Understanding and configuring Cloudflare’s IPv6 support
IPv6 support overview
Cloudflare provides free IPv6 support to all domains without requiring additional configuration or hardware.
If your origin web server is not compatible with IPv6, Cloudflare allows toggling IPv6 Compatibility to Off for domains on Enterprise plans.
Alternatively, if clients connect to your Cloudflare-proxied domain via IPv6 but the origin web server uses older software that only understands IPv4 formatted IP addresses, use Cloudflare’s Pseudo IPv4 feature mentioned below.
Configure IPv6 compatibility
If your hosting provider supports IPv6 for your origin web server, Cloudflare’s IPv6 Compatibility allows you to route IPv6 connections through Cloudflare’s global network when proxying AAAA DNS records. When both IPv4 and IPv6 connections are available, Cloudflare prefers IPv4.
Domains on Enterprise plans can toggle IPv6 compatibility within the Cloudflare dashboard:
- Login to your Cloudflare account.
- Select the appropriate domain.
- Click the Network app.
- Toggle IPv6 Compatibility Off or On.
Note that even when IPv6 is disabled, domains receive IPv6 traffic via the Tor network. To completely disable all IPv6 traffic, you can:
- Disable Onion Routing via the Network tab of the Cloudflare dashboard. Read Understanding Cloudflare Tor support and Onion Routing.
- Use a firewall rule to block 0:0:0:0:0:0:0:0/0 using the filter
ip.src in {::/0}. Learn how to create firewall rules in Cloudflare.
Enable Pseudo IPv4
Some older origin server analytics and fraud detection software expect IP addresses in an IPv4 format and do not support IPv6 addresses.
To support migrating to IPv6, Cloudflare’s Pseudo IPv4 provides an IPv6 to IPv4 translation service for all Cloudflare domains.
Pseudo IPv4 uses the Class E IPv4 address space to provide as many unique IPv4 addresses corresponding to IPv6 addresses as possible.
- Example Class E IPv4 address:
240.16.0.1 - Example IPv6 address:
2400:cb00:f00d:dead:beef:1111:2222:3333
The three options available for configuring Pseudo IPv4 are:
- Off - This is the default value.
- Add Header - Cloudflare automatically adds the
Cf-Pseudo-IPv4header with a Class E IPv4 address hashed from the original IPv6 address. - Overwrite Headers - Cloudflare overwrites the existing
Cf-Connecting-IPandX-Forwarded-Forheaders with a pseudo IPv4 address while preserving the real IPv6 address in aCf-Connecting-IPv6header.
Troubleshoot an IPv6 network issue
Provide the following information to Cloudflare Support if you experience issues with IPv6 connectivity:
- A traceroute that demonstrates the IPv6 connection issues,
- the Cloudflare data center serving your request when the IPv6 issues occur, and
- confirmation of whether disabling IPv6 Compatibility resolves the issue.