IPv6 Addresses

In this example, Oracle assigns this prefix: 2001:0db8:0123: 7811::/56.

The following diagram illustrates the VCN and includes two subnets: public subnet 1111 and private subnet 1112.

Access to the internet is always determined at the subnet level, not at the VNIC level.

VNIC 1 in Subnet 1111 has a primary private IPv4 address (10.0.1.4) with an optional IPv6 address assigned. VNIC 1 has a secondary private IPv4 address (10.0.1.5), also with an optional public IP address assigned.

Since Subnet 1111 has internet access enabled it can only have an internet-routable IPv6 address, which is 2001:0db8:0123:7811:abcd:ef01:2345:0006.

Subnet 1112 is private, which means the VNICs don't have IPv4 or IPv6 access from the internet. The instance using VNIC 2 can still initiate contact with other hosts on the internet and get responses, but won't get uninitiated requests.

1. Open the navigation menu, click Networking, and then click Virtual cloud networks.
2. Under List Scope, select a compartment that you have permission to work in.The page updates to display only the resources in that compartment. If you're not sure which compartment to use, contact an administrator. For more information, see Access Control.
3. Click Create Virtual Cloud Network.

4. Enter the following:

   • Name: A descriptive name for the VCN. It doesn't have to be unique, and it cannot be changed later in the Console (but you can change it with the API). Avoid entering confidential information.
   • Create in Compartment: Leave as is.
   • CIDR Block: A single, contiguous IPv4 CIDR block for the VCN. For example: 172.16.0.0/16. You cannot change this value later. See Allowed VCN Size and Address Ranges. For reference, here's a CIDR calculator.
   • Enable IPv6 Address Assignment: Oracle can allocate an IPv6 prefix for you, you can select a BYOIPv6 prefix you have already imported, or you can specify a ULA prefix. You cannot later disable IPv6 for the VCN but you can change the IPv6 prefix or prefixes on the VCN as long as there is always at least one IPv6 prefix. If you accept an Oracle-allocated IPv6 prefix, you receive a /56. For BYOIPv6 or ULA, specify any prefix size of /64 or larger. All IPv6-enabled subnets are /64 in size.
   • Use DNS Hostnames in this VCN (supported for IPv4 only): This option is required to assign DNS hostnames to hosts in the VCN, and required if you plan to use the VCN's default DNS feature (called the Internet and VCN Resolver). If you select this option you can specify a DNS Label for the VCN, or you can allow the Console to generate one for you. The dialog box automatically displays the corresponding DNS Domain Name for the VCN (<VCN_DNS_label>.oraclevcn.com). For more information, see DNS in Your Virtual Cloud Network.
   • Tags: Leave as is. You can add tags later. For more information, see Resource Tags.

5. Click Create Virtual Cloud Network.

   The VCN is then created and displayed on the Virtual Cloud Networks page in the compartment you chose.

1. While still viewing the VCN, click Create Subnet.

2. Enter the following:

   • Name: A descriptive name for the subnet (for example, Regional Public Subnet). It doesn't have to be unique, and you can change it later. Avoid entering confidential information.
   • Regional or Availability Domain-specific subnet: Oracle recommends creating only regional subnets, which means that the subnet can contain resources in any of the region's availability domains. If you instead choose Availability Domain-Specific, you must also specify an availability domain. This choice means that any instances or other resources later created in this subnet must also be in that availability domain.
   • CIDR Block: A single, contiguous IPv4 CIDR block for the subnet (for example, 172.16.0.0/24). The address block must be within the VCN's IPv4 CIDR block and not overlap any other subnets. You cannot change this value later. See Allowed VCN Size and Address Ranges. For reference, here's a CIDR calculator.
   • Enable IPv6 Address Assignment: You can add and remove prefixes to an IPv6-enabled subnet. However, at least one IPv6 prefix must always remain after IPv6 has been enabled. An IPv6 enabled subnet cannot become an IPv4-only subnet. The subnet can only have one IPv6 prefix. All IPv6 enabled subnets are always /64 in size. If you previously assigned several IPv6 prefixes to the VCN that contains this subnet, you can choose which prefix you assign to the subnet.
     • If you have an Oracle-allocated prefix assigned to the VCN, select the checkbox and enter two hexadecimal characters (00-FF).
     • If you assigned a BYOIPv6 or ULA prefix in the VCN, select it and specify hex characters to assign a /64 to the subnet.
     For more information about the IPv6 address format, see Overview of IPv6 Addresses.
   • Route Table: Select the default route table.
   • Private or public subnet: Select Public Subnet, which means instances in the subnet can optionally have public IPv4 addresses. Internet communication using IPv6 is allowed when GUA IPv6 addresses are assigned to resources hosted in a public subnet. For more information, see Access to the Internet.
   • Use DNS Hostnames in this Subnet (supported for IPv4 only): This option is available only if a DNS label was provided for the VCN when it was created. The option is required for assignment of DNS hostnames to hosts in the subnet, and also when you plan to use the VCN's default DNS feature (called the Internet and VCN Resolver). If you select the checkbox, you can specify a DNS label for the subnet, or let the Console generate one for you. The dialog box automatically displays the corresponding DNS domain name for the subnet as an FQDN. For more information, see DNS in Your Virtual Cloud Network.
   • DHCP Options: Select the default set of DHCP options.
   • Security Lists: Select the default security list.
   • Tags: Leave as is. You can add tags later if you want. For more information, see Resource Tags.

