Skip to main content

Dual-Stack IPv4/IPv6 Support

EntryGuard supports both IPv4 and IPv6 addresses, automatically detecting and whitelisting both protocols when available.

Automatic IP Detection​

When you click Start Session, EntryGuard automatically detects your current IP address(es) from your connection. You can see your detected addresses on the Dashboard under Your IP Addresses.

  • IPv4 addresses are displayed with a v4 badge
  • IPv6 addresses are displayed with a v6 badge

If your network supports dual-stack (both IPv4 and IPv6), EntryGuard creates separate rules for each protocol on every resource, ensuring access regardless of which protocol your application uses.

CIDR Notation​

EntryGuard applies the most restrictive CIDR notation for single-host access:

IP VersionExampleCIDRMeaning
IPv4203.0.113.42/32Single host
IPv62001:db8::1/128Single host

Network Scenarios​

IPv4-Only Network​

If your network only has IPv4, the session will show a single IP with a v4 badge per resource. This is the most common scenario.

Dual-Stack Network​

If your network has both IPv4 and IPv6, the session will show two IPs per resource — one v4 and one v6. Both are whitelisted independently.

IPv6-Only Network​

If your network only has IPv6 (common on mobile networks), the session will show a single IP with a v6 badge per resource.

info

If you don't see an IPv6 address on your dashboard but expect one, your network may not support IPv6, or a proxy/VPN may be hiding it.

Cloud Provider Compatibility​

AWS Security Groups​

  • Full IPv4 and IPv6 support (when VPC has IPv6 CIDR block)
  • Separate ingress rules for each protocol
  • EntryGuard creates distinct rules per IP version

APISIX​

APISIX route-level IP whitelisting supports both IPv4 and IPv6 addresses.

Future Providers​

GCP and Azure dual-stack support will follow each provider's IPv6 capabilities as they are implemented.

Viewing IP Details in Sessions​

On the Sessions page, click a session row to expand it. The per-resource details show:

  • IP — The specific address whitelisted (v4 or v6)
  • Status — Whether the rule was applied successfully

In dual-stack scenarios, you'll see separate entries for the IPv4 and IPv6 rules on each resource, with independent statuses.

Troubleshooting​

Only One IP Version Detected​

Your client may prefer one protocol, or a proxy/load balancer may only forward one IP. Check your dashboard's Your IP Addresses section to see what EntryGuard detects.

IPv6 Rule Fails to Apply​

The cloud resource (e.g., AWS Security Group) may not support IPv6 if the VPC doesn't have an IPv6 CIDR block. The session will show PARTIAL status with the IPv4 rule applied and the IPv6 rule failed. Configure IPv6 in your cloud infrastructure to resolve this.

Different IP Than Expected​

If you're behind a proxy, VPN, or NAT, your detected IP may differ from your local IP. Check the Your IP Addresses section on your dashboard to verify what EntryGuard sees.

API Reference: For programmatic access, see Start Session and Detect IP.