I switched to StarLink a few months ago, which is the first time I've dealt with a CGNAT ISP, so with that process, and wanting to get some of my self-hosted services back out to the internet, I delved for the first time into IPv6 (had always just kept it disabled previously, and stuck to v4, with port forwarding and DDNS). I'm now have a domain, and everything routing to the appropriate containers, but it was a very manual process to set that up. This was still on the 6.xx version of unRAID. I've since upgraded to the current 7.1.x, and don't see much in the way of changes on the docker networking front.

Are there any improvements that have been/should be made to the docker UI to make IPv6-centric situations like this more intuitive? Getting to any v6 settings in the unraid docker UI seems to be far more cumbersome than the v4 counterparts - and I'm not sure that should be the case today and moving forward. I'm sadly, not really the person that should come up with a request list, because I genuinely have no idea how others have implemented this type of configuration.

Sorry to hear that you have ignored IPV6 for the last 30yrs.

You had a lot of time to learn about it, but obviously you need a crash course now.

Docker and V6 are a desaster, like you they have ignored V6 for a long time too and now there is no real implementation, but more or less a half done "fix" or how they call it.

Anyway, there is hope, IT CAN BE DONE :-)

Take a look at my docker list for example:

The gui does not show any V6 addresses at all (but they are there in the background, believe me).

As you can see, there are many running in "bridge" mode, others in "host" mode.

The general rule is "if you need direct access to the docker from the internet, you need to run it in host mode". This means, it is reachable with the address of the server himself.

Here "Nginx-Proxy-Manager-Official" and "CrushFTP10" are directly connected.

The others, running in "Bridge" mode, need proxiing, this is handled by "Nginx-Proxy-Manager-Official" (or other alike packages that are also available).

This takes the connection from the internet and makes a new internal connection to the local docker (this can become quite complicated, you will find several posts here in the forum how to solve certain problems). The nice thing with it is, it can take connections from V6 and hand it over to internal V4!

So you will not have to deal with the complicated Docker-V6 at all.

You might ask, why not running ALL dockers in host mode? the answer is simple: in host mode they use all the ports they have been created for. And many many use ports 80,443,8080 and so on. So they cannot be run together. Nginx-Proxy-Manager uses ports 80 and 443 and tunnels them to arbitary ports as you can see on the above list, so baikal can run with nginx although both of them use port 80 internally.

But you will need to create a CNAME record in your dns server of your domain for each bridged docker that should be tunneled to the nginx reverse proxy.

The biggest problem here is that many dockers do not like to be tunneled easily. They need a special setup in the proxy manager. You will need to search the forum for hints for every of them, there is no general solution.

But at the end, everything should work fine again.

So, this is part of the problem I've experienced - with there being multiple ways to do a thing, and no clear way in the UI to know how to do so.
In my case, I am not running my exposed containers in host mode - as you are - they are instead running through br0, which is set with my local ipv6 prefix. This puts each docker container as another machine on my local network, and a ipv6 global address. The trick i needed to do was to make sure that the containers were assigned the same ipv6 address every time - which since it was based on the prefix and MAC address, was another 'additional parameter' that needed to be added to the container. That finally was the key to allow adding DNS entries for those machines, and making it work.

And then I upgraded to unraid 7, and now, for some reason that I haven't determined yet, the mac addresses are no longer being set by the --mac-address parameter, so things are no longer remote accessible until I get through this struggle...

3 hours ago, CraziFuzzy said:

hey are instead running through br0, which is set with my local ipv6 prefix.

Then, at least, make sure that "host access to custom networks" is allowed in your docker setting

I dont think that host access works via ipv6

27 minutes ago, pkoci said:

I dont think that host access works via ipv6

how else can it work if there is only Ipv6 on the host???

Today you can run the machine without v4.

I meant the host access to custom network. Try to ping from a container to host via ipv6.

35 minutes ago, pkoci said:

Try to ping from a container to host via ipv6.

root@c0f0b99bb5d7:/# ping

BusyBox v1.36.1 (2025-08-05 16:44:32 UTC) multi-call binary.

Usage: ping [OPTIONS] HOST

Send ICMP ECHO_REQUESTs to HOST

-4,-6 Force IP or IPv6 name resolution

-c CNT Send only CNT pings

-s SIZE Send SIZE data bytes in packets (default 56)

-i SECS Interval

-A Ping as soon as reply is received

-t TTL Set TTL

-I IFACE/IP Source interface or IP address

-W SEC Seconds to wait for the first response (default 10)

(after all -c CNT packets are sent)

-w SEC Seconds until ping exits (default:infinite)

(can exit earlier with -c CNT)

-q Quiet, only display output at start/finish

-p HEXBYTE Payload pattern

root@c0f0b99bb5d7:/# ping 2001:470:70af:1::3

PING 2001:470:70af:1::3 (2001:470:70af:1::3): 56 data bytes

64 bytes from 2001:470:70af:1::3: seq=0 ttl=63 time=0.265 ms

64 bytes from 2001:470:70af:1::3: seq=1 ttl=63 time=0.200 ms

64 bytes from 2001:470:70af:1::3: seq=2 ttl=63 time=0.286 ms

64 bytes from 2001:470:70af:1::3: seq=3 ttl=63 time=0.331 ms

64 bytes from 2001:470:70af:1::3: seq=4 ttl=63 time=0.212 ms

64 bytes from 2001:470:70af:1::3: seq=5 ttl=63 time=0.289 ms

^C

--- 2001:470:70af:1::3 ping statistics ---

6 packets transmitted, 6 packets received, 0% packet loss

round-trip min/avg/max = 0.200/0.263/0.331 ms

root@c0f0b99bb5d7:/#

works flawlessly (most of the dockers have no ping, but this one does)

What type of the custom network do you use? Ipvlan or macvlan?

ipvlan

you could have seen that in the screenshot above.

