IPv6 is on. Is your firewall watching it?

Many networks run IPv6 without anyone deciding to. If the firewall rules only cover IPv4, devices may be reachable directly.

5 May 2026 · 1 min read

Most ISPs, cloud providers and operating systems turn IPv6 on by default now. In many offices nobody chose it. It just appeared. The problem is when the firewall rules, monitoring and documentation only cover IPv4.

I’ve seen servers that were carefully closed on IPv4 and wide open on IPv6, because the provider gave them a public IPv6 address and nobody wrote rules for it.

Check whether your network and servers have IPv6 addresses: ip -6 addr on Linux, ipconfig on Windows.
Make sure every firewall rule set has an IPv6 version, with the same default deny for inbound traffic.
Scan your public IPv6 addresses from outside, the same way you scan IPv4.
Include IPv6 in logs and alerts.

Turning IPv6 off is rarely the answer anymore. Treating it as a first-class network is.