Solution:
I have vps.
Vps have 1 ipv4 addr and 64 ipv6 subnet(presumable)
I trying to setup Wireguard server so it will provide nated ipv4 and real ipv6 ips to clients.
No matter what I do I cannot make ipv6 work. ipv4 is working fine.
Trace route on WG client reaches only server WG interface ip.
On server i am using IPWF (I tried with firewall completely disabled, and don't see any blocked ipv6 packets when its enabled)
rc.conf:
/usr/local/etc/wireguard/wg0.conf:
wg_client.conf:
doas netstat -rn:
From client:
tracepath -6 www.google.com:
...
I am narrowing this down. For some reason.
ipv6 works ONLY for peer with ...xxx:200::2/72 address.
...xxx:200::3/72, ...xxx:200::30/72 etc - no ipv6 connectivity. Even if they the first and only one peer I add by hand.
Not using wg-quick.
Firewall is disabled.
Code:
Ok. So. Things are actually stupid.
And sad, considering how hard it was to find the answer.
Hoster do not route 64 prefix to me. So, I need to use ndproxy or something.
ndp - utility ended up completely not helpful.
ndproxy - is doing something, probably. Useless it seems for Wireguard.
REALLY strange that I cannot just mock neighbor solicitation responses for needed addresses.
So. Solution for now, make temp aliases on wan interface with desired IPs and ping internet so hoster router learn where to send packets.
🤣I have vps.
Vps have 1 ipv4 addr and 64 ipv6 subnet(presumable)
I trying to setup Wireguard server so it will provide nated ipv4 and real ipv6 ips to clients.
No matter what I do I cannot make ipv6 work. ipv4 is working fine.
Trace route on WG client reaches only server WG interface ip.
On server i am using IPWF (I tried with firewall completely disabled, and don't see any blocked ipv6 packets when its enabled)
Code:
14.3-RELEASE FreeBSD 14.3-RELEASE releng/14.3-n271432-8c9ce319fef7 GENERIC amd64rc.conf:
sh:
clear_tmp_enable="YES"
hostname="push-nyan"
ifconfig_vtnet0="inet xxx.xxx.25.180 netmask 255.255.255.0"
defaultrouter="xxx.xxx.25.1"
ifconfig_vtnet0_ipv6="inet6 2a0d:xxxx:xxxx:xxxx:200::1 prefixlen 72"
ipv6_static_routes="wan_net"
ipv6_route_wan_net="-net 2a0d:xxxx:xxxx::/48 -iface vtnet0"
ipv6_defaultrouter="2a0d:xxxx:xxxx::1"
sshd_enable="YES"
moused_nondefault_enable="NO"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="NO"
zfs_enable="YES"
qemu_guest_agent_enable="YES"
wireguard_enable="YES"
wireguard_interfaces="wg0"
gateway_enable="YES"
ipv6_gateway_enable="YES"
firewall_enable="YES"
firewall_nat_enable="YES"
firewall_logging="YES"
firewall_script="/etc/nyan_ipfw.pur"/usr/local/etc/wireguard/wg0.conf:
INI:
[Interface]
PrivateKey = xxxx7sLga+3gp193Q=
Address = 10.10.0.1/16
Address = 2a0d:xxxx:xxxx:xxxx:100::1/72
ListenPort = 41313
MTU=1400
[Peer]
PublicKey = xxxxKT1qcyFkBTiOocww1jq0js2Qg=
AllowedIPs = 10.10.0.2/32, 2a0d:xxxx:xxxx:xxxx:100::2/128
[Peer]
PublicKey = xxxxbiQyVf3EfYlx29EIdCs6AdX+WrS4=
AllowedIPs = 10.10.0.3/32, 2a0d:xxxx:xxxx:xxxx:100::3/128wg_client.conf:
INI:
[Interface]
PrivateKey = xxxxxxx+PxNk8DO8ZcQg/fg/o3+wEHoACsgG8=
Address = 10.10.0.2/16, 2a0d:xxxx:xxxx:xxxx:100::2/72
DNS = 1.1.1.1, 8.8.8.8
MTU=1400
[Peer]
PublicKey = xxxxxjuF6pjDrVwuCL0NccfCZ9WqjGGfR8=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = xxx.xxx.25.180:41313
PersistentKeepalive = 22doas netstat -rn:
Code:
Internet:
Destination Gateway Flags Netif Expire
default 93.113.25.1 UGS vtnet0
10.10.0.0/16 link#3 U wg0
10.10.0.1 link#2 UHS lo0
10.10.0.2 link#3 UHS wg0
10.10.0.3 link#3 UHS wg0
xxx.xxx.25.0/24 link#1 U vtnet0
xxx.xxx.25.180 link#2 UHS lo0
127.0.0.1 link#2 UH lo0
Internet6:
Destination Gateway Flags Netif Expire
::/96 link#2 URS lo0
default 2a0d:8140:1fff::1 UGS vtnet0
::1 link#2 UHS lo0
::ffff:0.0.0.0/96 link#2 URS lo0
2a0d:xxxx:xxxx::/48 link#1 US vtnet0
2a0d:xxxx:xxxx:xxxx:100::/72 link#3 U wg0
2a0d:xxxx:xxxx:xxxx:100::1 link#2 UHS lo0
2a0d:xxxx:xxxx:xxxx:200::/72 link#1 U vtnet0
2a0d:xxxx:xxxx:xxxx:200::1 link#2 UHS lo0
fe80::%lo0/10 link#2 URS lo0
fe80::%vtnet0/64 link#1 U vtnet0
fe80::be24:11ff:fe86:fbe%lo0 link#2 UHS lo0
fe80::%lo0/64 link#2 U lo0
fe80::1%lo0 link#2 UHS lo0
ff02::/16 link#2 URS lo0From client:
tracepath -6 www.google.com:
Code:
1?: [LOCALHOST] 0.050ms pmtu 1400
1: 2a0d:xxxx:xxxx:xxxx:100::1 34.739ms
1: 2a0d:xxxx:xxxx:xxxx:100::1 35.051ms
2: no reply
3: no reply
......
I am narrowing this down. For some reason.
ipv6 works ONLY for peer with ...xxx:200::2/72 address.
...xxx:200::3/72, ...xxx:200::30/72 etc - no ipv6 connectivity. Even if they the first and only one peer I add by hand.
Not using wg-quick.
Firewall is disabled.
Last edited:
