I have set up a Wireguard server on a VM running on top of Ubuntu and a couple of clients. I have also installed Pi-Hole on the same VM and I am using the public IP address for DNS resolving configuration on the clients. IPv4 is working just fine but IPv6 isn't. Here is my server configuration:
# Server Configuration
[Interface]
Address = 172.16.0.1/27, fc00:xxx:xxx::1/64
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ListenPort = 51820
PreUp = iptables -t nat -A POSTROUTING -s 172.16.0.0/27 -o eth0 -j MASQUERADE; ip6tables -t nat -A POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 172.16.0.0/27 -o eth0 -j MASQUERADE; ip6tables -t nat -D POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE
# Laptop 1
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.2/32, fc00:xxx:xxx::2/128
# Phone
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.3/32, fc00:xxx:xxx::3/128
# Laptop 2
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 172.16.0.4/32, fc00:xxx:xxx::4/128
And this is my client's configuration:
[Interface]
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Address = 172.16.0.4/27, fc00:xxx:xxx::4/64
DNS = <VM_Public_IP>, 2001:4860:4860::8888
[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Endpoint = <VM_Public_IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0
So I am having a ping to the IPv6 address of the Wireguard server but not to the Google's IPv6 DNS, which is configured as IPv6 DNS server (2001:4860:4860::8888) on the client. I guess this is a problem of the IPv6 configuration. I have enabled ipv6 forwarding on the server side using:
$ sudo sysctl -p /etc/sysctl.d/wireguard.conf
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
[EDIT]: Apparently the VM has a separate interface for the IPv4 and another one for the IPv6 connectivity, so I did: ping6 ipv6.google.com -I eth0/1/2 and found out that only on the eth2 there is IPv6 connectivity. So I have changed the iptables rules for IPv6 to -s fc00:xxx:xxx::/64 -o eth2 on the server and restarted the Wireguard sudo systemctl stop wg-quick@wg0 && sudo systemctl start wg-quick@wg0 on the server and on the client afterward, I had a working IPv6 connectivity.
I hope that this will help someone in the future.
