I have set up a Wireguard server on a VM running on top of Ubuntu and a couple of clients. I have also installed Pi-Hole on the same VM and I am using the public IP address for DNS resolving configuration on the clients. IPv4 is working just fine but IPv6 isn't. Here is my server configuration:
# Server Configuration [Interface] Address = 172.16.0.1/27, fc00:xxx:xxx::1/64 PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ListenPort = 51820 PreUp = iptables -t nat -A POSTROUTING -s 172.16.0.0/27 -o eth0 -j MASQUERADE; ip6tables -t nat -A POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE PostDown = iptables -t nat -D POSTROUTING -s 172.16.0.0/27 -o eth0 -j MASQUERADE; ip6tables -t nat -D POSTROUTING -s fc00:xxx:xxx::/64 -o eth0 -j MASQUERADE # Laptop 1 [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AllowedIPs = 172.16.0.2/32, fc00:xxx:xxx::2/128 # Phone [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AllowedIPs = 172.16.0.3/32, fc00:xxx:xxx::3/128 # Laptop 2 [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AllowedIPs = 172.16.0.4/32, fc00:xxx:xxx::4/128
And this is my client's configuration:
[Interface] PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Address = 172.16.0.4/27, fc00:xxx:xxx::4/64 DNS = <VM_Public_IP>, 2001:4860:4860::8888 [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Endpoint = <VM_Public_IP>:51820 AllowedIPs = 0.0.0.0/0, ::/0
So I am having a ping to the IPv6 address of the Wireguard server but not to the Google's IPv6 DNS, which is configured as IPv6 DNS server (
2001:4860:4860::8888) on the client. I guess this is a problem of the IPv6 configuration. I have enabled ipv6 forwarding on the server side using:
$ sudo sysctl -p /etc/sysctl.d/wireguard.conf net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1
[EDIT]: Apparently the VM has a separate interface for the IPv4 and another one for the IPv6 connectivity, so I did:
ping6 ipv6.google.com -I eth0/1/2 and found out that only on the eth2 there is IPv6 connectivity. So I have changed the
iptables rules for IPv6 to
-s fc00:xxx:xxx::/64 -o eth2 on the server and restarted the Wireguard
sudo systemctl stop wg-quick@wg0 && sudo systemctl start wg-quick@wg0 on the server and on the client afterward, I had a working IPv6 connectivity.
I hope that this will help someone in the future.