How to Enable and Configure IPv6 on Your Home Network: ISP Prefixes, Router Settings, and Firewall Rules Explained

IPv6 has been the successor to IPv4 since its standardization in 1998, yet most home networks still run IPv4-only in 2026. ISP adoption has accelerated — Comcast, AT&T, T-Mobile, and Verizon all assign IPv6 prefixes to residential customers — but routers often ship with the feature disabled or set to a non-functional default. Enabling it correctly takes about ten minutes and improves connection performance to any service that supports IPv6 natively, since your traffic travels directly rather than through carrier-grade NAT (CGNAT). This guide covers everything you need: how ISP prefix delegation works, per-brand router configuration, client addressing options, and the firewall rules you must set before going live.

How ISPs Deliver IPv6 to Your Router

Your ISP does not assign your router a single IPv6 address the way it assigns an IPv4 address. Instead, it delegates an entire block of addresses — a prefix — that your router then subdivides and distributes to your home network. This process is called DHCPv6 Prefix Delegation (DHCPv6-PD).

The prefix your ISP delegates is almost always a /56 (256 usable /64 subnets) or a /60 (16 usable /64 subnets), depending on the ISP. Each interface on your home network — your main LAN, a guest network, IoT VLAN, and so on — gets its own /64 subnet carved out of that prefix. A /64 contains more addresses than any home will ever need, so a single /64 per segment is standard practice. If your ISP gateway is doing the prefix delegation while your own router handles WiFi, our guide on bridge mode and double NAT explains how to avoid conflicts between the two.

The prefix itself is not static. Most ISPs renew it periodically, which means your home’s IPv6 addresses change over time. This is by design: IPv6 privacy extensions on client devices randomize the host portion of the address even further, limiting device tracking across sites.

SLAAC vs DHCPv6: How Devices Get Their Addresses

Once your router has its delegated prefix, it needs to hand out addresses to your phones, laptops, and smart home gear. There are two mechanisms:

• SLAAC (Stateless Address Autoconfiguration): The router broadcasts the /64 prefix via Router Advertisements (RAs). Each device independently constructs its own IPv6 address by combining the prefix with a randomly generated host identifier. No server is required. This is the default for most home routers and works well for standard use.
• DHCPv6 (Stateful): A DHCPv6 server on the router assigns specific IPv6 addresses to specific devices and keeps a log. Useful if you need consistent per-device addresses — for a NAS, a printer, or a device you want to allow through the firewall by address. Not all client operating systems request DHCPv6 addresses by default; iOS and Android use SLAAC exclusively.

For most homes, SLAAC is the right choice. Enable DHCPv6 only if you need static address assignments for specific devices.

How to Enable IPv6 on Your Router

TP-Link Routers (Archer and Deco Series)

1. Open tplinkwifi.net or 192.168.0.1 in a browser and log in.
2. Go to Advanced › Network › IPv6 and toggle IPv6 on.
3. Under Internet Connection Type, select Dynamic IP (SLAAC/DHCPv6). This is correct for most cable and fiber ISPs.
4. Expand Advanced Settings and enable Prefix Delegation. Leave the prefix length at the default (usually 56 or 60 — check with your ISP if unsure).
5. Under LAN Settings, set Address Type to SLAAC+RDNSS so devices receive both an address and a DNS server automatically.
6. Click Save. The WAN IPv6 address should populate within 30 seconds.

ASUS Routers (RT and ZenWiFi Series)

1. Log in to router.asus.com or 192.168.1.1.
2. Go to Advanced Settings › IPv6.
3. Set Connection Type to Native. This instructs the router to request a prefix via DHCPv6-PD on the WAN interface.
4. Enable DHCP-PD (Prefix Delegation). ASUS will automatically allocate a /64 from your delegated prefix to the LAN and advertise it via SLAAC.
5. Under LAN Setting, set Auto Configuration Setting to Stateless (SLAAC) for standard setups, or Stateful if you want DHCPv6 address assignments.
6. Click Apply. ASUS routers typically pick up the delegation within one minute.

Netgear Routers (Nighthawk and Orbi Series)

1. Log in to routerlogin.net or 192.168.1.1.
2. Navigate to Advanced › Advanced Setup › IPv6.
3. Select Auto Detect first — Netgear will probe your ISP and select the correct mode (DHCPv6, Auto Config, or PPPoE IPv6) automatically. If Auto Detect fails, select DHCP manually for cable and fiber, or PPPoE for DSL with IPv6.
4. For LAN IP Address Assignment, choose Use RDNSS for SLAAC or Use DHCPv6 Server for stateful addressing.
5. Enable IPv6 Prefix Delegation and click Apply.

Firewall Rules: What You Must Configure Before Going Live

This is where most guides stop short. On IPv4, your router’s NAT acts as an implicit firewall — inbound connections are blocked by default because there is no translation entry. IPv6 has no NAT (each device gets a globally routable address), so inbound connections are blocked only if your router has explicit firewall rules. Most modern home routers add a default “block all unsolicited inbound” rule for IPv6 automatically, but verify it before proceeding. For the broader picture, our guide on how to secure your WiFi network walks through the firewall and access settings that matter most.

Required Default Rules

• Block all unsolicited inbound traffic from WAN to LAN: This should be the default stateful firewall rule. Verify it exists in your router’s firewall settings. On ASUS, it appears as “IPv6 Firewall: Enable” under the IPv6 settings page. On TP-Link, it is enabled automatically when IPv6 is turned on.
• Allow ICMPv6: IPv6 depends heavily on ICMPv6 for neighbor discovery, router advertisements, and path MTU discovery. Blocking ICMPv6 entirely breaks IPv6 connectivity. Allow ICMPv6 types 133–137 (Neighbor Discovery Protocol messages) inbound and outbound.
• Allow established and related connections inbound: Outbound connections initiated from inside your network must be able to receive reply traffic. Most stateful firewalls handle this automatically.

Avoid NAT66

Some routers offer NAT66, which translates Unique Local Addresses (ULA, the fc00::/7 range) to your delegated public prefix. Avoid it unless you have a specific requirement — it reintroduces the same complexity and Application Layer Gateway (ALG) problems that NAT causes on IPv4, and defeats the core benefit of IPv6’s end-to-end addressing.

Verifying Your IPv6 Configuration

After saving settings, confirm IPv6 is working at every layer:

1. Router WAN address: Check your router’s status page for a WAN IPv6 address starting with your ISP’s prefix (typically a 2 or 3 for globally routable addresses).
2. LAN prefix delegation: The LAN summary should show a /64 prefix assigned to the interface — different from the WAN address.
3. Client address: On a connected device, open a terminal and run ipconfig (Windows) or ifconfig / ip a (macOS/Linux). Look for an IPv6 address with your LAN prefix that does not start with fe80 (link-local addresses are not globally routable).
4. End-to-end reachability: Visit test-ipv6.com in a browser. A score of 10/10 confirms that DNS, HTTP, and large-packet IPv6 are all functional.

Once IPv6 is active, run a speed test to confirm your throughput is unchanged or improved. Dual-stack connections — where your network supports both IPv4 and IPv6 — use IPv6 preferentially via the Happy Eyeballs algorithm, falling back to IPv4 only when needed. You should see improved latency to major services like Google, Cloudflare, and Netflix that serve content natively over IPv6. Our guide on changing your DNS server for faster internet covers configuring DNS64 if any of your legacy services require an IPv4-only path.