Exploring the roots and future of Internet Relay Chat

IPv6 on IRC: Migration Guide for Network Operators

October 25, 2024 — by Marco Pellegrini

IPv6 has been "coming soon" for roughly twenty-five years. But in 2026, it's genuinely here — many ISPs assign IPv6 addresses by default, mobile networks are predominantly IPv6, and some users have IPv6 connectivity only (with NAT64 for IPv4 access). If your IRC network doesn't support IPv6, you're excluding a growing portion of the internet.

Why IPv6 on IRC?

Beyond basic reachability, IPv6 has specific advantages for IRC:

  • No CGNAT: IPv6 addresses are plentiful enough that every user gets a real, routable address. No more shared IPs behind carrier-grade NAT, which makes per-IP bans and connection limits more meaningful.
  • DCC potential: With real routable addresses, DCC connections become feasible again — no port forwarding needed.
  • Better identity: A user's /64 subnet can serve as a more stable identifier than an IPv4 address that might be shared with hundreds of other users behind CGNAT.

The downsides are real too: IPv6 addresses are long and ugly (not great for hostmasks), a single user can have millions of addresses within their /64 allocation (complicating bans), and the transition period means running both protocols simultaneously.

Dual-Stack Configuration

The standard approach is dual-stack — listen on both IPv4 and IPv6 simultaneously.

UnrealIRCd:

# Listen on all IPv4 addresses:
listen {
    ip *;
    port 6697;
    options { tls; };
};

# Listen on all IPv6 addresses:
listen {
    ip "::";
    port 6697;
    options { tls; };
};

# Or listen on a specific IPv6 address:
listen {
    ip "2001:db8::1";
    port 6697;
    options { tls; };
};

InspIRCd:

<bind address="" port="6697" type="clients" ssl="gnutls">
<!-- Empty address = listen on all IPv4 and IPv6 -->

<!-- Or specific: -->
<bind address="2001:db8::1" port="6697" type="clients" ssl="gnutls">

Verify your server is listening on IPv6:

ss -tlnp | grep 6697
# Should show both 0.0.0.0:6697 and [::]:6697

DNS Setup for IPv6

Your DNS needs both A (IPv4) and AAAA (IPv6) records:

irc.example.com.    IN    A       203.0.113.10
irc.example.com.    IN    AAAA    2001:db8::1

Consider also adding specific round-robin hostnames if you have multiple servers:

# IPv4-only access:
irc4.example.com.   IN    A       203.0.113.10

# IPv6-only access:
irc6.example.com.   IN    AAAA    2001:db8::1

# Dual-stack (both records):
irc.example.com.    IN    A       203.0.113.10
irc.example.com.    IN    AAAA    2001:db8::1

This gives users the option to force a specific protocol if they're having connectivity issues — connecting to irc6.example.com guarantees an IPv6 connection.

IPv6 Cloaking

IPv6 cloaking requires some thought. IPv4 addresses have four octets, and cloaking typically hashes each separately. IPv6 addresses have eight groups of four hex digits — cloaking them at the same granularity produces extremely long cloaked hostnames.

Most IRC servers handle this by cloaking at the /64 boundary — the first 64 bits (the network prefix) are hashed, and the last 64 bits (the host part) are discarded entirely. This is reasonable because a typical residential IPv6 allocation is a /64, so all addresses from the same user share the same prefix.

UnrealIRCd 6 handles this automatically with its default cloaking module. InspIRCd's cloaking module also has IPv6-aware cloaking. Check that the cloaked hostnames for IPv6 users look reasonable — not excessively long and not so short that they lose meaningful information.

Banning and IPv6

This is where IPv6 gets tricky. A single user typically has a /64 allocation, which means they have 2^64 (about 18 quintillion) possible addresses. Banning a single IPv6 address is useless — the user changes their host part and reconnects.

Best practices for IPv6 bans:

  • Ban at /64: For residential users, banning the /64 subnet is equivalent to banning their household. *!*@2001:db8:1234:5678:*
  • Ban at /48: Some ISPs assign /48 blocks to customers. If a /64 ban isn't sufficient, escalate to /48.
  • Use account-based bans: With services (Anope/Atheme), ban by registered account name rather than by IP. This works regardless of IPv4/IPv6.
  • Use cloaked host bans: Ban the cloaked hostname, which is based on the /64 prefix. This automatically covers all addresses in the same allocation.

The ircd's ban matching needs to understand CIDR notation for IPv6. Both UnrealIRCd and InspIRCd support this in modern versions.

Services and IPv6

Anope and Atheme both handle IPv6 addresses in their databases and access lists. Key considerations:

  • Access lists: When users add hostmasks to their NickServ access list, educate them about using /64-based wildcards instead of specific IPv6 addresses.
  • Connection limits: Per-IP limits need adjustment for IPv6. Consider per-/64 limits instead of per-address limits.
  • Session limits: Similarly, session limits should be per-/64, not per-address.

Testing Your Setup

After enabling IPv6, test from both protocol versions:

# Test IPv4 connection:
openssl s_client -connect irc.example.com:6697 -4

# Test IPv6 connection:
openssl s_client -connect irc.example.com:6697 -6

# Verify from IRC (as a connected user):
/WHOIS yournick
# Check that the displayed hostname shows an IPv6-based cloak

Also verify that server-to-server links work over IPv6 if your server links use IPv6 addresses. A link that works over IPv4 but fails over IPv6 indicates firewall or routing issues on the IPv6 path.

IPv6 on IRC isn't glamorous, but it's necessary infrastructure work. The transition is less painful than most people expect — a few hours of configuration and testing, and your network is ready for the next generation of internet addressing. The sooner you do it, the fewer support requests you'll get from users who can't connect because their ISP has gone IPv6-only.

Frequently Asked Questions

Do I need to drop IPv4 support?

No. Dual-stack is the standard approach — support both protocols simultaneously. There's no reason to drop IPv4 support until essentially all of your users have IPv6 connectivity, which is still years away.

My IPv6 address keeps changing — how do I stay identified?

Use SASL authentication (preferably with CertFP) instead of hostmask-based identification. SASL authenticates you before your IP is visible, so changing addresses doesn't matter. Alternatively, add your /64 prefix as a wildcard in your NickServ access list.

How do I get IPv6 if my ISP doesn't provide it?

Tunnel brokers like Hurricane Electric (tunnelbroker.net) provide free IPv6 tunnels. On a VPS, most hosting providers offer IPv6 by default. For home users, a tunnel broker is the easiest option until your ISP catches up.

Does IPv6 affect IRC performance?

Not meaningfully. IPv6 packets have a slightly larger header than IPv4 (40 bytes vs 20 bytes), but this has no practical impact on IRC traffic. Connection establishment might be marginally slower if the client tries IPv6 first and falls back to IPv4 on timeout, but this is a client behavior issue, not a server issue.

FAQ

Do I need IPv6 on my IRC server?

You should offer it. Many users are on IPv6-only or dual-stack connections. Some networks require IPv6 support for linking. It also increases the IP address space available for vhosts and bans.

How do I enable IPv6 in UnrealIRCd?

Add a listen block with an IPv6 address (or ::) in unrealircd.conf. Ensure your OS and firewall allow IPv6 traffic on the IRC ports. Most modern IRCds handle IPv6 natively.

Does IPv6 cause problems with bans?

IPv6 bans need wider ranges than IPv4. A single user might have a /64 or even /48 prefix. IRCd ban matching needs to support CIDR notation for IPv6 to be effective.