Should we use ULA internally and NAT66 at the edge, the way we use RFC 1918 and NAT today?
Show the answer
Say this first
Usually no. The default IPv6 design is global addresses everywhere, with a stateful firewall at the edge
for protection. ULA (fd00::/8 plus a random 40-bit global ID, RFC 4193) is useful for networks that never
reach the internet, or alongside global addresses for stable internal names. NAT66 is not a standard;
NPTv6 (RFC 6296) is a stateless prefix swap and only experimental. And there is a trap: hosts' default
address selection prefers IPv4 over ULA, so a ULA-only network quietly keeps using IPv4.
Go deeper
Why people ask
They want what RFC 1918 gave them: addresses that do not change when they change ISP, and a feeling of being hidden.
Better answers to the real needs
| Need | IPv6 answer |
|---|---|
| Stable addressing across ISPs | get provider-independent space from your RIR and run BGP, or use PA space and plan for renumbering |
| Hide internal hosts | stateful firewall, default deny inbound |
| Isolated networks (OT, labs) | ULA alone is fine |
| Stable internal service addresses | ULA alongside GUA, with care |
The address selection trap
RFC 6724's default policy table gives fc00::/7 a precedence of 3 and IPv4 (::ffff:0:0/96) 35. If a name
has both an A record and a ULA AAAA record, hosts try IPv4 first. For internet destinations, a host with only
a ULA source sees a label mismatch with the global destination and also prefers IPv4. So a ULA plus NAT66
design can be "deployed" and carry almost no traffic.
If you do use ULA
- Generate the 40-bit global ID randomly.
fd00::/48is what everyone types and will collide in a merger. - Never advertise it to the internet, and filter
fc00::/7at the edge in both directions. - Expect to tune the policy table (
/etc/gai.confon Linux,netsh interface ipv6 show prefixpolicieson Windows) if you need hosts to prefer it.
They will ask next
What is the difference between NAT66 and NPTv6?
NPTv6 maps one prefix to another of the same length, 1:1 and stateless, adjusting bits so checksums stay valid. NAT66 usually means stateful many-to-one translation with ports, which IPv6 was meant to make unnecessary and which no RFC standardizes.
How unlikely is a ULA collision?
With a truly random 40-bit global ID, two organizations colliding is around one in a trillion. With
fd00::/48it is certain.
Traps
- Saying NAT provides security. The firewall does.
- Picking a non-random ULA prefix.