From a RIPE-Allocated IPv6
/29 poolIPv6 Subnet Lease
Lease an IPv6 prefix from our own RIPE allocation at any of five sizes, /48 through /32, and start announcing it the same minute payment clears. We carve the block, create the inet6num and a dedicated mnt-by under your organisation, publish the RPKI ROA and delegate reverse DNS. All before your coffee cools.
Starting at
5 €
/ year
for an IPv6
/48, up to /32 at 100 €/yr- Free setup, no activation fee
- Dedicated
mnt-byobject for you - RPKI ROA + route6 included
- Reverse DNS (rDNS) delegation
- Letter of Authorization on request
IPv4 is gone, IPv6 is the answer
Why lease IPv6 now instead of chasing IPv4 on the grey market
RIPE NCC drained its last IPv4 /22 pool in November 2019. What is left for new players is a waiting list that drips out recovered /24 prefixes and a secondary market where per-address pricing has climbed from under one dollar a decade ago to 30-60 USD per address today and keeps rising.
IPv6 is the opposite story. There are enough addresses for every grain of sand on Earth, several times over. Major mobile networks, cloud providers and residential ISPs are already IPv6-enabled, so a significant chunk of real-world internet traffic is native IPv6. Google's own IPv6 adoption metric has been over 40% for two years.
At 5 € per year for a /48 or 12 € per year for a /40 (256 end-site subnets), an IPv6 lease from our LIR is dramatically cheaper than buying a single IPv4 address on the grey market. Dual-stack now, go IPv6-only later.
How big is a /40, really?
Your lease
/40Customer subnets (
/56)65,536End-site subnets (
/48)256LAN subnets (
/64)16,777,216Host addresses per
/641.8 × 10¹⁹A typical IPv6 best practice is to give each residential customer a
/56 and each enterprise site a /48. A single /40 covers a serious ISP-scale footprint before you even think about requesting more.Five sizes, one pool
Pick the IPv6 Size That Fits Your Network
Every tier is carved directly from our RIPE /29 allocation and ships with the same production-grade tooling. Only the room to grow changes between a homelab /48 and an ISP-scale /32.
ASSIGNED PA
IPv6 /48
Single end-site: homelab, startup or one office.
€5/ year
Setup free
Capacity
- 1 ×
/48end-site assignment - 65,536 ×
/64LAN segments - For your own end-site, no further sub-assignment
Included with every tier
- Dedicated
mntnerobject inet6numunder your org- Full RPKI / ROA management
route6object published- Reverse DNS in self-service panel
- LOA on request
ALLOCATED-BY-LIR
IPv6 /44
Multi-site separation: a
/48 per office, tenant or environment.€10/ year
Setup free
Capacity
- 16 ×
/48sub-allocations - Per-site, per-tenant or per-environment isolation
- Sub-assign to your downstream end users
Included with every tier
- Dedicated
mntnerobject inet6numunder your org- Full RPKI / ROA management
route6object published- Reverse DNS in self-service panel
- LOA on request
Most popular
ALLOCATED-BY-LIR
IPv6 /40
Distributed cloud or mature multi-site infrastructure.
€12/ year
Setup free
Capacity
- 256 ×
/48sub-allocations - Dozens of downstream customers, distributed cloud
- Sub-assign
/48or/56to your customers
Included with every tier
- Dedicated
mntnerobject inet6numunder your org- Full RPKI / ROA management
route6object published- Reverse DNS in self-service panel
- LOA on request
ALLOCATED-BY-LIR
IPv6 /36
Regional backbone or multi-tenant platform with years of headroom.
€50/ year
Setup free
Capacity
- 4,096 ×
/48sub-allocations - Hundreds of downstream customers, regional reach
- Sub-assign to ISPs and hosting resellers
Included with every tier
- Dedicated
mntnerobject inet6numunder your org- Full RPKI / ROA management
route6object published- Reverse DNS in self-service panel
- LOA on request
ALLOCATED-BY-LIR
IPv6 /32
Full LIR-scale: hosting platforms, CDNs, downstream ISPs.
€100/ year
Setup free
Capacity
- 65,536 ×
/48sub-allocations - ISP/CDN scale, unlimited downstream layers
- Sub-assign any prefix size
/40to/64
Included with every tier
- Dedicated
mntnerobject inet6numunder your org- Full RPKI / ROA management
route6object published- Reverse DNS in self-service panel
- LOA on request
Interactive preview of the Client Area
The RIPE Management Panel, Click Through Every Tab
Every tab below actually switches, exactly like the real self-service panel. Click ROA / RPKI, Reverse DNS, inet6num, Config Gen, WHOIS or any other tab to see the real interface you get after ordering.
