diff --git a/ansible/roles/resolvers/templates/unbound.conf.j2 b/ansible/roles/resolvers/templates/unbound.conf.j2
index 877267a..c5e10e2 100644
--- a/ansible/roles/resolvers/templates/unbound.conf.j2
+++ b/ansible/roles/resolvers/templates/unbound.conf.j2
@@ -59,6 +59,7 @@ server:
 	# interface: 2001:DB8::5
 	# interface: eth0@5003
 	interface: 0.0.0.0
+	interface: ::0
 
 	# enable this feature to copy the source address of queries to reply.
 	# Socket options are not supported on all platforms. experimental.
@@ -252,7 +253,7 @@ server:
 	do-ip4: yes
 
 	# Enable IPv6, "yes" or "no".
-	do-ip6: no
+	do-ip6: yes
 
 	# If running unbound on an IPv6-only host, domains that only have
 	# IPv4 servers would become unresolveable.  If NAT64 is available in
@@ -326,6 +327,9 @@ server:
     access-control: 172.1.0.0/15 allow
     access-control: 100.64.0.0/10 allow
     access-control: 216.180.128.0/20 allow
+    access-control: ::0/0 refuse
+    access-control: ::1 allow
+    access-control: 2606:1c80::/32 allow
 
 	# tag access-control with list of tags (in "" with spaces between)
 	# Clients using this access control element use localzones that