IPv6 tunnel stopped working after setting up Wireguard

Installing and Using OpenWrt Network and Wireless Configuration
1

I have a networking setup where I use a Hurricane Electric 6in4 tunnel to provide me with IPv6 connectivity. Everything worked fine until I set up a Wireguard VPN server that I assigned a subnet from my v6 address space to. After that my devices still get a prefix from the router, but any attempt at estabilishing a v6 connection fails (even after removing the subnet from wireguard's config and rebooting the router).

My /etc/config/network:

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdcb:aca7:30c4::/48'

config interface 'lan'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.0.1'
        option dns '2606:4700:4700::1111 1.1.1.1 8.8.8.8'
        option ifname 'eth1.1'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option ifname 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 6t'

config interface 'henet'
        option proto '6in4'
        option password '<censored>'
        option username '<censored>'
        option peeraddr '216.66.86.114'
        option ip6addr 'xxxx:xxx:xx:xxx::x/64'
        option tunnelid '<censored>'
        option ip6prefix 'xxxx:xxx:xxxx::/48'

config interface 'wg0'
        option proto 'wireguard'
        option private_key '<censored>'
        option listen_port '1234'
        list addresses '10.14.0.0/16'

config wireguard_wg0
        option public_key '<censored>'
        option route_allowed_ips '1'
        list allowed_ips '::/0'
        list allowed_ips '0.0.0.0/0'
        option persistent_keepalive '25'
        option description 'S5'

My /etc/config/firewall:

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        option network 'wan henet'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule                           
        option name 'Allow-Ping'      
        option src 'wan'              
        option proto 'icmp'           
        option icmp_type 'echo-request'
        option family 'ipv4'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-IGMP'       
        option src 'wan'               
        option proto 'igmp'            
        option family 'ipv4'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-DHCPv6'     
        option src 'wan'               
        option proto 'udp'             
        option src_ip 'fc00::/6'       
        option dest_ip 'fc00::/6'      
        option dest_port '546'         
        option family 'ipv6'           
        option target 'ACCEPT'

config rule                            
        option name 'Allow-MLD'        
        option src 'wan'               
        option proto 'icmp'            
        option src_ip 'fe80::/10'      
        list icmp_type '130/0'         
        list icmp_type '131/0'         
        list icmp_type '132/0'         
        list icmp_type '143/0'         
        option family 'ipv6'           
        option target 'ACCEPT'         
                                       
config rule                            
        option name 'Allow-ICMPv6-Input'
        option src 'wan'                
        option proto 'icmp'             
        list icmp_type 'echo-request'   
        list icmp_type 'echo-reply'     
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        list icmp_type 'router-solicitation'    
        list icmp_type 'neighbour-solicitation' 
        list icmp_type 'router-advertisement'   
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'

config rule                                     
        option name 'Allow-ICMPv6-Forward'      
        option src 'wan'                        
        option dest '*'                         
        option proto 'icmp'                     
        list icmp_type 'echo-request'           
        list icmp_type 'echo-reply'             
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'         
        list icmp_type 'time-exceeded'          
        list icmp_type 'bad-header'             
        list icmp_type 'unknown-header-type'    
        option limit '1000/sec'                 
        option family 'ipv6'                    
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-IPSec-ESP'           
        option src 'wan'                        
        option dest 'lan'                       
        option proto 'esp'                      
        option target 'ACCEPT'                  
                                                
config rule                                     
        option name 'Allow-ISAKMP'              
        option src 'wan'                        
        option dest 'lan'                       
        option dest_port '500'                  
        option proto 'udp'                      
        option target 'ACCEPT'                  
                                                
config include                                  
        option path '/etc/firewall.user'

config rule                                     
        option name 'Allow-Shadowsocks-inbound' 
        option target 'ACCEPT'                  
        option src '*'                          
        option dest_port '9001'                 
                                                
config include 'ss_rules'                       
        option path '/etc/firewall.ss-rules'    
        option reload '1'                       
                                                
config rule                                     
        option target 'ACCEPT'                  
        option dest_port '1234'                 
        option name 'Allow-Wireguard-Inbound'   
        option proto 'udp'                      
        option src '*'                          
                                                
config zone                                     
        option name 'wg'                        
        option input 'ACCEPT'                   
        option forward 'ACCEPT'                 
        option output 'ACCEPT'                  
        option network 'wg0'                    
                                                
config forwarding                               
        option src 'wg'                         
        option dest 'wan'                       
                                                
config forwarding                               
        option src 'wg'                         
        option dest 'lan'                       
                                                
config forwarding                               
        option src 'lan'                        
        option dest 'wg'

config forwarding                               
        option src 'wan'                        
        option dest 'wg'
2

Is the IPv6 address you refer to, from the Wireguard provider or Tunnelbroker?

You may have to setup your own routes.

3

It's from the tunnel broker. I don't have a WG service provider, I'm trying to set up a server. Forgot to mention that in the OP, sorry. I've ammended the OP to mention it now.

4

Depending on your intentions, you may need to explicitly route traffic from your local IPv6-over-IPv4 tunnel portal to the remote tunnel portal.

I've seen some "interesting" behavior under OpenWRT with respect to tunneled interfaces and routing, at least as far as GRE goes (HE uses proto 41, as I recall, not GRE). Checking the installed routes before and after a tunnel comes up, as well if it goes down and comes up again later may provide some insight.