How to Disable IPv6 on Ubuntu 26.04

ubuntunetworkingipv6linuxsysctlsystem-administration

Bottom line

Ubuntu 26.04 offers three primary methods to disable IPv6. A sysctl config file (best for servers, no reboot), a GRUB kernel parameter (most complete, requires reboot), and NetworkManager/GNOME Settings or nmcli (best for Desktop). The correct method depends on your installation type - Desktop uses NetworkManager which overrides sysctl, so the GUI or nmcli approach is essential on Desktop. On Server, the sysctl file way is reliable and immediate. Confidence is high - all methods are confirmed by multiple independent sources including an Ubuntu 26.04-specific guide.

Key findings

  • Desktop vs. Server split is critical: Ubuntu Desktop uses NetworkManager, which re-enables IPv6 on interfaces after resume/suspend even if sysctl disables it. Use GNOME Settings or nmcli on Desktop.
  • sysctl file is the recommended server method: Creating /etc/sysctl.d/99-disable-ipv6.conf persists across reboots and applies immediately with sudo sysctl --system. No reboot required.
  • GRUB is the nuclear option: ipv6.disable=1 in GRUB prevents the IPv6 kernel module from loading entirely - no service or process can re-enable it. Requires reboot.
  • NetworkManager and sysctl conflict: On Desktop, nmcli connection modify ipv6.method disabled both disables IPv6 and automatically sets the matching sysctl values - it's the clean, integrated path.
  • Disabling lo IPv6 is optional but risky: Adding net.ipv6.conf.lo.disable_ipv6 = 1 disables IPv6 on loopback. Some system services rely on ::1 for local communication; the GRUB method is safer if you need full service-wide removal.
  • Kubernetes/Docker users: don't disable at OS level - Kubernetes dual-stack and Docker 26+ handle IPv6 internally; OS-level disabling causes container networking problems.

Background

IPv6 is enabled by default on Ubuntu 26.04 ("Resolute Raccoon") because it's the future standard of internet networking. Ubuntu uses Netplan as the high-level network configuration layer, with either systemd-networkd (Server default) or NetworkManager (Desktop default) as the backend renderer. This architectural split is the main reason why different methods are needed for Desktop vs. Server.

Common reasons to disable IPv6:

  • Legacy app compatibility (apps that misbehave with dual-stack)
  • VPN IPv6 leak prevention (IPv6 traffic bypasses VPN tunnel)
  • Troubleshooting (eliminating IPv6 as a variable)
  • APT/Snap slowness on IPv6 (esm.Ubuntu.Com and Snap Store have reported IPv6 latency issues)
  • Internal/isolated server environments where IPv6 isn't routed

Current state

Ubuntu 26.04 ships with Netplan 1.1+ and the same general IPv6 disable approach as Ubuntu 24.04, with no major behavioral changes. The GRUB and sysctl methods are identical. The Netplan YAML syntax is the same. A known bug appeared in Ubuntu 24.10 where /etc/sysctl.d/*.conf entries occasionally failed to persist after reboot (workaround: add sysctl --system to /etc/rc.local). It's unclear if this is fully resolved in 26.04 - test after applying.

Technical methods - complete reference

Step 0: Check current IPv6 status

# Check if IPv6 is active (0 = enabled, 1 = disabled)
cat /proc/sys/net/ipv6/conf/all/disable_ipv6

# Show active IPv6 addresses
ip -6 addr show

# Show active IPv6 connections
ss -6 -tuln

Method 1: Temporary disable (testing only, lost on reboot)

sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1

Verify:

cat /proc/sys/net/ipv6/conf/all/disable_ipv6   # should output: 1
ip -6 addr show                                  # should be empty

To restore: set all values back to 0.

Method 2: Permanent via sysctl - ✅ Recommended for Ubuntu Server

Creates a persistent drop-in config file. No reboot needed.

sudo tee /etc/sysctl.d/99-disable-ipv6.conf <<EOF
# Disable IPv6 - not in use in this environment
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
EOF

sudo sysctl --system

Verify:

sysctl net.ipv6.conf.all.disable_ipv6   # should output: 1

To revert:

sudo rm /etc/sysctl.d/99-disable-ipv6.conf
sudo sysctl --system

Note: If settings don't persist after reboot (known 24.10 edge case), add sysctl --system to /etc/rc.local as a workaround.

Method 3: Permanent via GRUB - ✅ Most complete, requires reboot

Disables the IPv6 kernel module before interfaces are configured. No service can re-enable it.

sudo nano /etc/default/grub

Find the line and add ipv6.disable=1:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash ipv6.disable=1"
GRUB_CMDLINE_LINUX="ipv6.disable=1"

Apply and reboot:

sudo update-grub
sudo reboot

Verify after reboot:

cat /proc/cmdline | grep ipv6    # should contain: ipv6.disable=1
ip -6 addr show                   # should be empty

To revert: remove ipv6.disable=1 from both GRUB lines, run sudo update-grub, reboot.