3. Click Create Subnet.

   The subnet is then created and displayed on the Subnets page.

1. Under Resources, click Internet Gateways.
2. Click Create Internet Gateway.

3. Enter the following:

   • Name: A descriptive name for the internet gateway. It doesn't have to be unique, and it cannot be changed later in the Console (but you can change it with the API). Avoid entering confidential information.
   • Create in Compartment: Leave as is.
   • Tags: Leave as is. You can add tags later. For more information, see Resource Tags.

4. Click Create Internet Gateway.

   Your internet gateway is created and displayed on the Internet Gateways page. The internet gateway is already enabled, but you must add route rules that allow IPv4 and IPv6 traffic.

The default route table starts out with no rules. Here you add rules that route all IPv4 and IPv6 traffic destined for addresses outside the VCN to the internet gateway. The existence of these rules also enables inbound connections to come from the internet to the subnet, through the internet gateway. You use security rules to control the types of traffic that are allowed in and out of the instances in the subnet (see the next task).

No route rule is required to route traffic within the VCN.

1. Under Resources, click Route Tables.
2. Click the default route table to view its details.
3. Click Add Route Rules.

4. Enter the following:

   • Target Type: Internet Gateway
   • Destination CIDR block: 0.0.0.0/0 (which means that all IPv4 non-intra-VCN traffic that is not already covered by other rules in the route table goes to the target specified in this rule).
   • Compartment: The compartment where the internet gateway is located.
   • Target: The internet gateway you created.
   • Description: An optional description of the rule.
5. Click + Additional Route Rule.

6. Enter the following:

   • Target Type: Internet Gateway
   • Destination CIDR block: ::/0 (for the IPv6 traffic).
   • Compartment: The compartment where the internet gateway is located.
   • Target: The internet gateway you created.
   • Description: An optional description of the rule.
7. Click Add Route Rules.

The default route table now has two rules for the internet gateway, one for IPv4 traffic and one for IPv6 traffic. Because the subnet was set up to use the default route table, the resources in the subnet can now use the internet gateway. The next step is to specify the types of traffic you want to allow in and out of the instances you later create in the subnet.

Earlier you set up the subnet to use the VCN's default security list. This list already includes basic rules that allow essential IPv4 and IPv6 traffic. In this task, you add any additional security rules that allow the types of connections that the instances in the VCN need.

For example: in a public subnet with an internet gateway, the instances you create might need to receive inbound HTTPS connections from the internet (if they are web servers). Here's how to add another rule to the default security list to enable that traffic:

1. Under Resources, click Security Lists.
2. Click the default security list to view its details. By default, you land on the Ingress Rules page.
3. Click Add Ingress Rule.

4. To enable inbound connections for HTTPS (TCP port 443), enter the following:

   • Stateless: Unselected (this is a stateful rule)
   • Source Type: CIDR
   • Source CIDR: 0.0.0.0/0 (or ::/0 if you want to enable IPv6 traffic with this rule)
   • IP Protocol: TCP
   • Source Port Range: All
   • Destination Port Range: 443
   • Description: An optional description of the rule.
5. Click Add Ingress Rule.

For a production VCN, you typically set up one or more custom security lists for each subnet. If you like, you can edit the subnet to use different security lists. If you choose not to use the default security list, do so only after carefully assessing which of its default rules you want to duplicate in your custom security list. For example: the default ICMP rules in the default security list are important for receiving connectivity messages for IPv4.

Your next step is to create an instance in the subnet. When you create the instance, you choose the availability domain , which VCN and subnet to use, and several other characteristics.

Each instance automatically gets a private IPv4 address. When you create an instance in a public subnet, you choose whether the instance gets a public IPv4 address. A public IPv4 address is NOT required for globally routable IPv6 traffic. But if you want to connect to the instance from an IPv4 host, you must give the instance a public IP address, or else you can't access them through the internet gateway. The default (for a public subnet) is for the instance to get a public IP address.

If the instance's VNIC is associated with a VCN and subnet that support IPv6 addressing, you have the choice of creating a compute instance with IPv6 addresses assigned at instance launch or assigning IPv6 addresses at a later date.

For more information and instructions, see Launching an Instance.

1. While viewing the instance you created in the previous step, click Attached VNICs.
2. Click the name of the primary VNIC from the list of attached VNICs.
3. Under Resources, click IPv6 Addresses.
4. Click Assign IPv6 Address.

5. Enter the following:

   • Prefix: Select an IPv6 prefix from which the IPv6 address is automatically assigned (the VNIC's subnet must already be enabled to use IPv6 and have one or more IPv6 prefixes assigned). Available choices depend on what you choose in IPv6 address assignment:
     • Automatically assign IPv6 addresses from prefix: Choose this option to let the console select an available IPv6 address from an IPv6 prefix assigned to this subnet. A subnet can have more than one IPv6 prefix, and the prefixes can be one of three types: ULA, BYOIP, or Oracle-allocated.
     • Manually assign IPv6 addresses from prefix: Choose this option to select a specific address from an IPv6 prefix assigned to this subnet. Example: 0000:0000:1a1a:1a2b. This option is only available for IPv6-enabled subnets.
     • Unassign if already assigned to another VNIC: (Only available if you select Manually assign IPv6 addresses from prefix:) Leave this checkbox as is (cleared). Only use this option to force reassignment of an IPv6 address that is already assigned to another VNIC in the subnet.

     If you click + Another subnet prefix you can assign additional IPv6 addresses to the instance VNIC. You can assign one and only one IPv6 address to the VNIC from each IPv6 prefix (there can be several IPv6 prefixes assigned to a subnet). If this VNIC is being attached to an existing instance after its launch, keep in mind that your instance OS needs specific configuration to use IPv6 addressing.

   • Tags: Leave as is. You can add tags later. For more information, see Resource Tags.

6. Click Assign.

   The IPv6 is created and then displayed on the IPv6 Addresses page for the VNIC.

You must configure the instance's OS to use the IPv6. For more information, see Configuring an Instance OS to use IPv6.

Assign the IPv6 address dynamically when using Oracle Linux 8. Enabling IPv6 during the compute create is not supported, so you might not see the IPv6 address immediately after the instance is launched. After the compute instance is up, you can wait for the next DHCPv6 cycle to get the IPv6 address, or you can use the DHCPv6 client service to manually cycle DHCP and update with the newly added IPv6 address. To use the DHCPv6 client, enter:

sudo dhclient -6 ens3

sudo firewall-cmd --add-service=dhcpv6-client 

See the instructions in Task 1: Create the IPv6-enabled VCN.

Summary: Creating an IPv6-enabled subnet is similar to creating an IPv4 subnet. The difference is that you must select which VCN IPv6 prefix you want to assign a /64 from and specify characters accordingly. If selecting an Oracle-allocated prefix, you can provide 8 bits for the subnet's portion of the IPv6 prefix. See Overview of IPv6 Addresses.

For general instructions, see Task 2: Create a regional IPv6-enabled public subnet. If you want a private subnet, select the radio button for Private Subnet when creating the subnet.

The process for adding an IPv6 address to a VNIC is similar to adding a secondary private IPv4 address. You can specify the particular IPv6 address to use or let Oracle choose it from the subnet. For more information, see Overview of IPv6 Addresses. After assigning the IPv6 to the VNIC, you must configure the OS to use the IPv6.

1. Assign the IPv6. For general instructions, see Task 7: Add an IPv6 address to the instance.
2. Configure the OS to use the IPv6 address. For more information, see Configuring an Instance OS to use IPv6.

The process is similar to moving a secondary private IPv4 address from one VNIC to another (let's call them the original VNIC and the new VNIC). You assign the IPv6 to the new VNIC, specify the IPv6 address, and select Unassign if already assigned to another VNIC. Oracle automatically unassigns it from original VNIC and assigns it to the new VNIC.

1. Confirm you're viewing the compartment that contains the instance you're interested in.
2. Open the navigation menu and click Compute. Under Compute, click Instances.
3. Click the instance to view its details.

4. Under Resources, click Attached VNICs.

   The primary VNIC and any secondary VNICs attached to the instance are displayed.

5. Click the VNIC you're interested in.
6. Under Resources, click IPv6 Addresses.
7. Click Assign Private IP Address.

8. Enter the following:

   • IPv6 Address: The IPv6 address that you want to move.
   • Unassign if already assigned to another VNIC: Select this checkbox to move the IPv6 address from the currently assigned VNIC.
   • Tags: If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you're not sure whether to apply tags, skip this option or ask an administrator. You can apply tags later.
9. Click Assign.

The IP address is moved from the original VNIC to the new VNIC.

1. Confirm you're viewing the compartment that contains the instance you're interested in.
2. Open the navigation menu and click Compute. Under Compute, click Instances.
3. Click the instance to view its details.

4. Under Resources, click Attached VNICs.

   The primary VNIC and any secondary VNICs attached to the instance are displayed.

5. Click the VNIC you're interested in.
6. Under Resources, click IPv6 Addresses.
7. For the IPv6 you want to delete, click the Actions menu (), and then click Delete IPv6.
8. Confirm when prompted.

The IPv6 address is returned to the pool of available addresses in the subnet.