A temporary IPv6 address is generated by privacy extensions - a mechanism that gives your device a random, rotating address for outbound connections so it cannot be tracked by a fixed identifier. On Linux you enable and control it through the net.ipv6.conf.*.use_tempaddr sysctl, and you force a fresh one by cycling the interface or the setting. The reason this exists is that a plain IPv6 address derived from your network card’s MAC address is effectively a permanent, globally-unique tracking cookie baked into every packet - privacy extensions replace that with an address that changes, so your traffic is not trivially linkable across sites and sessions.
The question “how do I get a new temporary IPv6 address” almost always comes from one of two places: you want more privacy, or something broke because your address changed underneath it. The mechanism is the same; the fix differs.
Table of contents
- Why temporary addresses exist at all
- Checking what you have on Linux
- Enabling and preferring temporary addresses
- Forcing a fresh temporary address now
- The catch: temporary addresses break inbound services
- How this fits the rest of the stack
- FAQ
Why temporary addresses exist at all
IPv6 originally derived the host part of an address from the network interface’s MAC address (via EUI-64). That is convenient and catastrophic for privacy: it means a stable, globally-unique identifier tied to your physical hardware appears in every packet you send, from any network. Any site you visit could correlate you across sessions and locations by that suffix alone.
Privacy extensions (RFC 4941 / 8981) fix this by generating a random interface identifier for outbound connections, rotating it periodically. Your device keeps a stable address for inbound services if it needs one, but its outgoing traffic uses a temporary address that changes over time. Most desktop and mobile operating systems enable this by default now. Servers often do not, because a server usually wants a predictable address.
Checking what you have on Linux
First, see whether privacy extensions are on and what addresses exist:
ip -6 addr showA temporary address is flagged temporary (and often dynamic) in the output, alongside the stable one. If you only see one non-link-local address with no temporary flag, privacy extensions are off.
Check the sysctl directly:
sysctl net.ipv6.conf.all.use_tempaddrThe value meanings:
- 0 - disabled; use the stable address only.
- 1 - enabled; generate temporary addresses but prefer the stable one for outbound.
- 2 - enabled and prefer the temporary address for outbound connections. This is the setting for actual privacy.
Enabling and preferring temporary addresses
To turn privacy extensions on and prefer the temporary address, set use_tempaddr to 2. Test it live first:
sudo sysctl -w net.ipv6.conf.all.use_tempaddr=2
sudo sysctl -w net.ipv6.conf.default.use_tempaddr=2That lasts until reboot. To make it permanent, add it to a sysctl config file:
# /etc/sysctl.d/40-ipv6-privacy.conf
net.ipv6.conf.all.use_tempaddr = 2
net.ipv6.conf.default.use_tempaddr = 2Then sudo sysctl --system to apply. On systems using NetworkManager, the equivalent is the connection’s ipv6.ip6-privacy setting (2 for prefer-temporary), which is the better place to set it because NetworkManager can otherwise override the sysctl on that interface.
Forcing a fresh temporary address now
Temporary addresses rotate on their own schedule, but to force a new one immediately, cycle the interface so the address gets regenerated:
sudo ip link set dev eth0 down
sudo ip link set dev eth0 upReplace eth0 with your interface name (find it in ip -6 addr show). Bringing the interface down and up triggers regeneration of the temporary address. On a NetworkManager system, nmcli connection down <name> && nmcli connection up <name> does the same thing more cleanly and reassigns the connection’s addresses.
After it comes back up, run ip -6 addr show again and you will see a different temporary suffix. The stable address stays the same; only the temporary one rotates.
The catch: temporary addresses break inbound services
There is a good reason servers usually leave this off. A temporary address changes, and anything that needs to reach your machine at a fixed address - a service you host, a firewall rule pinned to your IP, a DNS record - breaks when the address rotates out.
So the rule of thumb:
- Client/desktop/laptop: privacy extensions on, prefer temporary (
2). Your outbound traffic is protected and you are not running inbound services on a fixed IPv6 anyway. - Server: privacy extensions off (or
1), so inbound connections and DNS keep working against a stable, predictable address.
If you enabled privacy extensions on a server and something stopped being reachable, that is the cause - the address it was found at rotated away. Set use_tempaddr back to 0 on that box and it stabilises.
How this fits the rest of the stack
Whatever you decide here, the cost of it eventually shows up as a bill. The RunxBuild hosting calculator is the right place to model that before committing: the compute, the database, the storage, the bandwidth, the worker - each one is a separate line item, and the real cost of a platform is the sum, not the headline number. The RunxBuild dashboard is where the team sees the actual usage once it is running.
Useful related references:
- IPv4 vs IPv6: How They Actually Differ When You Ship Traffic
- How to Check Your IP Address in Ubuntu (And Which One You Actually Want)
- How to Turn Off IPv6 on Linux, Safely, Without Breaking Your Network
- Domains and DNS on RunxBuild
FAQ
What is a temporary IPv6 address?
It is a randomly generated, rotating IPv6 address created by privacy extensions for outbound connections. It replaces the older scheme that derived the address from your MAC address - a permanent, trackable identifier - so your outgoing traffic cannot be trivially linked across sites and sessions. Most desktops and phones enable it by default.
How do I get a new temporary IPv6 address on Linux?
Force regeneration by cycling the interface: sudo ip link set dev eth0 down then ... up (using your interface name from ip -6 addr show). On NetworkManager systems, nmcli connection down <name> && nmcli connection up <name> does the same. A fresh temporary suffix appears while the stable address is unchanged.
How do I enable IPv6 privacy extensions?
Set the sysctl net.ipv6.conf.all.use_tempaddr=2 (and default.use_tempaddr=2) to enable and prefer temporary addresses. Make it permanent in /etc/sysctl.d/. On NetworkManager systems, set the connection’s ipv6.ip6-privacy to 2, which prevents NetworkManager from overriding the sysctl.
What does use_tempaddr 2 mean?
The value 2 enables IPv6 privacy extensions and makes the system prefer the temporary address for outbound connections - the setting you want for actual privacy. A value of 1 generates temporary addresses but still prefers the stable one, and 0 disables the feature entirely.
Should I use temporary IPv6 addresses on a server?
Usually no. A server typically needs a stable, predictable address so inbound connections, DNS records, and firewall rules keep working. Temporary addresses rotate and will break anything pinned to a fixed IP. Enable privacy extensions on clients and laptops; leave them off (use_tempaddr 0) on servers.