Understanding and configuring Cloudflare's IPv6 support

Learn how Cloudflare supports IPv6 traffic and the features Cloudflare recommends if your origin web server or application software does not support IPv6 traffic.


IPv6 support overview

Cloudflare provides free IPv6 support to all domains without requiring additional configuration or hardware.

If your origin web server is not compatible with IPv6, Cloudflare allows toggling IPv6 Compatibility to Off.

Alternatively, if clients connect to your Cloudflare-proxied domain via IPv6 but the origin web server uses older software that only understands IPv4 formatted IP addresses, use Cloudflare’s Pseudo IPv4 feature mentioned below.


Configure IPv6 compatibility

If your hosting provider supports IPv6 for your origin web server, Cloudflare’s IPv6 Compatibility allows you to route IPv6 connections through Cloudflare's global network when proxying AAAA DNS records.

Domains on Enterprise plans can toggle IPv6 compatibility within the Cloudflare dashboard:

  1. Login to your Cloudflare account.
  2. Select the appropriate domain.
  3. Click the Network app.
  4. Toggle IPv6 Compatibility Off or On.

Customers with domains on the Free, Pro, and Business plans must update IPv6 Compatibility via the Cloudflare API.

Note that even when IPv6 is disabled, domains receive IPv6 traffic via the Tor network. To completely disable all IPv6 traffic, you can:


Enable Pseudo IPv4

Some older origin server analytics and fraud detection software expect IP addresses in an IPv4 format and do not support IPv6 addresses.

To support migrating to IPv6, Cloudflare's Pseudo IPv4 provides an IPv6 to IPv4 translation service for all Cloudflare domains.

Pseudo IPv4 uses the Class E IPv4 address space to provide as many unique IPv4 addresses corresponding to IPv6 addresses as possible.

  • Example Class E IPv4 address: 240.16.0.1
  • Example IPv6 address: 2400:cb00:f00d:dead:beef:1111:2222:3333

Class E IPv4 addresses are designated as experimental and are not used for production Internet traffic.

The three options available for configuring Pseudo IPv4 are:

  • Off - This is the default value.
  • Add Header - Cloudflare automatically adds the Cf-Pseudo-IPv4 header with a Class E IPv4 address hashed from the original IPv6 address.
  • Overwrite Headers - Cloudflare overwrites the existing Cf-Connecting-IP and X-Forwarded-For headers with a pseudo IPv4 address while preserving the real IPv6 address in a Cf-Connecting-IPv6 header.

When using Overwrite Headers, no software changes are necessary in your origin web server.


Troubleshoot an IPv6 network issue

Provide the following information to Cloudflare Support if you experience issues with IPv6 connectivity:


Related resources

Not finding what you need?

95% of questions can be answered using the search tool. This is the quickest way to get a response.

Powered by Zendesk