In the context of CentOS server administration, certain business scenarios or legacy hardware environments may not require IPv6. In some cases, the preference for IPv6 in a dual-stack configuration can even cause network connectivity issues—for instance, if a cloud instance attempts to prioritize IPv6 despite the IPv6 link being non-functional, it can degrade overall access speeds.

However, disabling IPv6 is not a single-step process. In CentOS, IPv6 involves multiple layers, including kernel modules, the network stack, NetworkManager configurations, and service dependencies. Overlooking any of these layers can lead to confusing situations—such as `ip addr` showing no `inet6` addresses, while `ss -tuln` still indicates that services are listening on `:::22` (IPv6). The correct approach is to address the issue layer by layer, verifying each one.

Layer 1: Temporary Disabling (Immediate effect, lost upon reboot)

If you are troubleshooting an issue and do not wish to reboot the server, you can adjust the kernel runtime parameters directly:

sysctl -w net.ipv6.conf.all.disable_ipv6=1

sysctl -w net.ipv6.conf.default.disable_ipv6=1

sysctl -w net.ipv6.conf.lo.disable_ipv6=1

These changes take effect immediately but will be reset after a reboot. This method is suitable for quickly verifying whether an issue is related to IPv6, but it is not appropriate for long-term production environments.

Layer 2: Permanent Disabling via `sysctl` (Kernel module remains loaded)

To ensure the configuration persists after a reboot, you must add these parameters to a configuration file. Edit `/etc/sysctl.conf` (or a separate file within `/etc/sysctl.d/`) and add the following three lines:

ini

net.ipv6.conf.all.disable_ipv6=1

net.ipv6.conf.default.disable_ipv6=1

net.ipv6.conf.lo.disable_ipv6=1

After saving the file, run `sysctl -p` to apply the changes.

It is important to understand that this `sysctl` layer only "disables the network stack"—the `ipv6` kernel module remains loaded. It simply prevents the assignment of addresses to network interfaces and stops the system from responding to neighbor discovery requests. Consequently, the module will still appear in the output of `lsmod | grep ipv6`. For the vast majority of use cases, this level is sufficient; however, if you need to completely prevent the kernel from loading the IPv6 module, you must proceed to the next level.

Level 3: Complete Disablement via GRUB Kernel Parameters (Requires Reboot)

To ensure the kernel does not load the IPv6 module during boot, you must modify the GRUB boot parameters. Edit `/etc/default/grub` and append `ipv6.disable=1` to the `GRUB_CMDLINE_LINUX` line. For example:

ini

GRUB_CMDLINE_LINUX="crashkernel=auto rhgb quiet ipv6.disable=1"

Note: CentOS 7/8 uses `GRUB_CMDLINE_LINUX`, not `GRUB_CMDLINE_LINUX_DEFAULT` (which is mentioned in some tutorials). After making this change, you must regenerate the GRUB configuration; otherwise, the parameters will not take effect after a reboot:

grub2-mkconfig -o /boot/grub2/grub.cfg

reboot

Verify after reboot: Running `lsmod | grep ipv6` should yield no output, indicating that the kernel has not loaded the IPv6 module at all. This is the most thorough method of disablement, but it requires modifying boot parameters and performing a reboot—actions that should be scheduled during a maintenance window in production environments.

Level 4: NetworkManager/Interface Configuration (Required for CentOS 8+)

In CentOS 8 and its Stream versions, even if IPv6 has been disabled at the kernel and `sysctl` levels, NetworkManager may still attempt to enable IPv6 for connections, resulting in an incomplete configuration. In such cases, you must use `nmcli` to explicitly instruct NetworkManager to ignore IPv6:

# List connection names

nmcli connection show

# Set the IPv6 method for the target connection to 'disabled'

nmcli connection modify "connection_name" ipv6.method "disabled"

# Reactivate the connection for the configuration to take effect

nmcli connection up "connection_name"

Setting `ipv6.method` to `disabled` prompts NetworkManager to proactively configure the corresponding `sysctl` values ​​within the kernel and cease managing IPv6 for that specific connection. Verification method: Run `ip address show <interface_name>`. If there are no `inet6` entries in the output, IPv6 is successfully disabled for that interface.

For CentOS 7 environments using the legacy `network-scripts`, you must explicitly disable IPv6 initialization within the `/etc/sysconfig/network-scripts/ifcfg-<interface>` file:

ini

IPV6INIT=no

IPV6_AUTOCONF=no

IPV6_DEFROUTE=no

IPV6_PEERDNS=no

IPV6_FAILURE_FATAL=no

This prevents DHCP or autoconfiguration from re-enabling IPv6 when the interface is brought up.

Layer 5: Service Dependencies — SSH `AddressFamily`

This is the most frequently overlooked aspect. Even if IPv6 has been disabled at the network layer, the default `sshd` configuration—`AddressFamily any`—will still cause it to listen on `:::22` (an IPv6 socket). If the IPv6 stack has been disabled, SSH may fail to bind correctly, or it may generate a large number of warnings in the logs.

The correct approach is to explicitly configure SSH to use only IPv4. Edit `/etc/ssh/sshd_config` and ensure it contains:

ini

AddressFamily inet

Then, restart the SSH service:

systemctl restart sshd

This ensures that SSH will not attempt to bind to an IPv6 socket, remaining consistent with the overall objective of disabling IPv6.

Verification: A Three-Layer Check to Ensure IPv6 Has Truly "Vanished"

Once the configurations above are complete, verify the setup as follows:

First, at the kernel module level: run `lsmod | grep ipv6`. If GRUB parameters were used, there should be no output; if only `sysctl` was used, the module may still appear.

Second, at the network interface level: run `ip -6 addr show` or `ip addr show <interface>`. No `inet6` addresses should be present (even `fe80::` link-local addresses should be gone).

Third, at the listening port level: run `ss -tuln | grep -E ':::|tcp6'`. No services should be listening on IPv6 wildcard addresses. If output still appears, it indicates that certain services (such as `sshd`, `nginx`, or `postfix`) have not yet had their `AddressFamily` or `listen[::]` configurations adjusted; these must be investigated one by one.

Underlying Network: A Stable IPv4 Link is a Prerequisite for Disabling IPv6

Once IPv6 is disabled, all traffic is routed through the IPv4 stack. If the underlying IPv4 connection is of poor quality, disabling IPv6 will not "accelerate" the network; instead, it may expose issues—previously bypassed via IPv6—as bottlenecks within the IPv4 path itself.

Jtti’s cloud server solutions provide robust infrastructure support for IPv4 networks. Their Hong Kong and U.S. nodes utilize premium CN2 GIA routes with optimized direct connectivity across all three major Chinese carriers, maintaining a packet loss rate of under 0.5% even during peak evening hours. With IPv6 disabled, all service traffic flows through this high-quality IPv4 channel, ensuring that no new latency or stuttering arises from packet loss or inefficient routing. Every instance comes with dedicated bandwidth, guaranteeing consistent IPv4 throughput unaffected by resource contention from "neighboring" users. A recurring, lifetime discount policy ensures that long-term operational costs remain entirely predictable.

The core logic for disabling IPv6 on CentOS follows a "layered alignment and verification" approach: use `sysctl` for temporary troubleshooting, modify GRUB for a permanent disable, employ `nmcli` (for CentOS 8 and later), and finally, verify the `AddressFamily` setting in SSH. By addressing all five layers and performing cross-verification using the commands `ip addr`, `ss -tuln`, and `lsmod`, you can avoid the common pitfall of believing IPv6 is disabled when it is, in fact, still active.