IPv6 support in Google Cloud

This document describes which services in Google Cloud include support for IPv6.

IPv6 has a much larger address space than IPv4, with 128 bits per address. IPv6 has many more addresses available than IPv4 does, which helps mitigate the growing shortage of IPv4 addresses.

IPv6 support is widely available in Google Cloud through dual-stack (IPv4 and IPv6) and IPv6-only compute and networking services. You can deploy dual-stack and IPv6-only subnets, which lets you deploy IPv6 workloads.

You can control IPv6 configurations by using organization policy constraints as described in the organization policy constraints section of the VPC networks overview.

Core compute and networking services

The following table summarizes support for IPv6 in core compute and networking services in Google Cloud.

If a service has an IP stack type configuration option, the table lists the supported stack types. The IPv6-only stack type is available for some services where marked in the table. If a service doesn't have a stack type configuration option, the table lists not applicable (N/A).

For more information about a given service, see the corresponding documentation.

Service

IPv6 support

Supported stack types

Documentation

Compute

Compute Engine instances ¹

Dual-stack,
IPv6-only

Compute Engine instance templates

Dual-stack,
IPv6-only

Compute Engine managed instance groups (MIGs) ²

Dual-stack,
IPv6-only

Dynamic Network Interfaces (NICs)

Dual-stack,
IPv6-only

Google Kubernetes Engine (GKE) nodes and pods

Dual-stack

Cloud Run services and jobs (internal IPv6)

Dual-stack

Set up dual-stack services and jobs

Networking

VPC networks

Subnets

Dual-stack,
IPv6-only

VPC Network Peering ³

Dual-stack

Static IP address reservation

N/A

Static routes

N/A

Policy-based routes

N/A

Network security

Cloud Next Generation Firewall

N/A

Packet Mirroring

N/A

Network Connectivity

Cloud Router

N/A

Network Connectivity Center

N/A

You can configure VPC spokes to exchange only IPv4 subnet ranges, both IPv4 and IPv6 subnet ranges, or only IPv6 subnet ranges. See:
- IP addressing
- Create a VPC spoke

Dedicated Interconnect VLAN attachments ³

Dual-stack

Partner Interconnect VLAN attachments ³

Dual-stack

HA VPN

Dual-stack,
IPv6-only

Classic VPN

N/A

DNS

Cloud DNS ⁴

N/A

IPv6 DNS record support:
- DNS records overview
- Add, modify, and delete records
DNS64 synthesizes IPv6 addresses for IPv4 destinations:
- DNS64 overview
- Configure DNS64
To reach IPv4 destinations on the internet, you must use both DNS64 and NAT64.

NAT

Cloud NAT ⁵

N/A

IPv6-only instances can reach IPv4 destinations on the internet by using DNS64 and NAT64 in Public NAT. See:

Cloud Load Balancing

Global external Application Load Balancer

Dual-stack

End-to-end dual-stack support. See:

Global external proxy Network Load Balancer

Dual-stack

Regional external Application Load Balancer

Dual-stack

Dual-stack backends are supported but load balancers can't terminate IPv6 connections from clients. See:

Regional internal Application Load Balancer

Dual-stack

Cross-region internal Application Load Balancer

Dual-stack

Regional external proxy Network Load Balancer

Dual-stack

Regional internal proxy Network Load Balancer

Dual-stack

Cross-region internal proxy Network Load Balancer

Dual-stack

Classic Application Load Balancer

N/A

Load balancers can terminate IPv6 connections from clients but backends with IPv6 addresses aren't supported. See IPv6 for Application Load Balancers and proxy Network Load Balancers .

Classic proxy Network Load Balancer

N/A

External passthrough Network Load Balancer ⁶

Dual-stack,
IPv6-only

End-to-end dual-stack or IPv6-only support. See Backend service-based external passthrough Network Load Balancer overview .

Internal passthrough Network Load Balancer ⁶

Dual-stack,
IPv6-only

End-to-end dual-stack or IPv6-only support. See Internal passthrough Network Load Balancer overview .

Private access for services

Private Service Connect published services

N/A

Private Service Connect endpoints for published services

N/A

Private Service Connect interfaces

Dual-stack

Private Service Connect backends

N/A

¹ See the following limitations:

IPv6-only instances support only Debian and Ubuntu operating systems .
IPv6-only instances don't support Compute Engine Internal DNS .

² See the limitations for including instances with IPv6 addresses in MIGs in Basic scenarios for creating MIGs .

³ VPC Network Peering and Cloud Interconnect VLAN attachments themselves can only be configured as dual-stack and not IPv6-only. However, when configured as dual-stack they are compatible with IPv6-only resources such as subnets and instances.

⁴ Cloud DNS doesn't support IPv6 for inbound forwarding.

⁵ For NAT64, Public NAT supports second generation or earlier VM instances and M3 VM instances. For more information, see Compute Engine terminology .

⁶ IPv6-only support is limited to instance group backends and protocol forwarding with IPv6-only target instances.

Application services

The following table summarizes support for IPv6 in commonly used Google APIs and services.

For services that support private IPv6 access, private access from IPv6 clients is supported by Private Google Access .

For more information, see Additional details about application services and IPv6 .

Service	Public IPv6 access	Private IPv6 access
AlloyDB for PostgreSQL API
AlloyDB for PostgreSQL instances ¹
Bigtable
BigQuery
Dataflow
Dataproc
Cloud Deploy
Firestore
Cloud Identity
Cloud Logging
Memorystore for Memcached API
Memorystore for Memcached instances ¹
Memorystore for Redis API
Memorystore for Redis instances ¹
Cloud Monitoring
Pub/Sub
Spanner
Cloud SQL Admin API for MySQL
Cloud SQL for MySQL instances ¹
Cloud SQL Admin API for PostgreSQL
Cloud SQL for PostgreSQL instances ¹
Cloud SQL Admin API for SQL Server
Cloud SQL for SQL Server instances ¹
Cloud Storage
Cloud Tasks
Cloud Trace
Workflows
Container Registry / Artifact Registry
Secret Manager

¹ Some products have an administrative API that runs on Google's production infrastructure and can be accessed by IPv6 clients, but the API creates VPC-hosted resources that can't be accessed by IPv6 clients. For example, Memorystore for Memcached has an administrative API at memcache.googleapis.com . Using this API lets you perform some administrative tasks for your Memorystore for Memcached instances, but you must use private services access to access the Memorystore for Memcached instances.

Additional details about application services and IPv6

There are two varieties of Google APIs and services:

Services that run on Google's production infrastructure, including all *.googleapis.com service endpoints.
Services that run in VPC networks that are run by Google (also known as VPC-hosted services ), such as Cloud SQL and Filestore.

Most services that run on Google's production infrastructure support access by clients with IPv6 addresses:

Public access from IPv6 clients is supported.
Private access from IPv6 clients is supported through the following methods:
- Private Google Access . For more information, including supported services, see Domain options .
- Private Service Connect endpoints for regional Google APIs . This type of endpoint can be configured with either an IPv4 or IPv6 address—you must configure an IPv6 address to let IPv6 clients use it.
  
  However, you can't use Private Service Connect endpoints for global Google APIs to access services from IPv6 clients. This type of endpoint can be configured with an IPv4 address only.

For more information about services that run on Google's infrastructure, see the Google APIs Explorer .

For VPC-hosted services, support for access by IPv6 clients depends on the private access option that you use:

You can create IPv6 Private Service Connect endpoints to let clients with IPv6 addresses access published services .
Private services access doesn't support access by clients that have IPv6 addresses. For more information, see the Supported services in the private services access documentation.