IPv6 /56 prefix: 256 /64 subnets

An IPv6 /56 holds 256 /64 subnets, or 2^72 = 4,722,366,482,869,645,213,696 addresses. Only the last two hex digits of the fourth group are yours to number: in 2001:db8:0:ab00::/56 the subnets run from 2001:db8:0:ab00::/64 to 2001:db8:0:abff::/64.

The numbers

Network          2001:db8:0:ab00::/56
First host       2001:db8:0:ab00::1
Last host        2001:db8:0:abff:ffff:ffff:ffff:ffff
Addresses        4722366482869645213696
Usable hosts     4722366482869645213695
/64 subnets      2001:db8:0:ab00::/64, 2001:db8:0:ab01::/64 … 2001:db8:0:abff::/64

How it fits

A /48 holds 256 /56s and a /52 holds 16. A /56 splits into 16 /60s, from 2001:db8:0:ab00::/60 to 2001:db8:0:abf0::/60, or 256 /64s.

Where you’ll see it

• Home and small-office internet. Many ISPs delegate a /56 to each customer’s router with DHCPv6 prefix delegation (RFC 8415), and RIPE-690 recommends at least a /56 for residential customers. The router numbers a /64 per LAN, guest network or VLAN from it. Some ISPs delegate only a /60 (16 /64s) or a single /64.
• AWS VPCs. The IPv6 block Amazon assigns to a VPC is a /56, and subnets in it are typically /64s, so a VPC has room for 256 of them.

Gotchas

• The digits are hex. The 256 /64s are numbered 00 to ff, not 0 to 255: the tenth is 2001:db8:0:ab09::/64, and 2001:db8:0:ab10::/64 is the seventeenth.
• Ask for a persistent prefix. If the ISP hands out a different /56 when the router reconnects, every global address on the network changes, and firewall rules or DNS records written against the old prefix break. RIPE-690 recommends that ISPs keep a customer’s prefix stable.
• Write rules at the right level. A rule for the whole network uses the /56; a rule for one LAN uses its /64. A rule written for 2001:db8:0:ab00::/64 covers only the first subnet.

In your stack

# Terraform: the second and tenth /64 of the /56
cidrsubnet("2001:db8:0:ab00::/56", 8, 1)     # "2001:db8:0:ab01::/64"
cidrsubnet("2001:db8:0:ab00::/56", 8, 9)     # "2001:db8:0:ab09::/64"

import ipaddress
home = ipaddress.ip_network("2001:db8:0:ab00::/56")
list(home.subnets(new_prefix=64))[9]         # IPv6Network('2001:db8:0:ab09::/64')

# nftables: let the whole delegated prefix reach the router's DNS
nft add rule inet filter input ip6 saddr 2001:db8:0:ab00::/56 udp dport 53 accept