0

I have set up a Wireguard server on a VM running on top of Ubuntu and a couple of clients. I have also installed Pi-Hole on the same VM and I am using the public IP address for DNS resolving configuration on the clients. IPv4 is working just fine but IPv6 isn't. Here is my server configuration:

# Server Configuration
[Interface]
Address = 172.16.0.1/27, fc00:xxx:xxx::1/64
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ListenPort = 51820
PreUp = iptables -t nat -A POSTROUTING -s 172.16.0.0/27  -o eth0  -j MASQUERADE; ip6tables -t nat -A POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 172.16.0.0/27  -o eth0 -j MASQUERADE; ip6tables -t nat -D POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE

# Laptop 1
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
AllowedIPs = 172.16.0.2/32, fc00:xxx:xxx::2/128

# Phone
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.3/32, fc00:xxx:xxx::3/128

# Laptop 2
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.4/32, fc00:xxx:xxx::4/128

And this is my client's configuration:

[Interface]
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Address = 172.16.0.4/27, fc00:xxx:xxx::4/64
DNS = <VM_Public_IP>, 2001:4860:4860::8888

[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Endpoint = <VM_Public_IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0

So I am having a ping to the IPv6 address of the Wireguard server but not to the Google's IPv6 DNS, which is configured as IPv6 DNS server (2001:4860:4860::8888) on the client. I guess this is a problem of the IPv6 configuration. I have enabled ipv6 forwarding on the server side using:

$ sudo sysctl -p /etc/sysctl.d/wireguard.conf  
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

[EDIT]: Apparently the VM has a separate interface for the IPv4 and another one for the IPv6 connectivity, so I did: ping6 ipv6.google.com -I eth0/1/2 and found out that only on the eth2 there is IPv6 connectivity. So I have changed the iptables rules for IPv6 to -s fc00:xxx:xxx::/64 -o eth2 on the server and restarted the Wireguard sudo systemctl stop wg-quick@wg0 && sudo systemctl start wg-quick@wg0 on the server and on the client afterward, I had a working IPv6 connectivity.

I hope that this will help someone in the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.