2a10:fa80:aaaa::/40
EXAMPLE-LTD Active
Prefix Length
/40
Maintainer
MNT-EXAMPLE
Route Objects
2
ROAs
3
Reverse DNS
1
Reverse Zone
a.a.a.a.0.4.b.6.b.0.a.2.ip6.arpa
RIPE DB
Route6 Objects
Route6 objects register your prefix in the RIPE routing registry (IRR). BGP peers use this to validate your announcements.
2 / 10 used
| Prefix | Origin AS | Status | Created | Actions |
|---|---|---|---|---|
| 2a10:fa80:aaaa::/40 | AS213123 | Active | 2026-04-08 10:42 | ViewDelete |
| 2a10:fa80:aaaa:1000::/44 | AS213123 | Active | 2026-04-12 15:08 | ViewDelete |
+ Create Route6 Object
Your full allocation or a more-specific prefix
AS number originating this prefix
Create route6
ROA / RPKI Management
Route Origin Authorizations (ROAs) cryptographically validate that your AS is authorised to announce your prefix. Protects against BGP hijacking.
3 / 10 used
| Prefix | Max Length | ASN | Status | Created | Actions |
|---|---|---|---|---|---|
| 2a10:fa80:aaaa::/40 | /48 | AS213123 | Active | 2026-04-08 10:44 | Delete |
| 2a10:fa80:aaaa:1000::/44 | /48 | AS213123 | Active | 2026-04-12 15:10 | Delete |
| 2a10:fa80:aaaa::/40 | /40 | AS65001 | Active | 2026-04-14 09:21 | Delete |
+ Create ROA
Must be within 2a10:fa80:aaaa::/40
Set equal to prefix length for exact match only
Reverse DNS Delegation
Configure reverse DNS (PTR records) by delegating the ip6.arpa zone to your nameservers.
Your reverse zone: a.a.a.a.0.4.b.6.b.0.a.2.ip6.arpa
| Zone | Nameservers | Status | Actions |
|---|---|---|---|
| a.a.a.a.0.4.b.6.b.0.a.2.ip6.arpa | ns1.example.comns2.example.com | Active | EditDelete |
+ Update Reverse DNS Delegation
One nameserver per line. Minimum 2 required.
inet6num Object
View and edit your inet6num object in the RIPE database.
Current RIPE DB Values
| inet6num | 2a10:fa80:aaaa::/40 |
| netname | EXAMPLE-NET |
| descr | Example Ltd. IPv6 allocation |
| country | RO |
| org | ORG-EXML1-RIPE |
| admin-c | JD1234-RIPE |
| tech-c | JD1234-RIPE |
| status | ALLOCATED-BY-LIR |
| mnt-by | MNT-EXAMPLE |
| source | RIPE |
Update Fields
Update inet6numView in RIPE DB →
RIPE Database Objects
All RIPE DB objects associated with your allocation.
| Type | Key | Handle | Status | Actions |
|---|---|---|---|---|
| inet6num | 2a10:fa80:aaaa::/40 | EXAMPLE-NET | Active | ViewRIPE → |
| organisation | ORG-EXML1-RIPE | Example Ltd. | Active | ViewRIPE → |
| mntner | MNT-EXAMPLE | MNT-EXAMPLE | Active | ViewRIPE → |
| role | JD1234-RIPE | J. Doe | Active | ViewRIPE → |
| route6 | 2a10:fa80:aaaa::/40 | AS213123 | Active | ViewRIPE → |
| route6 | 2a10:fa80:aaaa:1000::/44 | AS213123 | Active | ViewRIPE → |
Sub-allocations
Organise your address space by splitting it into smaller blocks. This is local bookkeeping, no changes are made in RIPE.
3 entries
| Subnet | Label | Description | Status | Actions |
|---|---|---|---|---|
| 2a10:fa80:aaaa:0::/48 | Web Servers | Public-facing web cluster | Used | EditDelete |
| 2a10:fa80:aaaa:1::/48 | SMTP / IMAP / MX | Used | EditDelete | |
| 2a10:fa80:aaaa:100::/56 | Staging | Reserved for staging env | Reserved | EditDelete |
+ Add Sub-allocation
Must be within 2a10:fa80:aaaa::/40
Subnet Calculator
Split your allocation into sub-prefixes.
