Docs Dashboard Developers
Menu ⌃

Public IPv6

Every VM on Metalhost gets a public, routable IPv6 address for free — it's part of the public NIC that comes with the VM. You don't opt in or pay for it; it's just there unless you explicitly make the VM private-only.

How it works

When a VM is created, one global unicast IPv6 address is reserved from the datacenter's IPv6 pool and configured on the VM's public network interface. The address is written into the guest's network config at boot, so it's live as soon as the VM is up — no DHCP wait, no manual setup inside the VM.

  • Free — there's no per-address charge for IPv6, unlike IPv4.
  • Always on — every VM gets one unless it's marked private-only.
  • Stable — the address persists across stop/start, restart, and resize. Deleting the VM releases it.
  • Routable — it's a real internet address, reachable from anywhere IPv6 reaches.

Reaching your VM over IPv6

Find the address on the VM's overview under Public IPv6 (and in the Access card). From an IPv6-capable client: 

ssh user@2606:2a80:...

Note that inbound IPv6 is gated by the same firewall as IPv4 — see below. If your local network or ISP doesn't offer IPv6 connectivity, you'll need a public IPv4 to reach the VM directly.

Firewall

The public NIC is default-deny for both IPv4 and IPv6. A baseline SSH rule is seeded at create so you can get in; everything else is closed until you open it. Firewall rules accept IPv6 source CIDRs (e.g. 2001:db8::/32) just like IPv4 — a rule with an empty source applies to both families.

Opting out: private-only VMs

If you want a VM with no internet exposure at all, toggle Private only at create time. That VM gets no public NIC — no IPv6 and no IPv4 — and is reachable only inside your project's VPC. Outbound internet still works through NAT, so it can pull packages and updates. This is a create-time choice; you can't remove the public NIC from an existing VM.

What's next