2

I have set up a Wireguard server on a VM running on top of Ubuntu and a couple of clients. I have also installed Pi-Hole on the same VM and I am using the public IP address for DNS resolving configuration on the clients. IPv4 is working just fine but IPv6 isn't. Here is my server configuration:

# Server Configuration
[Interface]
Address = 172.16.0.1/27, fc00:xxx:xxx::1/64
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ListenPort = 51820
PreUp = iptables -t nat -A POSTROUTING -s 172.16.0.0/27  -o eth0  -j MASQUERADE; ip6tables -t nat -A POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 172.16.0.0/27  -o eth0 -j MASQUERADE; ip6tables -t nat -D POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE

# Laptop 1
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
AllowedIPs = 172.16.0.2/32, fc00:xxx:xxx::2/128

# Phone
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.3/32, fc00:xxx:xxx::3/128

# Laptop 2
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.4/32, fc00:xxx:xxx::4/128

And this is my client's configuration:

[Interface]
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Address = 172.16.0.4/27, fc00:xxx:xxx::4/64
DNS = <VM_Public_IP>, 2001:4860:4860::8888

[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Endpoint = <VM_Public_IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0

So I am having a ping to the IPv6 address of the Wireguard server but not to the Google's IPv6 DNS, which is configured as IPv6 DNS server (2001:4860:4860::8888) on the client. I guess this is a problem of the IPv6 configuration. I have enabled ipv6 forwarding on the server side using:

$ sudo sysctl -p /etc/sysctl.d/wireguard.conf  
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

[EDIT]: Apparently the VM has a separate interface for the IPv4 and another one for the IPv6 connectivity, so I did: ping6 ipv6.google.com -I eth0/1/2 and found out that only on the eth2 there is IPv6 connectivity. So I have changed the iptables rules for IPv6 to -s fc00:xxx:xxx::/64 -o eth2 on the server and restarted the Wireguard sudo systemctl stop wg-quick@wg0 && sudo systemctl start wg-quick@wg0 on the server and on the client afterward, I had a working IPv6 connectivity.

I hope that this will help someone in the future.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.