Calculate
Splitting 2a10:fa80:aaaa::/40 produces 256 /48 subnets.
# First 5 of 256 subnets 2a10:fa80:aaaa:0000::/48 → first: 2a10:fa80:aaaa:: last: 2a10:fa80:aaaa:ffff:ffff:ffff:ffff:ffff 2a10:fa80:aaaa:0001::/48 → first: 2a10:fa80:aaaa:1:: last: 2a10:fa80:aaaa:1:ffff:ffff:ffff:ffff:ffff 2a10:fa80:aaaa:0002::/48 → first: 2a10:fa80:aaaa:2:: last: 2a10:fa80:aaaa:2:ffff:ffff:ffff:ffff:ffff 2a10:fa80:aaaa:0003::/48 → first: 2a10:fa80:aaaa:3:: last: 2a10:fa80:aaaa:3:ffff:ffff:ffff:ffff:ffff 2a10:fa80:aaaa:0004::/48 → first: 2a10:fa80:aaaa:4:: last: 2a10:fa80:aaaa:4:ffff:ffff:ffff:ffff:ffff ... 251 more
BGP Config Generator
Generate ready-to-use BGP configuration snippets for your router.
# BIRD 2.x IPv6 BGP to AS6939 router id 213.214.215.216; protocol static { ipv6 { table master6; }; route 2a10:fa80:aaaa::/40 blackhole; } protocol bgp peer_he6 { local as 213123; neighbor 2001:470:1f0a::1 as 6939; ipv6 { import filter { reject; }; export filter { if net = 2a10:fa80:aaaa::/40 then accept; reject; }; }; }
! FRRouting IPv6 BGP router bgp 213123 bgp router-id 213.214.215.216 no bgp default ipv4-unicast neighbor 2001:470:1f0a::1 remote-as 6939 ! address-family ipv6 unicast network 2a10:fa80:aaaa::/40 neighbor 2001:470:1f0a::1 activate neighbor 2001:470:1f0a::1 prefix-list PL-OUT out neighbor 2001:470:1f0a::1 prefix-list PL-IN in exit-address-family ! ipv6 prefix-list PL-OUT seq 5 permit 2a10:fa80:aaaa::/40 ipv6 prefix-list PL-IN seq 5 deny any
# MikroTik RouterOS 7.x /routing bgp template add name=peer-he6 as=213123 router-id=213.214.215.216 \ output.filter-chain=bgp-out input.filter-chain=bgp-in /routing bgp connection add name=he6 template=peer-he6 remote.as=6939 \ remote.address=2001:470:1f0a::1 /routing filter rule add chain=bgp-out rule="if (dst in 2a10:fa80:aaaa::/40) { accept }" add chain=bgp-out rule="reject" add chain=bgp-in rule="reject"
! Cisco IOS / IOS-XE router bgp 213123 bgp router-id 213.214.215.216 no bgp default ipv4-unicast neighbor 2001:470:1f0a::1 remote-as 6939 address-family ipv6 network 2a10:fa80:aaaa::/40 neighbor 2001:470:1f0a::1 activate neighbor 2001:470:1f0a::1 prefix-list PL-OUT out neighbor 2001:470:1f0a::1 prefix-list PL-IN in exit-address-family ! ipv6 prefix-list PL-OUT seq 5 permit 2a10:fa80:aaaa::/40 ipv6 prefix-list PL-IN seq 5 deny any
RPKI Validation Check
Verify that your prefix has valid RPKI / ROA status. Queries the RIPE RPKI validator in real-time.
Check RPKI
Valid
The ROA for 2a10:fa80:aaaa::/40 authorises AS213123 with max-length /48. Global RPKI validators will accept announcements from this AS.
RIPE Validator: Valid
Cloudflare: Valid
NTT: Valid
Last checked: 42 seconds ago
BGP Routing Status
Check if your prefix is visible in the global BGP routing table. Data from RIPE RIS.
Check BGP Status
Visible Globally
Announced by AS213123, seen by 234 / 240 RIPE RIS collectors.
Origin AS: AS213123
Most common path: AS6939 AS213123
Route collectors: 234 / 240 see it
First seen: 14 days ago
Communities: 6939:8100 6939:9002
Last update: 3 minutes ago
Letter of Authorization (LOA)
Generate a PDF letter authorising an AS to announce your prefix. Required by most transit providers and IXPs.
WHOIS Lookup
Search the RIPE database for any object.
