Disable IPv6 in the Kernel Without Breaking Networking

Practical steps to turn off IPv6 at the kernel level while keeping systems reachable and predictable.

28.01.2026 | reading time: 3 min

IPv6 may be unwanted in certain environments or cause troubleshooting noise; this guide shows concrete steps to shut it down kernel-side so the stack no longer advertises or uses IPv6, and explains when to prefer a kernel parameter over runtime sysctl changes.

Quick verification and immediate action

```sh # show current IPv6 addresses ip -6 addr show # disable immediately (affects running kernel parameters) sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 # verify IPv6 gone ip -6 addr show ```

Make the change persistent without reboot

Write the settings into a sysctl drop-in and reload so the setting survives reboots and sysctl --system will apply them: `printf 'net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 ' | sudo tee /etc/sysctl.d/99-disable-ipv6.conf` then `sudo sysctl --system`; the administrator should then re-run `ip -6 addr show` to confirm no addresses remain.

When to disable at boot (kernel parameter)

For a true kernel-side shutdown that prevents the IPv6 module from initializing, add the kernel parameter ipv6.disable=1 to your bootloader command line (for example add ipv6.disable=1 to GRUB_CMDLINE_LINUX in /etc/default/grub and run update-grub or grub2-mkconfig -o /boot/grub2/grub.cfg), then reboot; this avoids race conditions where sysctl changes arrive too late during early boot.

Module removal and limits

If the kernel builds IPv6 as a module you can remove it with sudo modprobe -r ipv6 but this may fail if other modules depend on it; if IPv6 is compiled into the kernel only the kernel parameter will fully disable it, and some programs may still expect IPv6 sockets so test services after changes.

Real-world caveats to test

Disabling IPv6 can break name resolution preferences, VPNs, container networking, SLAAC and IPv6-only services; after change, test DNS lookups, VPN connections, containers and firewall rules, and remember that firewalls need explicit IPv6 rules or disabling IPv6 may leave rules never applied.

Security and tool interactions

Be aware that network management tools such as NetworkManager or systemd-networkd may re-enable or configure IPv6 per-interface, so update their configuration if you want a cluster-wide policy; likewise update any nftables or ip6tables rulesets and monitoring checks that expect IPv6 telemetry.

Checklist for safe rollout

Plan: test on a single host, verify services and DNS, update persistent sysctl or bootloader entries, coordinate with network and VPN teams, and finally roll out across fleet; if anything fails, revert the sysctl or kernel command line and reboot to restore IPv6 quickly.