IPv6 Configuration for Tor Relays

Before configuring IPv6 on a Tor relay: (1) confirm the VPS has an IPv6 address assigned - most VPS providers offer IPv6 but it may not be enabled by default. Check with ip -6 addr show to list IPv6 addresses. If no IPv6 address appears, request one from the VPS provider's panel. (2) verify IPv6 connectivity: ping6 google.com or curl -6 https://ipv6.google.com should succeed. If the VPS has an IPv6 address but no external connectivity, the IPv6 routing may not be configured - check the default IPv6 gateway and route with ip -6 route show. (3) verify the Tor version supports IPv6 adequately: Tor 0.3.6+ has good IPv6 support. Modern Tor installations (0.4.x) from apt repositories include full IPv6 functionality. Check with tor --version.

Add IPv6 ORPort and DirPort directives to /etc/tor/torrc. For a relay: ORPort 9001 (existing IPv4) and ORPort [::]:9001 IPv6Only (adds IPv6 on the same port). The [::] notation binds to all IPv6 addresses. IPv6Only flag on the second ORPort prevents Tor from also binding IPv4 on that port (since the first ORPort handles IPv4). For an exit relay with IPv6 DirPort: DirPort 9030 and DirPort [::]:9030 IPv6Only. Outbound IPv6 connections: IPv6Exit 1 enables exit connections via IPv6 (for exit relays). IPv6OrPort configuration allows clients to connect to your relay via IPv6. After changing torrc: systemctl reload tor. Verify in Tor logs: look for 'Opened OR listener on [::]:9001' confirming IPv6 is bound.

In addition to IPv4 firewall rules (ufw or iptables), add equivalent IPv6 rules using ip6tables or ufw with IPv6 support. For ufw: ufw allow 9001/tcp ensures both IPv4 and IPv6 are allowed if IPv6 is enabled in /etc/default/ufw (IPV6=yes). Verify ufw's IPv6 status: ufw status verbose shows IPv6 rules. For ip6tables directly: ip6tables -A INPUT -p tcp --dport 9001 -j ACCEPT and ip6tables -A INPUT -p tcp --dport 9030 -j ACCEPT (if DirPort is configured). Persist ip6tables rules with ip6tables-save > /etc/ip6tables.rules and a startup script or iptables-persistent package (apt install iptables-persistent). Test IPv6 connectivity from the relay: use an external tool to verify the relay's IPv6 port is reachable.

IPv6-capable relays see slightly higher consensus weight over time as the Tor authority measurement system includes IPv6 reachability in relay quality scoring. Relays reachable on both IPv4 and IPv6 appear in more potential circuit configurations (clients who prefer IPv6 can use this relay). Relay metrics available on Tor Metrics (metrics.torproject.org) show IPv6 reachability status. After configuring IPv6, allow 24-48 hours for the relay to appear with IPv6 status in Tor Metrics. IPv6 traffic volume on most relays is 5-20% of total traffic (reflecting the current internet IPv6 adoption rate). Exit relays with IPv6Exit 1 handle IPv6 exit connections to IPv6-capable destination servers, increasing exit utility for connections to IPv6-capable services.

Common IPv6 relay configuration issues: (1) IPv6 address not assigned: the VPS has an IPv6 range assigned but the specific address needs to be configured - check VPS panel and add the IPv6 address with ip -6 addr add

/ dev eth0. (2) IPv6 reachability but no external routing: IPv6 default gateway not configured - add with ip -6 route add default via . (3) Firewall blocking: ip6tables has separate rules from iptables - rules added to iptables do not automatically apply to IPv6. (4) Tor not binding IPv6: check Tor logs for error messages about IPv6 bind failures - typically indicates either no IPv6 address or the address is not configured on the interface. (5) IPv6 works locally but relay appears IPv4-only on Tor Metrics: allow 24-48 hours for the relay measurement cycle to include IPv6 reachability testing.