ULA vs GUA: Which IPv6 Addresses Should You Use Inside Your Network?

If you come from IPv4, you probably expect a “private range” like 192.168.x.x behind NAT. IPv6 has something that looks similar, called ULA. But most IPv6 networks don’t work like IPv4 ones, and copying the IPv4 habit can cause problems later. This guide explains the two address types, when to use each, and gives you a tool to make your own ULA prefix.

What GUA and ULA are, in plain words

First, two words you will see everywhere:

• A prefix is the fixed front part of an address that names a network, written with a slash: 2001:db8:1234::/48 means “the first 48 bits are fixed”.
• A /64 is the normal size of one IPv6 LAN or VLAN. The first 64 bits name the network, the last 64 bits name the device.

Now the address types:

• GUA (global unicast address) is a normal public IPv6 address. Today these all come from 2000::/3, so they start with a 2 or a 3. A GUA can be reached from the internet if your firewall allows it. You get GUA space from your ISP, or from a registry (like RIPE or ARIN) if you are a larger organisation.
• ULA (unique local address) comes from fc00::/7. In practice it always starts with fd, so you will usually see it written as fd00::/8. ULAs are not routed on the internet. This is the IPv6 private address range, and the closest thing to 10.x.x.x or 192.168.x.x. But it is not used the same way: you normally don’t hide it behind NAT.
• Link-local (fe80::/10) addresses exist on every IPv6 interface automatically and only work on that one link. Don’t worry when you see them; they are normal.

So, is ULA like 192.168 for IPv6? Partly. It is private and not routed. But your devices will usually have a GUA and a ULA at the same time, and they use the GUA to reach the internet directly, through the firewall.

How a ULA prefix is built

An IPv6 address has 128 bits. A ULA splits them like this:

So every ULA site gets one /48. The 16-bit Subnet ID gives you 65,536 /64 subnets, which is more VLANs than anyone needs.

The important part is the Global ID. RFC 4193 says these 40 bits must be random, and that they “MUST NOT be assigned sequentially or with well-known numbers”. Why? If two companies or two homelabs both use fd00::/48, they collide the day they connect with a VPN or merge. It is exactly the same problem as two offices that both use 192.168.1.0/24. A random Global ID makes that clash very unlikely.

Generate your ULA prefix

You don’t need to pick the 40 random bits yourself. The free IPv6 ULA generator makes a random /48 in your browser and lists the /64 for each of your VLANs, using the same VLAN scheme as the worked examples below. Nothing is sent to a server.

Generate once, write it down, and keep using it. The point of a ULA is that it never changes.

Want a quick ULA address for a test or a lab note instead of a whole plan? The random IPv6 address generator has a ULA mode. To check the short form of any address, use the IPv6 compression tool.

When to use ULA, GUA, or both

If you have a static GUA prefix (your own /48, or a fixed prefix from your ISP), use GUA everywhere and protect it with a firewall. You don’t need ULA. A pattern used in big networks: keep a separate block inside your GUA space for internal-only networks, and simply never route it to the internet.

If your ISP prefix changes (this is called dynamic prefix delegation), keep the GUA for internet traffic and add a ULA /64 to each VLAN. With SLAAC (stateless address autoconfiguration, the way IPv6 devices give themselves addresses from the router’s announcements), devices pick up both automatically. Then use the ULA for anything you point at by address: DNS records, firewall rules, servers, printers, Home Assistant, Proxmox.

If your ISP gives you only one /64, you can’t split it into more SLAAC networks, because SLAAC needs a full /64. ULA is how you get extra internal subnets. To be honest about the downside: only the LAN with the GUA /64 then has normal IPv6 internet access. The others need extra work (or just use IPv4 for the internet).

If the network must stay isolated (out-of-band management, IPMI, a lab, an air-gapped network, sensor or OT networks), ULA only is a good fit. There is no internet prefix to change, and the addresses can’t leak out by accident.

Worked examples

All GUA examples use 2001:db8::/32, which is reserved for documentation. Replace them with your own prefix. To split any prefix into /64s yourself, use the IPv6 subnet calculator; the IPv6 cheat sheet lists the sizes of /48, /56 and /64.

Example 1: Home ISP delegates a /56

Your ISP gives you 2001:db8:abcd:ab00::/56.

