stack is needed and re-enables it.
Verifying the disable worked
After the disable, the checks:
ip -6 addr # should be empty or only lo (if lo not disabled)
ip -6 route # should be empty
ss -tulnp | grep -i 6 # no services listening on IPv6
The team that wants to confirm no service is using IPv6 runs the ss check. The team that only checks the addresses can miss a service that is bound to :: (IPv6 all-interfaces) but has no global address.
FAQ
What is the difference between removing IPv6 addresses and disabling IPv6?
Removing addresses only stops the host from being reachable on IPv6. Disabling IPv6 also stops the kernel from processing IPv6 packets. The team that only removes addresses (e.g., via ip -6 addr del) sees them come back at the next DHCPv6 cycle. The team that disables IPv6 via sysctl or GRUB has it off for good.
Does removing IPv6 break apt?
Sometimes, if apt is configured to use ::1 (IPv6 loopback) for the package mirror. The team that hits this on Ubuntu adds Acquire::ForceIPv4 true; to /etc/apt/apt.conf.d/99force-ipv4 to force apt to use IPv4.
Should I remove IPv6 from cloud VMs?
Usually no. AWS, GCP, and Azure all provide IPv6 on cloud VMs by default. The team that removes IPv6 on a cloud VM has slightly less attack surface but loses the dual-stack benefits.
Can I remove IPv6 from a single container?
Yes - via sysctl inside the container’s namespace, or by setting disable_ipv6 on the container’s network interface. The team that runs a containerized app with strict IPv4-only requirements uses the per-container sysctl.
What about IPv6 link-local addresses (fe80::/10)?
These are the IPv6 equivalent of 169.254.0.0/16 - automatically configured on every IPv6-capable interface. The team that disables IPv6 fully (sysctl all.disable_ipv6=1) removes these. The team that uses dhcp6: no in Netplan still has link-local addresses.
How this fits the rest of the stack
For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.
Useful related references: