Why IPv6

Exhaustion is the reason IPv6 exists; the redesign is the interesting part. The header is fixed at 40 bytes with no checksum and no fragmentation fields; options moved to chained extension headers, so routers do less per packet. Routers never fragment: only the sender may, and the minimum link MTU is 1280, so path MTU discovery via ICMPv6 "packet too big" is mandatory — filter that ICMP and large packets black-hole. There is no broadcast; ARP is replaced by Neighbor Discovery over ICMPv6 multicast, which also does router discovery, prefix advertisement and duplicate address detection. Hosts can configure themselves from router advertisements (SLAAC) without DHCP, and every interface has a link-local fe80::/10 address in addition to global ones.

Addresses are 128 bits written as eight hex groups with :: compressing one run of zeros; subnets are /64 by convention; a host typically has several addresses at once (link-local, global, temporary privacy addresses that rotate). With global addresses everywhere, NAT is unnecessary, so end-to-end connectivity returns and the firewall must explicitly do what NAT did implicitly.

Dual-stack is where things break. A name with both A and AAAA records makes clients try IPv6 first; if the IPv6 path is broken (advertised but not routed, firewall rules only written for IPv4, a load balancer with no v6 listener) clients hang or fall back slowly — Happy Eyeballs in browsers races both to hide this, but many server-side HTTP clients do not. Firewalls, security groups, allow-lists and logging all need to be done twice, and a service that "works" may be reachable on one family only.