1. From /56 to /64 is 8 bits, so you get 2^(64-56) = 256 /64s.
2. The 8 subnet bits are the last two hex digits of the 4th group: ab00 to abff.
3. First /64: 2001:db8:abcd:ab00::/64
4. “VLAN 10”, written as the hex digits 10: 2001:db8:abcd:ab10::/64
5. Last /64: 2001:db8:abcd:abff::/64

Watch out: VLAN 100 does not fit as “100”. You only have two hex digits. Use a simple scheme instead, for example VLAN 10 → 10, VLAN 20 → 20, VLAN 100 → a0, or renumber your VLANs to fit.

Example 2: ISP delegates a /48

Some ISPs (several UK ones label it this way) show a PD WAN /48 and a separate ND WAN /64. Here the PD prefix is 2001:db8:1234::/48.

1. From /48 to /64 is 16 bits, so you get 65,536 /64s.
2. The whole 4th group is yours. Write the VLAN number as hex digits:
   • VLAN 10 → 2001:db8:1234:10::/64
   • VLAN 4094 → 2001:db8:1234:4094::/64
3. The ND WAN /64 is only for the link between your router and the ISP. Your LANs come out of the /48.
4. A static server on VLAN 10: 2001:db8:1234:10::10/64. Its gateway is the router’s address on that VLAN, often the router’s link-local fe80:: address. That is normal in IPv6.

Example 3: The same home network with a ULA added

Example ULA: fd67:6191:bf40::/48. It was generated for this article; generate your own with the ULA generator.

1. VLAN 10 gets fd67:6191:bf40:10::/64.
2. The server on VLAN 10 gets fd67:6191:bf40:10::10.
3. Now the ISP changes your /56 from 2001:db8:abcd:ab00::/56 to 2001:db8:abcd:cd00::/56:
   • The server’s GUA changes from 2001:db8:abcd:ab10::10 to 2001:db8:abcd:cd10::10.
   • The ULA fd67:6191:bf40:10::10 stays the same.
4. Internal DNS records and firewall rules that use the ULA keep working. Nothing to fix.

Example 4: Why random matters

Two labs both lazily used fd00::/48. After a site-to-site VPN, fd00:0:0:10::/64 exists on both sides. Routers can’t tell which side a packet belongs to, and routing breaks.

With random Global IDs, the odds of a clash are tiny. RFC 4193 works it out with the formula 1 - e^(-N^2 / 2^41), where N is the number of connected sites:

• 10 connected sites: about 4.5 in 100 billion.
• 10,000 connected sites: about 4.5 in 100,000.

Before you join two ULA plans with a VPN, paste both prefixes into the subnet overlap checker to be sure.

The gotcha: dual-stack hosts often prefer IPv4 over ULA

Here is the part almost nobody explains. When a device has several ways to reach a name, it follows the default address selection rules in RFC 6724. Its policy table gives each kind of address a precedence:

Higher wins. So if a name has both an A record and a ULA AAAA record, most hosts connect over IPv4. GUA AAAA records get used first; ULA ones don’t.

In plain English: “I set up ULA and nothing seems to use it” is normal on a dual-stack network. An update to RFC 6724 has been proposed in the IETF to change this, but don’t count on your devices behaving differently yet.

Do I need NAT with IPv6?

No. You don’t need NAT66 for security or privacy. A stateful firewall blocks unsolicited inbound traffic, just like it does on an IPv4 router. NAT was never the thing protecting you; the firewall rules that come with it were.

NPTv6 (network prefix translation) exists for special cases, such as multihoming with two ISPs when you don’t have your own addresses. It works, but it adds the same kind of headaches NAT does: broken end-to-end addressing and harder troubleshooting.

Static addresses for servers

SLAAC gives clients addresses automatically. Servers usually get a fixed, low interface ID instead, set by hand or with DHCPv6:

• ::1 for the router
• ::53 for a DNS server
• ::10, ::11, ::100 for other servers

Keep a full /64 per LAN even for servers. Never make a LAN smaller than /64 if you want SLAAC to work. To see how an automatic (EUI-64) or link-local address is built from a MAC address, try the MAC to IPv6 converter. To check an address you typed by hand, use the IP validator.

Common mistakes

Using fd00::/48 or fc00::/48. That is not a random Global ID, and fc00::/8 isn’t even the half you are supposed to use. Generate a random one.

Thinking ULA is “more secure” than GUA. The firewall protects you, not the address type. A badly configured firewall is just as bad with ULA.

Running ULA only on a dual-stack network. Then traffic still goes over IPv4, because of the precedence rules explained above.

Using subnets smaller than /64 on LANs. SLAAC stops working, and Android and many other devices then get no IPv6 address at all.

Typing the ISP’s dynamic GUA into DNS, firewall rules or static configs. Everything breaks the day the prefix changes. Use your ULA (or a static GUA) for those.

Using the WAN /64 for the LAN when the ISP also delegated a bigger prefix. Your LANs belong in the delegated prefix.

Writing VLAN numbers into a /56. You only have two hex digits of subnet space, so VLAN 100 doesn’t fit as “100”.

Making up “unused” ranges. In IPv4, people used ranges they thought nobody needed, like military ranges or 1.1.1.0/24, and broke things later when those ranges went live. In IPv6, use real GUA space, a random ULA, or 2001:db8::/32 for documentation only.

FAQ

Is ULA just RFC 1918 / 192.168 for IPv6?

Close, but not the same. Like 192.168.x.x, ULA addresses are not routed on the internet. The difference is that you are not expected to hide them behind NAT: devices normally have a GUA for the internet and the ULA for internal use, side by side. And unlike 192.168.1.0/24, every ULA site is supposed to pick a random prefix, so two networks almost never clash.

Do big companies use GUA or ULA internally?

Both patterns exist. A common one in large networks is to use their own GUA space everywhere, protected by firewalls, and keep a separate block of that GUA space for internal-only networks that is simply never announced to the internet. Others add ULA for management or isolated networks. Pick what fits your network; there is no single rule.

Do I need NAT with IPv6?

No. NAT is not what keeps you safe; a stateful firewall is. Your router's IPv6 firewall blocks unsolicited inbound connections the same way an IPv4 router does. NAT for IPv6 exists, but it is only for special cases, and it brings back the same headaches as IPv4 NAT.

My ISP gives me a "ND WAN /64" and a "PD WAN /48". Which one do I use for my LAN and for a static IP?

Use the PD (prefix delegation) /48 for your LANs. Give each VLAN its own /64 out of it, and pick static server addresses from those /64s. The ND WAN /64 is only for the link between your router and the ISP, so don't put LAN devices on it.

What should I do at home if my ISP's IPv6 prefix keeps changing?

Keep using the ISP's GUA for internet traffic, and add a ULA /64 to each VLAN. Devices then have both. Put the ULA addresses, not the GUA ones, into internal DNS records, firewall rules and static configs, so nothing breaks when the ISP prefix changes.

My ISP only gives me a single /64. Can I still have VLANs?

Yes, but only one LAN can use that GUA /64, because a /64 cannot be split into smaller SLAAC networks. Give the other VLANs ULA /64s. Those VLANs then have no direct IPv6 internet access unless you add extra workarounds, so ask your ISP for a bigger prefix if you can.

Can I just use fd00::/64?

It will work today, but it defeats the purpose. fd00::/48 is the ULA version of 192.168.1.0/24: everyone who doesn't bother to randomise picks it. The day you connect to another network that did the same, the two clash. Generating a random prefix takes one click.

Why do my devices still use IPv4 when I've set up ULA?

Because of the default address selection rules (RFC 6724). They rank IPv4 above ULA, so when a name has both an A record and a ULA AAAA record, most hosts connect over IPv4. This is normal behaviour, not a broken setup.

Can a device have both a GUA and a ULA at the same time?

Yes. IPv6 interfaces normally have several addresses at once: a link-local fe80:: address, one or more GUAs, maybe a ULA, and often temporary privacy addresses. The operating system picks one for each connection.

How do I pick static IPv6 addresses for servers?

Keep the /64 of the server's VLAN and choose a short, easy interface ID: ::1 for the router, ::53 for DNS, ::10 or ::100 for servers. Set it by hand or with a DHCPv6 reservation. Use the same interface ID in the GUA and the ULA prefix so it is easy to remember.

Related tools

New to private addressing in IPv4? Start with private IP address ranges explained, then read the IPv4 vs IPv6 subnetting guide.