I have configured my LAN IPv6 range to be a public unicast IPv6 segment, then configured wireguard to bring the traffic over from a datacenter not far away.
This seems to be working; clients get SLAAC addresses from the IPv6 /64 segment and are pingable (icmp allow is default firewall rule).
root@5gpocket:~# iptables --table nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
prerouting_rule all -- anywhere anywhere /* !fw3: Custom prerouting rule chain */
zone_lan_prerouting all -- anywhere anywhere /* !fw3 */
zone_wan_prerouting all -- anywhere anywhere /* !fw3 */
zone_wan_prerouting all -- anywhere anywhere /* !fw3 */
zone_wan_prerouting all -- anywhere anywhere /* !fw3 */
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
postrouting_rule all -- anywhere anywhere /* !fw3: Custom postrouting rule chain */
zone_lan_postrouting all -- anywhere anywhere /* !fw3 */
zone_wan_postrouting all -- anywhere anywhere /* !fw3 */
zone_wan_postrouting all -- anywhere anywhere /* !fw3 */
zone_wan_postrouting all -- anywhere anywhere /* !fw3 */
Chain postrouting_lan_rule (1 references)
target prot opt source destination
Chain postrouting_rule (1 references)
target prot opt source destination
Chain postrouting_wan_rule (1 references)
target prot opt source destination
Chain prerouting_lan_rule (1 references)
target prot opt source destination
Chain prerouting_rule (1 references)
target prot opt source destination
Chain prerouting_wan_rule (1 references)
target prot opt source destination
Chain zone_lan_postrouting (1 references)
target prot opt source destination
postrouting_lan_rule all -- anywhere anywhere /* !fw3: Custom lan postrouting rule chain */
Chain zone_lan_prerouting (1 references)
target prot opt source destination
prerouting_lan_rule all -- anywhere anywhere /* !fw3: Custom lan prerouting rule chain */
Chain zone_wan_postrouting (3 references)
target prot opt source destination
postrouting_wan_rule all -- anywhere anywhere /* !fw3: Custom wan postrouting rule chain */
MASQUERADE all -- anywhere anywhere /* !fw3 */
Chain zone_wan_prerouting (3 references)
target prot opt source destination
prerouting_wan_rule all -- anywhere anywhere /* !fw3: Custom wan prerouting rule chain */
root@5gpocket:~# ip6tables --table nat --list
ip6tables v1.8.3 (legacy): can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
The curious question for me is that it looks like websites see my IPv6 address as the openwrt router interface IPv6 and not the device itself (similar to as if openwrt was doing NAT66). Did I miss any configuration or setting somewhere?
I want my IPv6 incoming traffic to be filtered except for established connections - the default WAN zone should suffice for this I thought, so my wireguard interface is assigned to that zone. My Windows 10 client connected to openwrt obtained public IPv6 from the segment it seems, traffic going towards the internet seems to be getting masquerated though. Screenshot attached "::1" is the WAN ipv6 of openwrt.
Here's ifstatus of my wireguard interface:
# ifstatus vpsgw
{
"up": true,
"pending": false,
"available": true,
"autostart": true,
"dynamic": false,
"uptime": 4368,
"l3_device": "vpsgw",
"proto": "wireguard",
"updated": [
"addresses",
"routes"
],
"metric": 0,
"dns_metric": 0,
"delegation": true,
"ipv4-address": [
{
"address": "10.100.100.10",
"mask": 24
}
],
"ipv6-address": [
{
"address": "2602:n00t:yours::106:8888::10",
"mask": 112
}
],
"ipv6-prefix": [
],
"ipv6-prefix-assignment": [
],
"route": [
{
"target": "::",
"mask": 128,
"nexthop": "2602:n00t:yours::106:8888::1",
"source": "::/0"
},
{
"target": "2602:n00t:yours::8f::1",
"mask": 64,
"nexthop": "::",
"source": "::/0"
},
{
"target": "::",
"mask": 0,
"nexthop": "::",
"source": "::/0"
},
{
"target": "0.0.0.0",
"mask": 0,
"nexthop": "0.0.0.0",
"source": "0.0.0.0/0"
}
],
"dns-server": [
],
"dns-search": [
],
"neighbors": [
],
"inactive": {
"ipv4-address": [
],
"ipv6-address": [
],
"route": [
],
"dns-server": [
],
"dns-search": [
],
"neighbors": [
]
},
"data": {
}
}
