IPv6 Private IP Address Explained: Unique Local Addresses and How to Use Them

IPv6 was designed around the idea that every device could eventually have its own globally unique, publicly routable address — but that doesn’t mean the concept of a “private” IP address disappeared. IPv6 has its own dedicated private addressing scheme, called Unique Local Addresses (ULA), that serves a similar purpose to IPv4’s familiar 192.168.x.x and 10.x.x.x ranges, while working quite differently under the hood. This article covers what ULA is and how it compares to IPv4 private addressing, how it differs from another non-routable IPv6 address type called Link-Local, how to actually generate and configure a ULA prefix for your own network, a ready-to-use script for generating one, and where to find the official specification that defines all of this.

What Is a Unique Local Address (ULA) in IPv6?

A Unique Local Address is IPv6’s equivalent of a private IP address — a range of addresses reserved for use within a local network that isn’t meant to be routed across the public internet.

1. ULAs are defined within the fc00::/7 prefix. This block is reserved specifically for private, local addressing, similar in spirit to how RFC 1918 reserves specific ranges for IPv4 private addressing — though as covered in more detail below, the underlying mechanics work quite differently.
2. In practice, ULAs almost always start with fd. The fc00::/7 block splits into two halves based on a specific bit (the “L” bit, detailed in the official specification later in this article): addresses starting with fd00::/8 are locally generated and the most commonly used in real deployments, while the fc00::/8 half is reserved for a centrally assigned scheme that has never been formally implemented.
3. Does IPv6 actually need private addresses? Given that IPv6’s address space is vast enough to assign a public address to every device without exhausting the pool, ULA might seem unnecessary — but it still serves real purposes: allowing internal communication on a network that isn’t connected to the internet at all, providing addressing stability that doesn’t change even if a network’s public IPv6 prefix changes (such as when switching ISPs), and adding a layer of separation for internal-only services that shouldn’t be directly reachable from the internet.
4. ULAs are not translated the way IPv4 private addresses are. This is one of the biggest conceptual differences from IPv4: private IPv4 addresses require NAT to communicate with the internet, since they can’t be routed publicly at all. IPv6 devices, by contrast, typically have both a ULA for internal stability and a separate global unicast address for actual internet communication, used side by side rather than being translated into one another.

With the core concept established, it’s worth clarifying how ULA relates to another address type you’ll often see automatically assigned on an IPv6 network — Link-Local addresses — since the two are easy to confuse but serve very different purposes.

Unique Local Address (ULA) vs. Link-Local Address: What’s the Difference?

Both ULA and Link-Local addresses are non-routable on the public internet, which is why they’re frequently confused — but they operate at very different scopes and are used for different purposes.

Key distinction: think of a Link-Local address as something every IPv6 device has automatically just to function at all on its immediate network segment, while a ULA is something a network administrator deliberately sets up to give devices a stable, private address usable across an entire internal network — much closer in purpose to what IPv4’s private ranges provide.

How to Generate and Configure a Unique Local IPv6 Address

Setting up ULA addressing on your own network involves generating a properly formatted prefix and then configuring your devices or router to assign addresses from it.

1. Understand the ULA address structure. A ULA is built from three parts: the fixed fd prefix (1 byte), a randomly generated 40-bit Global ID (5 bytes) that makes your specific prefix statistically unique, and a 16-bit Subnet ID that lets you divide your network into multiple subnets, followed by the 64-bit interface identifier for the individual device.
2. Generate a random 40-bit Global ID. This is the critical step that keeps your ULA prefix from colliding with another network’s, should the two ever be connected (for example, via a VPN or merger). Rather than picking this value arbitrarily, it should be generated using a proper randomization method — a ready-to-use script for this is provided in the next section.
3. Assemble your full ULA prefix. Combine the fixed fd prefix with your generated Global ID to form a /48 prefix, for example: fd12:3456:789a::/48. This is the prefix your entire private network will be built from.
4. Divide the prefix into subnets using the Subnet ID. Within your /48 prefix, you can create up to 65,536 individual /64 subnets by varying the Subnet ID field — for instance, fd12:3456:789a:0001::/64 for one subnet and fd12:3456:789a:0002::/64 for another.
5. Configure your router to advertise the ULA prefix. On most routers or Layer 3 switches supporting IPv6, this involves enabling Router Advertisement (RA) for the chosen /64 subnet, so connected devices can automatically configure their own ULA address via SLAAC (Stateless Address Autoconfiguration), similar to how IPv6 handles global address assignment.
6. Alternatively, assign ULA addresses via DHCPv6. If your network uses DHCPv6 for more centralized control rather than SLAAC, configure the DHCPv6 server’s address pool to hand out addresses from within your /64 ULA subnet instead.
7. Verify assignment on a connected device. Check a device’s network configuration (for example, ipconfig on Windows or ifconfig/ip addr on macOS/Linux) to confirm it has received an address beginning with your fd prefix, alongside its Link-Local address (covered above) and any global IPv6 address it may also hold.
8. Keep the prefix consistent across your network’s lifetime. Since one of ULA’s main benefits, as noted earlier, is addressing stability, avoid regenerating your Global ID once devices are relying on it — treat it as a long-term, foundational value for your network, similar to how a home network’s IPv4 private range is rarely changed once established.