Lookup
% Information related to '2a10:fa80:aaaa::/40' inet6num: 2a10:fa80:aaaa::/40 netname: EXAMPLE-NET descr: Example Ltd. IPv6 allocation country: RO org: ORG-EXML1-RIPE admin-c: JD1234-RIPE tech-c: JD1234-RIPE status: ALLOCATED-BY-LIR mnt-by: ro-dreamserver-1-mnt mnt-by: MNT-EXAMPLE created: 2026-04-08T10:41:22Z last-modified: 2026-04-08T10:41:22Z source: RIPE route6: 2a10:fa80:aaaa::/40 origin: AS213123 mnt-by: MNT-EXAMPLE source: RIPE
Activity Log
Last 20 operations performed on this allocation. Older entries are available in the admin panel.
| Date | Action | Object | Result | Details |
|---|---|---|---|---|
| 2026-04-14 09:21 | create_roa | roa 2a10:fa80:aaaa::/40 | ✓ OK | AS65001 /40 |
| 2026-04-12 15:10 | create_roa | roa 2a10:fa80:aaaa:1000::/44 | ✓ OK | AS213123 /48 |
| 2026-04-12 15:08 | create_route6 | route6 2a10:fa80:aaaa:1000::/44 | ✓ OK | origin AS213123 |
| 2026-04-09 11:02 | update_rdns | rdns a.a.a.a.0.4.b.6.b.0.a.2.ip6.arpa | ✓ OK | ns1, ns2.example.com |
| 2026-04-08 10:44 | create_roa | roa 2a10:fa80:aaaa::/40 | ✓ OK | AS213123 /48 |
| 2026-04-08 10:42 | create_route6 | route6 2a10:fa80:aaaa::/40 | ✓ OK | origin AS213123 |
| 2026-04-08 10:41 | provision | inet6num 2a10:fa80:aaaa::/40 | ✓ OK | ALLOCATED-BY-LIR, mnt-by MNT-EXAMPLE |
Showing last 7 entries
Who Leases IPv6 from Our LIR
A /40 covers more than most people think. Here are the most common profiles we provision every month.
Hosting providers
Dedicated-server or VPS providers that run out of their upstream's IPv6 allocation and need independent, RIPE-registered space to assign to end customers. A /40 gives every customer their own /56 with room for 65,000+ customers.
Enterprises & datacenters
Organisations that need portable IPv6 space independent of any transit provider, typically to support multi-homing or avoid renumbering when they change upstreams. Own mnt-by keeps the block yours forever.
VPN, CGNAT & IoT operators
Operators who need clean, dedicated address space separate from their transit provider's pool, often to avoid reputation spillover or to isolate customer traffic into its own routable blocks with proper abuse-c contacts.
The RIPE rules, in plain English
What you can do with leased IPv6, and where
IPv6 is governed by RIPE NCC, the registry that runs IP allocation for Europe, the Middle East and parts of Central Asia. Here is what their policy means for you in practice, no lawyer-speak.
Eligibility
Who can lease IPv6
Almost anyone with a real network to put it on. No revenue threshold, no minimum ASN size, no business plan to defend.
- ✓Companies (SRL, SA, GmbH, Ltd.) and freelancers (PFA)
- ✓NGOs, public bodies, universities
- ✓Individuals running their own AS or home BGP lab
- ✓Hosting, ISP, VPN, CGNAT, IoT, edge operators
RIPE calls you the "End User" or "End Site". The technical use case is the only real gate.
Where you can use it
RIPE service region
RIPE NCC covers over 75 countries: all of Europe, the Middle East and parts of Central Asia. That is where the prefix is meant to live.
- ✓Romania, EU, UK, Switzerland, Norway, Balkans: fully in scope
- ✓Israel, UAE, Turkey, Saudi Arabia, Kazakhstan: in scope
- ⚠PoPs in US/Asia for an EU-based operation: tolerated as long as part of the deployment stays in the RIPE region
- ×Pure North America, Latin America, Asia-Pacific or Africa deployment: go to ARIN, LACNIC, APNIC or AFRINIC instead
Official RIPE service region: ripe.net/about-us/what-we-do/ripe-ncc-service-region/.
Usage rights
Sub-divide for your customers
Your prefix is registered as ALLOCATED-BY-LIR, the friendly status. You can freely sub-divide it.
- ✓Sub-assign
/48to business customers - ✓Sub-assign
/56to residential customers - ✓Single
/64per LAN (smallest legal subnet) - ✓Announce from your own ASN, we publish the RPKI ROA
- ✓Use on bare-metal, VPS, dedicated, colocation, tunnels
Don't do this
Acceptable use limits
Hard lines that trigger blackhole filtering on the affected /48, then full revocation.
- ×Spam, phishing, malware C2, DDoS-for-hire, CSAM
- ×BGP hijacking or announcing prefixes you do not own
- ×Sponsoring another organisation's IPv6 as if you were their LIR (only DreamServer holds the RIPE sponsorship)
- ×Chopping subnets smaller than
/64(breaks SLAAC) - ×Ignoring abuse reports for more than 24h
RIPE Database
Keep contact data fresh
Your prefix is a public record. We maintain the objects, but you keep the data accurate.
- •We create
inet6num+route6+mntner+org+abuse-c - •You notify us in 14 days if company name, address or contact changes
- •Sub-assignments must reflect the actual end-customer, not your own data
- •Reply to
abuse-cmessages within 24 hours
Lease model
How ownership works
Your block is sub-allocated from our 2a10:fa80::/29 RIPE allocation. The relationship is between you and us.
- ✓One annual fee covers LIR work + RIPE NCC overhead + RPKI + rDNS
- ✓Block stays yours as long as the lease is active and rules are respected
- ⚠Stop paying or stop replying = we reclaim the prefix into our pool, you renumber out
- ⚠Leaving us: PA sub-allocations are not portable, you renumber to another provider's block
- •Need portability? Take your own RIPE membership and we sponsor your PI
/64
Single LAN, smallest legal subnet, SLAAC works only on
/64/56
Residential customer, 256 LANs per home
/48
Business end-site, the RIPE default for enterprises
/40 - /32
ISP and hosting reseller tiers, lets you carve thousands of customer blocks
Want the full legal text?
All the above is summarised from official RIPE NCC policy. The complete obligations are mirrored into Section 17 of our Terms and Conditions.
IPv6 Lease FAQ
The most common questions we get about leasing IPv6 from our LIR.
What exactly is an IPv6 /40?
A
/40 is a block of 2&sup8;⁸ IPv6 addresses, which is 16,777,216 /64 subnets, 65,536 /56 customer subnets or 256 /48 end-site subnets. In IPv6 practice the smallest routable unit on a LAN is a /64; the /56 and /48 boundaries are the recommended residential and enterprise customer sizes.Where does the prefix come from?
From our own RIPE NCC allocation of
2a10:fa80::/29. We are an accredited RIPE NCC member operating under AS57050, listed in the public RIPE NCC member directory. Your sub-allocation is registered as ALLOCATED-BY-LIR (not ASSIGNED) in the RIPE Database, which gives you the right to further sub-assign /48 blocks to your own downstream customers.How fast is activation, really?
Instant for card, PayPal and Bitcoin payments (under two minutes from confirmation to credentials delivery). Bank transfers activate the moment funds land in our account, which is usually same-day for SEPA and next-day for SWIFT. There is no human in the loop and no third-party LIR to wait for.
Who is listed as mnt-by on the database object?
You are. We create a dedicated
mntner object under your organisation, configure a strong shared password and store the credentials in your Client Area. You keep cryptographic control over edits, so even if you leave our LIR the maintainer survives the move.Is RPKI included?
Yes. We publish the Route Origin Authorisation through the RIPE NCC hosted RPKI service, signed against the origin ASN you specify at order time. Validators on the global internet accept your announcement and strict route-server filters (MANRS, RIPE route collectors, Cloudflare, Google) let it through.
Can I use the lease under my own ASN?
Yes, that is the most common use case. Provide your ASN at order time and we publish the ROA against it. If you do not have an ASN yet, pair the IPv6 lease with our ASN Registration bundle and we register one for you in about 5-7 business days.
How does reverse DNS work on IPv6?
IPv6 reverse DNS lives under the
ip6.arpa zone, with every hex nibble forming a label. For a /40 that is 10 nibbles of prefix. You can either delegate the whole /40 to your own nameservers, or host the zone on our authoritative DNS for free and manage PTR records through the Client Area.Can I split the /40 into smaller customer blocks?
Yes, freely. The
/40 is yours to sub-allocate as you see fit. You can assign /48 to business customers, /56 to residential customers, /64 to individual LANs, whatever fits your addressing plan. You do not need to notify us or RIPE for internal sub-allocations below the assigned block.What if I need a bigger block later?
Under RIPE policy you can request an expansion once 50% of your
/40 has been documented as assigned. We handle the RIPE paperwork and typically extend your block to /36 or /32 without renumbering. We simply add adjacent space. If you eventually outgrow our allocation, we help you apply for your own RIPE membership.Can I leave and take the prefix with me?
