What is Unique Local Address?

Understanding Unique Local Address

A Unique Local Address (ULA) is an IPv6 address reserved for private, internal use within a site or organization, defined in RFC 4193. ULAs use the fc00::/7 prefix (in practice fd00::/8 with a randomly generated 40-bit Global ID) and are not routable on the public internet, making them the rough IPv6 equivalent of IPv4 private (RFC 1918) addresses.

A ULA prefix is built from the fd prefix plus a pseudo-randomly chosen 40-bit Global ID, a 16-bit subnet ID, and a 64-bit interface identifier. The random Global ID makes collisions statistically unlikely, so two organizations can independently use ULAs and still merge or interconnect networks (via VPN) with minimal renumbering. Routers are expected to drop ULA-sourced packets at the boundary so they never leak onto the global internet, and ULAs are typically used alongside global unicast addresses in a dual-addressing scheme.

ULAs matter for security because they provide stable, internal-only addressing for infrastructure, management interfaces, and inter-site links that should never be reachable from outside. Using ULAs for back-end systems reduces external attack surface and avoids exposing hosts that have no business being publicly routable. However, ULAs are not a security control by themselves; like NAT in IPv4, they hide nothing if a firewall is misconfigured, so perimeter filtering must still enforce the boundary.

For example, an organization assigns an fd-prefix ULA range to its storage network and out-of-band management switches. These devices get reliable, conflict-resistant internal IPv6 addresses that border routers refuse to forward externally. Even if an internet-facing application server is compromised, the attacker cannot directly route to the management plane, because those ULA destinations are unreachable from outside the site.