IPv6 /48 prefix: 65,536 /64 subnets

An IPv6 /48 holds 65,536 /64 subnets, or 2^80 = 1,208,925,819,614,629,174,706,176 addresses. The first three groups are fixed, so everything in 2001:db8::/48 starts with 2001:db8:0:. The fourth group is the subnet ID, from 0 to ffff, and the last four groups are the interface ID inside each /64.

The numbers

Network          2001:db8::/48
First host       2001:db8::1
Last host        2001:db8:0:ffff:ffff:ffff:ffff:ffff
Addresses        1208925819614629174706176
Usable hosts     1208925819614629174706175
First /64s       2001:db8::/64, 2001:db8:0:1::/64, 2001:db8:0:2::/64 …
Last /64         2001:db8:0:ffff::/64

The tool counts one address fewer as usable: the first, 2001:db8::, is the Subnet-Router anycast address (RFC 4291 section 2.6.1).

How it fits

A /32 holds 65,536 /48s, a /40 holds 256 and a /44 holds 16. A /48 splits into 16 /52s, 256 /56s or 65,536 /64s. The tool below lists the first 256 /64s; split into /52 or /56 instead to see the larger units.

Where you’ll see it

• A site’s allocation. RIPE-690, the RIPE community’s best practice for end-user prefixes, recommends a /48 for business customers, and ARIN’s smallest direct assignment to an end-user organization is a /48. RFC 3177 once recommended a /48 for every site; RFC 6177 dropped the one-size rule and asks only that a site get room for multiple subnets, which in practice means a /48 or a /56.
• The global routing table. /48 is the longest IPv6 prefix most networks accept in BGP, the counterpart of /24 in IPv4, so it’s the smallest block you can announce on your own.
• Unique local addresses. RFC 4193 builds a private /48 from fd00::/8 plus a 40-bit random Global ID, such as fd3a:91c2:6e04::/48; the tool labels it Unique local (fc00::/7).

Planning the subnet ID

Sixteen bits leave room for structure. A common practice is to split on nibble boundaries, one hex digit per level, so each level reads straight off the address: the /52s are 2001:db8::/52, 2001:db8:0:1000::/52 … 2001:db8:0:f000::/52, one per region or building, and inside 2001:db8:0:1000::/52 the /56s are 2001:db8:0:1000::/56, 2001:db8:0:1100::/56, 2001:db8:0:1200::/56 and on, one per floor or function.

Gotchas

• Stop at /64. Hosts that configure themselves with SLAAC need a /64 per LAN, so the subnet ID is the 16 bits between /48 and /64. The interface ID isn’t for subnetting.
• Generate the ULA Global ID. Picking fd00::/48 by hand, or any easy pattern, makes a collision more likely when two networks merge or connect over a VPN. RFC 4193’s random 40 bits exist to prevent that.

In your stack

# Terraform: the second /64, the second /56 and the last /64 of the site
cidrsubnet("2001:db8::/48", 16, 1)        # "2001:db8:0:1::/64"
cidrsubnet("2001:db8::/48", 8, 1)         # "2001:db8:0:100::/56"
cidrsubnet("2001:db8::/48", 16, 65535)    # "2001:db8:0:ffff::/64"

import ipaddress
site = ipaddress.ip_network("2001:db8::/48")
sum(1 for _ in site.subnets(new_prefix=64))     # 65536

ip6tables -A INPUT -s 2001:db8::/48 -p tcp --dport 22 -j ACCEPT
nft add rule inet filter input ip6 saddr 2001:db8::/48 tcp dport 22 accept