How to Use IPv6 with IPv4 (AAAA Proxy + 6to4 Guide)

Running IPv6-only infrastructure is becoming increasingly common, especially in cost-sensitive or high-scale environments. However, a large portion of the internet still relies on IPv4.

This creates a challenge: how do you serve IPv6-only servers to IPv4 clients without maintaining dual-stack infrastructure?

The answer is simple in most cases - use a reverse proxy layer like Cloudflare. For more advanced or self-managed setups, 6to4 DNS can also be used as a fallback.

Using Cloudflare to Bridge IPv4 to IPv6

Cloudflare acts as a global reverse proxy that accepts both IPv4 and IPv6 traffic from clients, then connects to your origin server over IPv6.

This allows you to run your server as IPv6-only while still supporting legacy IPv4 users without any additional complexity on your infrastructure.

How It Works

• Client connects to Cloudflare using IPv4 or IPv6
• Cloudflare resolves your domain via AAAA records
• Traffic is proxied to your origin over IPv6
• Your server never needs a public IPv4 address

Configuration Steps

1. Add your domain to Cloudflare
2. Create an AAAA record pointing to your IPv6 server
3. Enable proxy mode (orange cloud)
4. Ensure your origin server accepts IPv6 traffic (port 80/443)
5. Enable SSL mode (Full or Full Strict recommended)

Once configured, Cloudflare automatically handles IPv4 to IPv6 translation at the edge.

Why This Approach Works

• No need to purchase or manage IPv4 addresses
• Global edge network improves latency and reliability
• Built-in DDoS protection and WAF
• Clean separation between edge and origin infrastructure
• Simplifies scaling IPv6-native deployments

Alternative: 6to4 DNS on Debian and Ubuntu

If you prefer not to rely on a third-party proxy, you can use 6to4 techniques to provide limited IPv4 compatibility. This approach is less common today but still useful in controlled environments.

Install Required Tools

sudo apt update
sudo apt install bind9 dnsutils

Example DNS Configuration

zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};

AAAA Record (IPv6)

example.com.    IN    AAAA    2001:db8:abcd::1

In some setups, you can pair this with translation gateways or NAT64/DNS64 services to allow IPv4 clients to resolve and reach IPv6 hosts.

Restart DNS

sudo systemctl restart bind9

Note: Native 6to4 is largely deprecated on the public internet. For production workloads, Cloudflare or similar proxy layers are significantly more reliable.

Best Practices

• Always prioritise IPv6-native infrastructure where possible
• Use Cloudflare or a similar edge provider for compatibility
• Ensure firewall rules allow IPv6 traffic
• Monitor logs to confirm IPv6 origin traffic
• Validate DNS using dig or nslookup