IPv6 proxies can be good, but not for the reason they are sold. The pitch is volume: millions of fresh addresses for the price of a few IPv4 ones. A site that scores IPv6 does not count addresses, though. It counts prefixes, because a single home is usually handed a whole /64 or more, and every device in it can pick any address inside. Many fresh addresses from one /64 look like one household, not many people.
Why one house has billions of addresses
An IPv6 address is 128 bits. By convention the first 64 are the network and the last 64 are the interface, the device. A home router gets a prefix from the ISP and announces a /64 on the local network. Each phone and laptop then makes up its own last 64 bits, usually with privacy extensions that pick a new random value every so often, so the same laptop shows a site a different address from one day to the next.
ISPs also hand out more than one /64. RFC 6177, the IETF's advice on how much space an end site should get, stopped recommending a /48 for everyone but still says a home should get more than a single /64, so it can run more than one network. In practice a household may hold a /64, a /60 or a /56, depending on the ISP.
So the address a site sees tells it less than an IPv4 address would. The last 64 bits change on their own. The prefix stays.
Paste one gateway line. Every profile mints its own exitIn Mosaic: Provider minting. One gateway line, a separate exit for every profile. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
How it works: Provider minting
How sites count IPv6
Think about what that means for anything that rate-limits, blocks or scores by address. Blocking one IPv6 address is pointless when the same machine can pick another in milliseconds. So systems that take IPv6 seriously aggregate it: by /64 at least, often wider, up to the whole block an ISP or hosting company was assigned. A reputation list that flags one address in a /64 tends to colour the neighbours too.
For a person running several accounts they are entitled to run, say an agency with one profile per client, that has a plain consequence:
| What your profiles exit from | What a prefix-scoring site sees |
|---|---|
| Ten addresses in one /64 | one network, one household |
| Ten addresses in one hosting company's /48 | one datacentre customer |
| Ten residential exits in ten ISPs' prefixes | ten households |
The first two rows are what a cheap IPv6 package often is: one block, carved into as many /128s as you want to buy. The address count on the invoice is real. The number of places those addresses come from may be one.
When an IPv6 proxy is the right tool
It works best when three things are true. The sites you need publish an IPv6 address (many still publish only IPv4, and an IPv6-only exit simply cannot reach them). Each exit you use sits in its own prefix. And the network it belongs to is one a person would plausibly browse from, which a hosting company's block usually is not.
A dual-stack residential exit is a different thing from a sold IPv6 block. It is someone's home connection with an IPv4 address and a prefix, and a site that reaches it sees whichever family the connection used. Our own proxy check once read that pair as a rotating pool, three checks in a row, before we taught it that an IPv4 and an IPv6 address from one proxy is one exit.
Checking whether two exits share a /64
Expand any :: shorthand and compare the first four groups. These two (documentation addresses) are the same network:
2001:db8:7c3e:5dc4::d565
2001:db8:7c3e:5dc4:91a0:2b17:4c0e:8f33
These two are not, though they share a /48:
2001:db8:7c3e:5dc4::d565
2001:db8:7c3e:9a10::12
Do the same with your own connection. If an IPv6 address on a proxy check shares its first four groups with the address your machine shows with no proxy, a request went around the proxy. WebRTC is the usual way that happens, because it gathers candidates over UDP that an HTTP proxy never carries (the candidate your proxy never carried).
What Mosaic does with IPv6 exits
Mosaic's proxy check samples the exit twice, a location lookup and a tunnel probe, and compares the two addresses only within one family. An IPv4 and an IPv6 address from two probes are not evidence that the exit moved, because they cannot be compared at all.
It does not group exits by prefix for you. Two saved proxies on one /64 are, to Mosaic, two addresses. So the prefix check above is yours to make before you trust a block to separate accounts. The way Mosaic does help is upstream of that: paste a seller's gateway line as a provider and every profile mints its own session id, so each profile asks the seller for its own exit instead of sharing one (forty profiles, forty exits has the measurement). Whether those exits land in different households is the seller's pool, and it is worth reading a few of them by hand before relying on it.
