An IPv6 address has eight hexadecimal groups. A double colon replaces one run of zero groups, while a prefix such as /64 marks the network boundary. The size of a prefix and the scope of an address answer different questions.
Expand and compress an address
2001:db8:12:34::7 expands to 2001:0db8:0012:0034:0000:0000:0000:0007. Each group holds 16 bits. Leading zeros within a group can be omitted; one consecutive zero run can be replaced by ::. Two double colons would make the missing groups ambiguous and are invalid.
Canonical text formatting uses lowercase hexadecimal and compresses the longest zero run, choosing the first when lengths tie. Different valid spellings can still describe the same address. Compare parsed addresses rather than raw text when checking a firewall list.
A device can have several IPv6 addresses
A link-local address, commonly starting with fe80:, is used on the local link. It is not a public Internet address. A destination using link-local scope may need an interface identifier such as %12 on Windows because the same address could exist on multiple interfaces.
Unique-local addresses occupy fc00::/7; locally assigned examples commonly begin fd. A global address can be routed beyond the LAN, subject to real routing and firewall rules. A laptop may also generate temporary addresses for outgoing connections. Seeing several addresses in its settings is therefore normal.
Split a delegated /56 into /64 LANs
Suppose a provider delegates the documentation prefix 2001:db8:abcd:1200::/56. Extending the prefix to /64 adds eight subnet bits: 2^8 = 256 distinct /64 networks, from 2001:db8:abcd:1200::/64 through 2001:db8:abcd:12ff::/64. This is a planning example, not an address allocation you can use publicly.
A single /64 contains exactly 18,446,744,073,709,551,616 addresses. That mathematical count is not a practical promise about how many clients a router can handle. Many SLAAC LAN configurations expect /64; making a LAN prefix smaller to save addresses can break assumptions in client configuration.
Check delegation, routing, and policy
- Read the WAN prefix delegation separately from the WAN interface address.
- Assign distinct LAN prefixes to networks that require separate routing or policy.
- Check router advertisements, DNS information, and client addresses on each LAN.
- Test outgoing connectivity and verify that unsolicited incoming traffic follows your intended firewall policy.
If the ISP changes your delegated prefix, dependent DNS records and literal-address rules may need updating. Prefer documented router features that track delegation. Do not disable the IPv6 firewall simply because NAT is absent; addressing and access control are separate tasks.
Put it into practice
References & further reading
Protocol standards and official documentation supporting this guide. Device menus and provider policies vary; use the documentation for your equipment when applying a change.