Disabling IPv6 on Linux is two-step if you want it to survive a reboot, one-step if you want it right now. The sysctl handles the runtime; the /etc/sysctl.d/ file makes it permanent. The GRUB approach is the heavier hammer when the sysctl is too late.
Table of contents
- The three-step approach
- The one-reboot approach
- The per-interface approach
- Verifying the change
- What breaks (and what doesn’t)
- The GRUB alternative when sysctl is too late
- Per-interface disable vs global
- FAQ
The three-step approach
The right recipe for most cases:
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
echo -e "net.ipv6.conf.all.disable_ipv6 = 1\nnet.ipv6.conf.default.disable_ipv6 = 1" | sudo tee /etc/sysctl.d/99-disable-ipv6.confThe first command disables it now; the third makes the change permanent.
The one-reboot approach
The right recipe when sysctl is not enough:
sudo sed -i 's/GRUB_CMDLINE_LINUX=""/GRUB_CMDLINE_LINUX="ipv6.disable=1"/' /etc/default/grub
sudo update-grub
sudo rebootThe team that uses this approach should still set the sysctl, because some user-space tools may try to use IPv6 before the kernel module is fully disabled.
The per-interface approach
The right recipe when you want IPv6 on most interfaces but not on one specific NIC:
sudo sysctl -w net.ipv6.conf.eth0.disable_ipv6=1Useful for the team that runs a public-facing service on eth0 and only wants IPv4 on it, but wants IPv6 on the internal network on eth1.
Verifying the change
The right tests:
ip -6 addrshould show no addresses (except possibly::1on the loopback).curl -6 https://example.comshould fail with a network error.ss -tlnp | grep -i v6should be empty.
The team that still sees IPv6 traffic on a specific interface has a per-interface override; check sysctl net.ipv6.conf.<interface>.disable_ipv6.
What breaks (and what doesn’t)
Things that break:
aptmirror selection (Debian prefers IPv6).- Some monitoring tools that assume
::1for localhost. - Docker’s default bridge network (IPv6-enabled by default in newer versions).
Things that don’t break:
- IPv4 networking.
- Localhost (the kernel always has 127.0.0.1).
- Most apps that don’t care.
The GRUB alternative when sysctl is too late
The right case for the GRUB approach:
Some applications grab IPv6 sockets at boot before sysctl has a chance to disable them. The team that sees the kernel module loaded despite the sysctl uses the GRUB approach.
GRUB_CMDLINE_LINUX="ipv6.disable=1"This passes ipv6.disable=1 to the kernel at boot. The kernel module is never loaded. No IPv6 stack, no IPv6 addresses, no IPv6 sockets.
The team that uses this approach should also set the sysctl as a belt-and-suspenders backup, in case the GRUB config gets overridden by a kernel update.
Per-interface disable vs global
The right pattern when you want IPv6 on most interfaces but not on one:
sudo sysctl -w net.ipv6.conf.eth0.disable_ipv6=1This disables IPv6 on eth0 only. The team that has a public-facing service on eth0 and a private management interface on eth1 uses this: IPv4 only on the public interface, IPv4 + IPv6 on the management interface.
The team that uses per-interface disable has more control than global disable, with the downside of having to remember which interface has which configuration.
FAQ
Is it safe to disable IPv6?
Yes, on a host that doesn’t need it. No, on a host that hosts IPv6-only services. The team that disables IPv6 on a public-facing server should verify that all the services also listen on IPv4.
Why would I disable IPv6?
Three reasons: a legacy application that breaks on dual-stack, a compliance requirement, or a desire to reduce the attack surface. None of these is common.
Can I disable IPv6 without rebooting?
Yes, with sysctl. The ipv6.disable=1 GRUB cmdline requires a reboot, but the sysctl does not.
What’s the difference between the sysctl and the GRUB approach?
Sysctl disables IPv6 at runtime. GRUB disables it at boot time. Use both if you want maximum certainty.
What’s the difference between ipv6.disable=1 and net.ipv6.conf.all.disable_ipv6=1?
The sysctl disables the IPv6 protocol stack at runtime; some user-space tools may have already grabbed IPv6 sockets. The GRUB cmdline disables IPv6 at boot before any user-space runs. The team that wants IPv6 never used picks GRUB; the team that wants IPv6 off now but might re-enable later picks sysctl.
Can I disable IPv6 for a specific user?
Not at the kernel level. The team that wants IPv6 off for a specific user has to use a container or a network namespace with IPv6 disabled inside. The cleanest solution: global disable or per-interface disable.
Does disabling IPv6 break my Docker setup?
It depends on the Docker version. Older Docker uses IPv4 only by default; newer Docker may try to use IPv6 for the bridge network. The team that disables IPv6 on the host may need to set ipv6: false in the Docker daemon config.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: