IPv6 Subnetting and Address Planning

The short answer

An IPv6 network is planned in prefix lengths, the same idea as IPv4 CIDR, but the sizes are so large that nobody counts hosts. Every ordinary subnet is a /64: 64 bits of network prefix and 64 bits of interface identifier. A site usually receives a /48 (or a /56 for a home), and the bits between the site prefix and /64 are the subnet ID you number your networks with. A /48 holds 65,536 /64 subnets.

Plan on 4-bit boundaries.

Each hex digit of an IPv6 address is 4 bits, a nibble. Prefixes that are multiples of 4, such as /48, /52, /56 and /60, line up with whole hex digits, so subnets are easy to read and reverse DNS can be delegated cleanly.

How an IPv6 address divides

An IPv6 address is 128 bits written as eight 16-bit groups in hex. For a typical site the address 2001:db8:abcd:12::1 breaks down like this:

Bits	Part	In the example
0–47	Global routing prefix, assigned by the provider or registry	2001:db8:abcd
48–63	Subnet ID, chosen by the site	0012
64–127	Interface identifier, one per host interface	0000:0000:0000:0001

RFC 4291 fixes the interface identifier at 64 bits for normal unicast addresses, and stateless address autoconfiguration (SLAAC, RFC 4862) depends on it. That is why a LAN that should work with every device is a /64, whether it has three hosts or three thousand. Paste 2001:db8:abcd:12::1/64 into the Subnet Calculator to see the 64 network and 64 host bits drawn out.

Common prefix sizes

Prefix	/64 subnets inside	Typical use
/32	4,294,967,296	Minimum allocation to an ISP or large network from a regional Internet registry
/48	65,536	One business site or organization; the smallest prefix widely accepted in global routing
/56	256	A home or small office connection
/60	16	Some residential ISPs; tight for a home with several networks
/64	1	One LAN, VLAN or Wi-Fi network
/127	—	A point-to-point link between two routers (RFC 6164)
/128	—	A single address, such as a router loopback

RIPE’s best current practice for end sites, RIPE-690, recommends a /48 for business customers and at least a /56 for residential customers, and that the prefix stays the same over time so customers don’t have to renumber.

Building an address plan

With a /48 you have 16 bits of subnet ID, the fourth group of the address. Instead of numbering subnets 1, 2, 3, give each hex digit a meaning, so anyone can read a subnet’s purpose from its address. One common layout:

Hex digit	Meaning	Example
1st	Location (16 sites or buildings)	2 = second building
2nd	Purpose (users, servers, voice, management…)	1 = servers
3rd and 4th	Network number (up to 256 per purpose)	0a = tenth server network

In that plan 2001:db8:abcd:210a::/64 is server network 10 in building 2, and the whole building is the /52 2001:db8:abcd:2000::/52, which a single firewall rule or route can match. Open 2001:db8:abcd::/48 in the Subnet Calculator and split it to /52 to see the 16 building blocks.

A few habits keep plans healthy:

Leave room. Use a nibble per level even when you only need a few values today; IPv6 space is cheap and renumbering is not.
Keep the plan the same across sites. If the purpose digit means the same thing everywhere, security rules can be written once.
Reserve blocks for infrastructure. Put /127 links and /128 loopbacks in one dedicated /64, carved up as needed, instead of using a whole /64 per link.
Don’t number hosts by hand. Let SLAAC or DHCPv6 assign interface identifiers, and give fixed addresses only to servers and network devices.

Private IPv6 and documentation prefixes

IPv6 has no direct equivalent of the RFC 1918 ranges used with NAT. The closest thing is the Unique Local Address block fc00::/7 from RFC 4193; in practice sites use fd00::/8 followed by a randomly generated 40-bit Global ID, which gives a /48 that is very unlikely to clash with another organization’s if networks ever merge. ULAs are useful for internal services, but most networks also use global addresses so hosts can reach the Internet without translation.

Examples should use the documentation prefixes 2001:db8::/32 (RFC 3849) and 3fff::/20 (RFC 9637), which are never routed. Every IPv6 example on this site uses them.

Reverse DNS for IPv6

Reverse lookups for IPv6 live under ip6.arpa, with one label per hex digit in reverse order (RFC 3596). Because each label is a nibble, a prefix on a 4-bit boundary maps to exactly one reverse zone: the /48 2001:db8:abcd::/48 is the zone d.c.b.a.8.b.d.0.1.0.0.2.ip6.arpa. A prefix that is not on a nibble boundary, such as a /50, has to be published as several zones. The Subnet Calculator shows the zone for any block, and Reverse DNS and PTR Records covers how PTR records are delegated.

FAQ

Why is every IPv6 subnet a /64?

RFC 4291 fixes the interface identifier of normal unicast addresses at 64 bits, and SLAAC, the way most devices configure themselves, needs it. A longer prefix such as /80 breaks SLAAC, so hosts there need static addresses or DHCPv6, and Android does not support DHCPv6 address assignment.

How many /64 subnets are in a /48?

65,536. The 16 bits between /48 and /64 each double the count, and 2 to the 16th is 65,536. A /56 holds 256 /64s and a /60 holds 16.

Should I use a /127 or a /64 on router links?

RFC 6164 recommends /127 on point-to-point links between routers, which avoids neighbor discovery exhaustion attacks against the unused space of a /64. Many operators still reserve a full /64 per link in their plan and configure only the /127 out of it.

Do I need NAT with IPv6?

No. IPv6 has enough space for every device to have a global address, so translation is not needed to save addresses. A stateful firewall that blocks unsolicited inbound connections gives the protection people often credit NAT for.

The short answer

How an IPv6 address divides

Common prefix sizes

Building an address plan

Private IPv6 and documentation prefixes

Reverse DNS for IPv6

FAQ

Sources and further reading

Related support articles