Hetzner IPv6 Proxy Setup: /64 Subnet, Agent, and First Fleet

Part of our IPv6 proxy management guide series.

Hetzner is one of the most cost-effective hosts for IPv6-heavy proxy fleets. Every Cloud VPS and dedicated root server ships with a routed /64 — the same building block Vultr and OVH use, but often at lower monthly cost.

What Hetzner gives you

Per Hetzner's network documentation, each server receives:

• One primary IPv4 (point-to-point routed)
• A /64 IPv6 subnet routed to the server's link-local address
• IPv6 gateway: fe80::1 on the primary interface (usually eth0 or enp*)

That /64 is not a single address — it is 2⁶⁴ host identifiers you can bind for outbound traffic. Providers standardize on /64 per RFC 4291 LAN segments; the practical limit is your CPU, RAM, and listening ports — not address exhaustion.

Cloud vs dedicated quirks

Hetzner Cloud (CX/CPX): IPv6 is configured via cloud-init in /etc/network/interfaces.d/50-cloud-init. Your primary global address already sits on a /64. MeshProx preflight reads this range automatically.

Older VX/VQ VMs: Some legacy plans used a local /64 with ::1 as gateway instead of full routing. If preflight reports no global range, check the Hetzner console → Networking tab or migrate to a current CX line.

Dedicated root servers: The full /64 routes to your NIC's link-local address. For containers/VMs you may need net.ipv6.conf.all.forwarding=1 and NDP proxy — MeshProx's agent handles AnyIP binding on the host itself, so you typically run proxies on the bare metal or primary VM, not nested guests, unless you forward the subnet.

MeshProx onboarding (recommended path)

Manual Hetzner IPv6 tuning (local routes, ndppd, ip_nonlocal_bind) is documented in community guides like Pieter Bakker's Debian 12/13 Hetzner IPv6 write-up. MeshProx automates the proxy-specific parts:

1. Servers → Add server (public IPv4, SSH key, root or sudo user)
2. Preflight — verifies global /64, RAM/CPU, systemd, opens UFW TCP 20000–60000 on the VPS
3. Install agent — uploads binary, writes systemd unit, connects outbound WSS to the panel
4. Verify proxy — creates one SOCKS5 listener and smoke-tests egress

Generate and export

On Proxies, pick your Hetzner server, choose SOCKS5 or HTTP, set count (100–10,000+), generate. Export CSV or URL list for your scraper.

Hetzner's network is fast (often sub-10ms intra-EU). Pair with static proxies for allowlisted partners or rotating mode when you want a fresh IPv6 per request.

Troubleshooting

| Symptom | Likely cause | Fix | |--------|----------------|-----| | Preflight: no IPv6 range | IPv6 disabled in Cloud console | Enable IPv6 on the server, reboot | | Agent online, proxy timeout | UFW or provider firewall | Re-run preflight → Fix on UFW check | | Exit IP is IPv4 only | Target has no AAAA record | Expected — agent falls back to IPv4 | | Works then all IPs blocked | Target banned your /64 prefix | New VPS in different region/range; slow down concurrency |

Cost snapshot (2026)

Hetzner CX22 (~2 vCPU, 4 GB) often runs €4–6/mo with /64 included. Compared to residential proxy pricing ($5–15/GB per industry benchmarks), self-hosted IPv6 wins on throughput economics when your targets accept datacenter/hosting ASN traffic.

Next steps

• Multi-server? Build a pool gateway with failover
• Rotating campaigns? See rotation without downtime
• Choosing providers? Read IPv6 vs IPv4 proxies