The
/40 itself is assigned from our LIR allocation, so it cannot be transferred to another LIR. However, moving your services to another IPv6 block is straightforward with IPv6's renumbering features (Router Advertisements, DHCPv6-PD) and we assist with any migration. If your intent is to own portable space long-term, ask us about PI (Provider Independent) assignments, which can be transferred.Do you support multi-year contracts or one-time purchases?
IPv6 is leased on an annual basis, starting at 5 €/year for a
/48 up to 100 €/year for a /32, renewed automatically. We do not sell permanent transfers of our LIR-assigned space because RIPE policy ties sub-allocations to the sponsoring LIR. For transferable resources ask us about PI assignments or RIPE membership.Can I peer at DSIX and other IXPs with this block?
Absolutely. Once RPKI is live and route6 is published, IXP route servers accept your announcement. We provide a free port to our own DSIX Internet Exchange (AS58218) for any ASN announcing prefixes from our LIR. For remote IXPs, our LOA gets you onboarded wherever you peer.
Do you handle abuse-c and abuse reports?
The
abuse-c on your inet6num object points to your role object by default, so abuse reports go directly to you. If you prefer, we can list our own NOC as abuse-c and forward reports to you. Useful during the first weeks while you set up your abuse handling process.What is the difference between ALLOCATED and ASSIGNED in my RIPE object?
These are distinct status values in the RIPE Database.
ALLOCATED-BY-LIR means we, as the sponsoring LIR, have allocated the block to your organisation for further distribution: you are allowed to carve it into smaller pieces and sub-assign them to your own downstream customers or services. ASSIGNED (typically ASSIGNED PA at the /48 boundary) is the end-of-chain status meaning the block is used directly by an end user and cannot be re-assigned. Every DreamServer lease is registered as ALLOCATED-BY-LIR, so you always have the freedom to sub-assign further without asking us or RIPE for permission.Does the lease include IPv4?
No. RIPE NCC exhausted its IPv4 free pool in 2019 and we deliberately stay out of the IPv4 grey market, where per-address pricing has climbed 10-30x over the last decade. The only sustainable path for new networks is IPv6, possibly paired with NAT64/DNS64 or an IPv4 proxy tier provided by your upstream.
Can I use the leased IPv6 with AWS, Azure or Google Cloud?
Not directly inside their managed VPCs: cloud providers allocate IPv6 from their own ranges. The lease fits natively when you run bare-metal, dedicated or colocated infrastructure on our side or any datacenter that lets you BGP-announce customer prefixes. You can also extend the block into cloud VMs through IPsec/WireGuard/GRE tunnels, giving hybrid deployments a single consistent IPv6 addressing plan.
How do I confirm my IPv6 setup actually works end-to-end?
After the route is live, the in-panel tools give you three independent checks: RPKI Check shows Valid/Invalid at multiple global validators, BGP Status queries RIPE RIS to count how many route collectors see your announcement, and WHOIS confirms inet6num + route6 are public. Externally, test-ipv6.com, bgp.tools and any looking glass (Hurricane Electric, Cloudflare) are the standard sanity checks.
What firewall basics should I know specifically for IPv6?
Every IPv6 address is public: there is no NAT to hide behind, so default-deny inbound at the edge is mandatory. Always permit ICMPv6 types 1, 2, 3, 4, 128, 129 and 133-137 (they carry Path MTU Discovery and Neighbour Discovery; blocking them breaks connectivity). Filter
fc00::/7 ULA at the internet edge. We ship starter firewall policies for Cisco IOS, Juniper, MikroTik, nftables and pf on request.Can I request a specific prefix or a vanity IPv6 block?
The automation assigns the next free
/40 from our /29 pool by default, but if you have a business reason for a specific prefix (continuity with a previous announcement, a memorable pattern, or internal addressing conventions), open a ticket at order time. Subject to availability we reserve the requested block at no extra charge.How do you handle DDoS attacks targeting my leased IPv6?
Volumetric L3/L4 attacks are handled by our RTBH (Remotely Triggered Black Hole) infrastructure. See the SLA page for detection and trigger SLAs. Customers who also use DreamServer dedicated servers or VPS get RTBH automatically. For customers who announce the lease from their own network but peer with us at DSIX, we can still apply blackhole community tags on the affected
/48 or /128 upstream. Layer 7 application attacks require a WAF or scrubbing tier on your side.Trusted By & Member Of
We are proud members of leading internet infrastructure organizations.
