Your connection can be fluent in two internet languages, or in one and a half. Dual stack is the fluent version, and the one a game server at home likes best.
The short answer
Dual stack means a device or connection runs IPv4 and IPv6 side by side [1]. A dual-stack connection has been given an address of each kind [2]. DS-Lite is the common alternative: the provider shares IPv4 addresses among its customers using an IPv4-in-IPv6 tunnel and NAT, so you have no public IPv4 address of your own [2][5]. Our assessment: for gaming and home servers, dual stack is the easy case. With DS-Lite, other players can reach you only over IPv6 or through ports the provider grants [4][5].
How it works
- Two protocols at once. RFC 4213 defines dual stack as a complete implementation of both IPv4 and IPv6 [1]. The other mechanism it describes, configured tunnelling, carries IPv6 over IPv4 infrastructure [1].
- Capable versus provisioned. RFC 6333 separates a dual-stack-capable device, which has code for both protocols, from a dual-stack-provisioned device, which has been given both an IPv4 and an IPv6 address [2].
- Why DS-Lite exists. RFC 6333 notes that the IANA free pool of IPv4 addresses ran out before IPv6 was widely deployed. DS-Lite lets a provider share IPv4 addresses among customers by combining an IPv4-in-IPv6 tunnel with NAT [2].
- What it means for reachability. AVM lists who can reach its routers from the internet (table below) [4].
- How to check your line. In the FRITZ!Box, Internet, Online Monitor shows the "Internet, IPv4" and "Internet, IPv6" lines. An IPv4 address from 10.0.0.0/8, 100.64.0.0/10 (carrier-grade NAT), 172.16.0.0/12, 192.0.0.0 to 192.0.0.7 (DS-Lite) or 192.168.0.0/16 cannot be reached from the internet [4]. Any other range is a public IPv4 address [4].
- Clients try both. Happy Eyeballs (RFC 8305) has a client send the AAAA (IPv6) and A (IPv4) DNS queries almost together, start with IPv6, wait 50 ms for a late AAAA answer, and then try the next address after 250 ms by default [3]. On a dual-stack line the fallback is quick.
- The firewall decides. AVM's routers reject unsolicited incoming data by default [6]. Our assessment: with IPv6, no NAT sits in front of your devices, so the router's firewall rules are what protects them. Check them.
Reachability by connection type [4]:
| Connection | Reachable via IPv6 | Reachable via IPv4 |
|---|---|---|
| IPv4 only | no | yes |
| IPv6 only | yes | no |
| IPv6, IPv4 via carrier-grade NAT | yes | no |
| Dual stack (IPv6 and IPv4) | yes | yes |
| DS-Lite | yes | no |
| DS-Lite with PCP | yes | only on ports set by the provider |
AVM adds that mobile network providers usually block incoming connections [4]. IPv6 access works only if both sides have IPv6, which not every mobile network or hotspot offers [5].
A practical example
You want friends to join a game server you run at home. First read the Online Monitor and compare the IPv4 address with the ranges above [4]. On a dual-stack line, forward the IPv4 port and allow the server in the IPv6 firewall. Add an AAAA record next to the A record if you publish a name [3]. On DS-Lite, friends need IPv6 or ports your provider grants through PCP [4][5]. Test from outside your network, for example with test-ipv6.com on a phone [4]. Our inventory (as of 14 to 16 Oct 2026) lists a UniFi router and firewall; whether our line is dual stack or DS-Lite is not recorded, so we claim neither.
Checklist
- Read both address lines in your router's overview [4].
- Compare the IPv4 address with the non-public ranges [4].
- Test IPv6 and IPv4 from a network outside yours [4].
- On DS-Lite, ask your provider whether PCP is available [4][5].
- Publish an AAAA record next to the A record for names that should work over IPv6 [3].
- Review the router's IPv6 firewall rules before you open a server port [6].