What is Global Unicast Address?

Understanding Global Unicast Address

A global unicast address (GUA) is an IPv6 address that is globally unique and routable across the public internet, identifying a single network interface. It is the IPv6 counterpart to a public IPv4 address, allowing devices to communicate directly end-to-end without network address translation. GUAs are allocated from the 2000::/3 prefix range.

It works through a hierarchical structure that ensures worldwide uniqueness and efficient routing. A typical 128-bit GUA divides into a global routing prefix assigned by registries and ISPs (commonly the first 48 bits), a subnet ID for the organization to segment its network (the next 16 bits), and a 64-bit interface identifier that uniquely identifies the host on its link. The interface ID may be derived from the MAC address via EUI-64 or, for privacy, randomized. Devices commonly obtain GUAs through Stateless Address Autoconfiguration (SLAAC) using router advertisements, or via DHCPv6.

It matters for security because GUAs are directly reachable from the internet by design, eliminating the implicit perimeter that IPv4 NAT provided. Every device with a GUA is potentially exposed, so security must rely on explicit stateful firewalling, host hardening, and access control rather than address translation. Privacy is another concern: an interface ID derived from a MAC address can let remote parties track a device across networks, which is why RFC-defined privacy extensions and randomized identifiers are recommended.

For example, a server hosting a public website is assigned the global unicast address 2001:db8:1234:1::10. Clients anywhere on the IPv6 internet can route packets to it directly using that address — no NAT involved. Because it is openly reachable, the administrator must enforce a stateful firewall permitting only ports 443 and managed SSH, keep the host patched, and rely on those explicit controls for protection, since the address itself offers no obscurity.