But its hard to find a docker containing ping and even harder to find one that supports v6 too.

For me "Oscam" worked. All others in my list did not have "ping" (did not test the rest, once oscam matched)

Edited September 30, 2025Sep 30 by MAM59

If I set up a custom network on ipvlan, pinging anything (LAN or even Google, for example) doesn't work.

Containers on the ipvlan network get the same ipv6 address as the host via SLAAC. This is probably the problem. And another ipv6 address via DHCPv6.

You don't seem to have these problems?

unraid needs ipv6 via ra to function and use ipv6 correctly per its inet rc script. slacc alone is not enoth for ipv6 on unraid... (more a linux and fored implementation and backwards compability due to andriods networking for ipv6...

With a dhcp server for ipv6 using RA. then unraid wil corectly detect and use ipv6 corectly...

Othwersie unraid will not coretly enabled ipv6 forwarding for dockers.

I usualy use a user script at first array start to enabled ipv6 across dockers.

Enable Unraid br0 IPV6 forwarding for Dockers

#!/bin/bash
# Delay before starting
sleep 10
# Apply sysctl settings
apply_sysctl_settings() {
echo "Applying sysctl settings..."
sysctl -w net.ipv6.conf.all.forwarding=1
sysctl -w net.ipv6.conf.br0.accept_ra=2
sysctl -w net.ipv6.conf.br0.accept_ra_rt_info_max_plen=64
#sysctl -w vm.overcommit_memory=1
echo "Verifying sysctl settings..."
sysctl net.ipv6.conf.all.forwarding
sysctl net.ipv6.conf.br0.accept_ra
sysctl net.ipv6.conf.br0.accept_ra_rt_info_max_plen
#sysctl vm.overcommit_memory
}
apply_sysctl_settings

docker inspect is your friend here.

docker network ls

docker inspect br0

this will tell you if your docker network can use and is seeing ipv6. this was due to internal ipv4 do per communication to guarantee a host connection.

Edited October 1, 2025Oct 1 by bmartino1

9 hours ago, pkoci said:

You don't seem to have these problems?

no, I have a real ra server running in my lan that supplies the boxes with full configurations as it normally should be.

Obviously your modem/router does not. so stick with the above script by @bmartino1

You may ask your ISP why their box does not supply ra data

(note, with V6 DHCP became more or less obsolete, this job is now done by the "router advertising protocol" (RA) which broadcasts the current valid Prefix to the LAN but additionally pack infos like DNS Servers, Routers (himself), local dns names and a lot of flags regulary to the LAN. Also a "new" client can ask for the info directly with a special request packet. If RAs do not arrive timely, the info is deleted at the client and he either picks the next router in line (the infos include a priority field), or stops IPV6 completely)

(note2: there are still DCHP6 servers out there. But they only supply addresses and only are asked if a special RA flag tells them to do so. They can be used for fixed prefixe, limited ranges or fixed addresses for a certain client, RA usually only uses dynamic prefixes and dynamic addresses with SLAAC scheme)

(note3: what I do not like with the above script is the ...accept_ra_rt_info_max_plen=64. This limits the usage to the "standard" netmask. This is not always true because some ISP already supply smaller Subnets to their customers. I would advise to change it to "0" (accept all sizes). Also, even with a normal mask, you cannot subnet your own lan any further with the 64 setting)

Edited October 1, 2025Oct 1 by MAM59

I have a Mikrotik router and IPv6 works without any problems.

I currently use the macvlan driver for the custom network, which also works with IPv6, but containers cannot access the host via IPv6 (even though it is enabled in the settings).

The problems described above only occur with ipvlan.

What are your Docker settings? Would you mind sharing a screenshot?

2 hours ago, pkoci said:

I have a Mikrotik router and IPv6 works without any problems.

Oh, Mikrotiks are very complicated, it is likely that you might have missed something in the configs (and no, although I have many mikrotics too here myself, I don't use them as routers. So I cannot help you with this)

2 hours ago, pkoci said:

What are your Docker settings? Would you mind sharing a screenshot?

What settings? I thought I have made a shot of the docker config above already??? or do you mean a particular docker? (although that would be boring, the only thing I ever change for the dockers are bridged or host mode, and maybe a port now and then.)

using unfi equipment, I can turn off ipv6 RA (Router announcement) and use ipv6 dhcp via slacc. Unraid will not see nor use ipv6. If i turn on RA in my unifi device for example, then unraid will see ipv6 and enable ipv6 stuff as it should.

I usually use unfi to test ipv6 on multiple OS.

That's what I've found with unraid... If using Ipv6 SLAAC on unraid then the ipv6 slacc dhcp server need the RA option on...

there is known configurations with Mikrotik router and ipv6

this is most likely a router misconfiguration.

see forum: https://forum.mikrotik.com/t/intermittent-issues-with-ipv6-slaac-and-or-ra/176567

More on ipv6 and RA

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/concept/port-security-ra-guard.html

Edited October 1, 2025Oct 1 by bmartino1
ipv6 videos and info.