Method 4: Ubuntu Desktop - GNOME Settings GUI

  1. Open Settings → Network (or Wi-Fi)
  2. Click the gear icon next to your active connection
  3. Select the IPv6 tab
  4. Change Method from "Automatic" to "Disable"
  5. Click Apply, then toggle the connection off/on

Limitation: This disables IPv6 on managed network interfaces only. The loopback ::1 address remains. For complete disable, use GRUB method.

Method 5: Ubuntu Desktop - nmcli (command line)

# List connections
nmcli connection show

# Disable IPv6 on a specific connection
sudo nmcli connection modify "Wired connection 1" ipv6.method "disabled"
sudo nmcli connection up "Wired connection 1"

When NetworkManager disables IPv6 this way, it automatically sets the matching sysctl values - it's the most integrated approach for Desktop.

To re-enable:

sudo nmcli connection modify "Wired connection 1" ipv6.method "auto"
sudo nmcli connection up "Wired connection 1"

Method 6: Ubuntu Server - Netplan YAML (per-interface)

For Ubuntu Server using systemd-networkd as the Netplan renderer. Edit your Netplan config:

sudo nano /etc/netplan/00-installer-config.yaml

Add three directives to the interface block:

network:
  version: 2
  ethernets:
    ens18:
      dhcp4: true
      dhcp6: false        # Disable DHCPv6
      accept-ra: false    # Ignore Router Advertisements
      link-local: []      # Prevent link-local fe80:: address assignment

Apply (no reboot needed):

sudo netplan apply

Verify:

ip -6 addr show ens18    # should return no output

Important: link-local: [] is required in addition to dhcp6: false. Without it, link-local fe80:: addresses are still assigned even with DHCPv6 disabled. Netplan cannot disable IPv6 on lo - combine with sysctl if you need that.

Bonus: APT-only IPv6 disable

If only apt is slow on IPv6 and you don't want to disable it globally:

sudo tee /etc/apt/apt.conf.d/99force-ipv4 <<EOF
Acquire::ForceIPv4 "true";
EOF

Post-disable: SSH hardening

After disabling IPv6, SSH may be slow if DNS returns AAAA records. Fix:

# Add to /etc/ssh/sshd_config
AddressFamily inet

sudo systemctl reload sshd

Method selection guide

Scenario Recommended method
Ubuntu Server (permanent) Method 2: sysctl file
Ubuntu Server (nuclear/immutable) Method 3: GRUB
Ubuntu Server (per-interface) Method 6: Netplan
Ubuntu Desktop Method 4: GNOME GUI or Method 5: nmcli
Testing only Method 1: runtime sysctl
Slow APT only Bonus: APT force IPv4

Evidence, comparisons, and related context

vs. Ubuntu 24.04: The methods are essentially identical. Ubuntu 26.04 uses Netplan 1.1+ as the default network config layer; the three-directive YAML block (dhcp6, link-local, accept-ra) is the same. GRUB and sysctl approaches are unchanged.

Alternative to full disable - IPv6 Privacy Extensions: If your goal is privacy (preventing MAC address exposure via EUI-64 IPv6 addresses), Ubuntu already enables privacy extensions by default. You can verify/enforce with:

sysctl net.ipv6.conf.all.use_tempaddr   # should be 2

This is often a better approach than full disable for desktop users.

Limitations and critiques

  • Security benefit is overstated: Community experts note that disabling IPv6 doesn't eliminate IPv6 attack surface - a properly configured firewall handles IPv6 better.
  • sysctl is unreliable on Desktop: NetworkManager overrides sysctl values on managed interfaces after suspend/resume. Sysctl-only methods on Desktop are fragile.
  • Disabling lo IPv6 can break services: Services and session daemons that use ::1 for local IPC may fail silently. Use the GRUB method for total system-wide removal.
  • Docker/Kubernetes impact: Docker 26+ enables IPv6 on containers by default. Disabling IPv6 at the OS level can break container bridge networking. Kubernetes dual-stack must be configured in Kubernetes, not at the OS level.
  • Reboot required for GRUB: The most reliable method requires a reboot, which may be undesirable in production.
  • sysctl persistence edge case: A reported bug in Ubuntu 24.10 caused /etc/sysctl.d/*.conf entries to not persist after reboot; it's unclear if fully resolved in 26.04.

Open questions

  • Whether the Ubuntu 24.10 sysctl persistence bug is confirmed-fixed in Ubuntu 26.04 (no official patch note found)
  • Whether Snap Store and esm.ubuntu.com IPv6 slowness issues are resolved in 26.04 or if the APT workaround is still needed

Practical takeaways

  • Always match the method to your network manager. Desktop → GNOME/nmcli. Server → sysctl file or Netplan.
  • Use /etc/sysctl.d/99-disable-ipv6.conf, not /etc/sysctl.conf - drop-in files in sysctl.d/ survive package upgrades and keep changes modular.
  • sudo sysctl --system applies all sysctl.D changes immediately without a reboot - prefer it over sysctl -p.
  • Test critical services after disabling - SSH, local apps that bind to ::1, and containers are the most common failure points.
  • GRUB method = safest for pure IPv4 servers - once set, no process can override it.
  • Consider privacy extensions over full disable if your real concern is MAC address tracking via IPv6 EUI-64 addresses.

Sources used