The most important and most commonly outsourced step in that process is generating a properly random 40-bit Global ID in the first place — which is exactly what the following script handles directly.

ULA Generator: Script for a Random RFC 4193-Compliant Prefix

Rather than relying on an online tool, you can generate a compliant random Global ID locally using a short script, following the algorithm described in the official specification (detailed further below). bash

#!/bin/bash
# Generates a random RFC 4193-compliant IPv6 ULA /48 prefix

# Generate 5 random bytes (40 bits) for the Global ID
GLOBAL_ID=$(openssl rand -hex 5)

# Format into the fd00::/8 ULA prefix structure
ULA_PREFIX="fd${GLOBAL_ID:0:2}:${GLOBAL_ID:2:4}:${GLOBAL_ID:6:4}::/48"

echo "Your randomly generated ULA prefix is:"
echo "$ULA_PREFIX"
echo ""
echo "Example /64 subnet from this prefix:"
echo "${ULA_PREFIX%::/48}:0001::/64"

How this works: the script uses openssl rand to generate 5 cryptographically random bytes (40 bits), matching the Global ID size defined by the specification, then formats those bytes into the standard fd + Global ID structure to produce a complete /48 ULA prefix. Run it once when setting up your network, and treat the resulting prefix as the fixed starting point for the subnetting and configuration steps covered above — regenerating it later would mean reassigning addresses across your entire network.

If you’d rather not run a script yourself, several web-based ULA generators implement this same random-generation logic through a simple form, producing an equivalent result without needing a terminal.

RFC 4193: The Official IPv6 ULA Specification

For the authoritative technical definition behind everything covered in this article, the IETF’s RFC 4193, titled “Unique Local IPv6 Unicast Addresses,” is the governing standard.

Defining document: RFC 4193, published by the Internet Engineering Task Force (IETF) in October 2005, formally defines the Unique Local Address format, generation algorithm, and intended use.

Address format defined: The RFC specifies a 128-bit address structure consisting of a 7-bit prefix (1111 110), a 1-bit “L” flag, a 40-bit Global ID, a 16-bit Subnet ID, and a 64-bit Interface ID — the same structural breakdown referenced in the configuration steps above.

The L bit: When set to 1, the L bit indicates the prefix was locally generated (resulting in the fd00::/8 range used in virtually all real-world deployments, as noted earlier); a value of 0 was reserved for a centrally assigned allocation method that RFC 4193 explicitly left undefined and has never been formally established.

Global ID generation requirement: The specification mandates that the 40-bit Global ID be generated using a pseudo-random algorithm, explicitly to minimize the probability of collision if two independently addressed private networks are later merged or interconnected — the same requirement the generation script above is built to satisfy.

Routing scope: RFC 4193 specifies that ULA prefixes are not to be advertised or routed on the global internet, and that internet service providers and internet routers should filter any ULA-sourced traffic that reaches them, formally reinforcing the private-only scope described throughout this article.

Where to access it: The full text of RFC 4193 is published and permanently archived by the IETF and can be found through the RFC Editor’s official repository at rfc-editor.org, searchable directly by its number.

From understanding what a ULA actually is and how it compares to a Link-Local address, through generating and configuring one on your own network, to the official specification that defines the whole scheme, IPv6’s approach to private addressing turns out to be both a conceptual cousin of IPv4’s familiar private ranges and a genuinely different system — one built for a world where every device having a public address is the norm, not the exception.

Please follow and like us: