I am following the July 29th version by @egc using OpenWrt version 25.12.5 and I have a few questions:
On page 10: why do we leave "endpoint host" empty? This is confusing, since later I have to enter this information for the peers
Anyhow, after rebooting, it connected, so far so good...
is it normal that the ULA address is remapped to the wan's own /64 address? No tempaddr at all? The pppoe interface has a /56
do we really need to reboot after adding a peer? In my case, I am the only user but otherwise I expect this requirement to be pretty annoying in a household
according to "wg show" the phone is connecting via IPv4, even if full IPv6 connectivity is available on the router AND within the vpn itself. Any way to set a preference? Or perhaps is it falling back because of some issue?
In the weekend I will try shutting down the he.net tunnel with static address, get openvpn out of the way and check the loose ends, like the 1-click script (though the qr generator is quite nice)
In the meantime, @egc, thanks for the guide, good job!
Having it empty is optional, but on that area you are refering to that is the side of the server, most of the times it just listens on 0.0.0.0 (itself), or the router itself.
What you have to type later is for the peer, and that of course need a more direct connection.
I never had a problem with just restarting the interface, that is better than a full restart.
Hmm this requires some more information please post the contents of /etc/config/network redact mac addresses and private and public keys + other sensitive information like public ip, ipv6.
it is possible you have no virtual local ipv6 address defined in the interface, and also not gave the peer this alowedips address inside the server area ?
^ I want to make a distinction here the allowedips in luci are for the wgserver, but the allowedips in peer need to be 0.0.0.0/0, ::/0 that way the peer gets a ip inside the tunnel.
Also with my bit of inexperienced ipv6 knowledge I think you do not need ipv6 connectivity to get ipv6 inside wireguard, this is thanks to the link local address, so translation is possible aslong the tunnel is correctly configurated, the other external end must have working ipv6 if that is for resolving websites.
v4 and v6 can exist (even simultaneously) inside a wg tunnel regardless of the address family used to transport the outer encrypted packets. In order for the outside of the tunnel to run v6 you need (D)DNS to resolve your house to an IPv6 address, and a v6 capable connection at the remote peer.
On a "server," endpoint_host is typically not configured since that is used to originate an outgoing connection to a particular IP. Clients do that with the IP of the server. Servers listen for connections from anywhere on listen_port.
Most of the things are already adequately answered
already answered but it is correct leave it empty and later fill in your proper endpoint address (ususally a DDNS address) in the peer config
Yes we setup the easy way with NAT66, but you can also use NPT6 to remap instead of NAT66 it is mentioned in the guide.
The reboot is after you are done setting up with all the peers you want so basically after you are done configuring.
A service network restart from the command line is also working but for not so experienced users a simple reboot is easier, It is mentioned in the guide:
Note: when adding a second peer later, be sure to restart the network (service network restart) or reboot the router to take effect.
Answered already by @mk24, if you also have a public IPv6 address you can use that to connect, set it as endpoint on your phone (needs bracketing) or let the DDNS resolve your IPV6 address.
In the end it does not matter as both IPv4 and IPv6 traffic is carried over the connection regardless of the endpoint address
Thanks to all who responded, here are my comments:
endpoint host: right, makes sense now... I guess I imagined this would be exported as client config but even then it would just mess up installations where a server is also a client.
interface restart: yeah, I was thinking about that, since rebooting my 4040 takes ages.
IPv6 connectivity: both phone and router have native IPv6 access, so I wanted to allow for all combinations. I have just tried hardcoding the IPv6 addresses of both tunnel and ISP connections, the phone can estabilish the vpn and "wg show" displays matching information, so.... it is always DNS
IPv6 tests are all ok, as far as I could see
DNS: the endpoint host in the phone config is a CNAME pointing to my DuckDNS address, both the aliased and the real hostnames resolve to IPv4 and IPv6 addresses... need to try with a different client (non-Android), could be that too
NAT66 is next on the list of things to try, good to know
Weird thing happening when setting up a second peer: both the QR code and the displayed config snippet contain DNS information but the downloaded file says "DNS not defined". Ok, adding it manually.
Also, importing the config (with DNS info) in network-manager on Linux gives working IPv4 but not IPv6... same happens with the wireguard windows app.... BUT, and here it gets weirder, importing this same config via QR on Android gives 10/10 on test-ipv6
EDIT: definitely a client issue, had a friend test my config and it was fine on test-ipv6
EDIT: frigging Android hotspot
Instead o "::/0" in the peer's AllowedIPs I had to use "::/1, 8000::/1"
Why not use an anvanced ai of you choice to conceive a config generator for your setup scenerio, take time to prepare your prompt, feed necessary info for it to properly understand the situation like the device, the openwrt version, providing it with a copy of latest development changes made to the version in use on your device. You will just have everything up and working in some minutes.
OpenWRT is being widely adopted in enterprises since the advent of AI, and since 2024 I myself encounter setup in multiple enterprise site in some european and asian countries.
Why would I ignore the perfectly good work @egc did with the guide?
Mind you, the server works already and the config worked too, as long as you're not connecting over IPv6 from an Android hotspot
Also, in my experience, AI can generate plausible looking configs which... fail the real life test. Not to mention the fact that hardly ever I get anything remotely complex right at the first try, no matter how many details I list explicitly: I always need to remind it that the package manager is now apk, you'd think that mentioning the current release would be enough but alas... that's not the case.
What I did find useful was a mix of Gemini and Lumo to debug the issue, that was indeed quicker than sifting through tons of blogs and manuals, for sure.
Never mind: I finally set up a new wifi network to simulate incoming connections from the Windows laptop, saw that here too the server was not answering at all even with no hotspot or tunnel (but again no issues with the other Android clients), went back to actually checking the f*ing keys while not sleeping and noted that after one edit too many... the keys did not look even remotely similar on the client and on the server. Fixed that and it worked, both on the local "wgtest" wifi and from the wan via hotspot.
Almost... I still have a IPv6 problem: this same config on an Android client gives 10/10 on test-ipv6 and 0/10 on Windows, regardless of the kill switch setting. @egc any ideas?
I am going to try again setting up the connection on Linux, should be nice to compare results!
If the same config works on Android then it is not the config neither the server side (note when you are testing the same config the android client has to be switched off) so it is a Windows problem, Windows has to be setup to support IPv6
Indeed it must be something wrong with Windows but I still can't find it.
I did alternate the Android client and the Windows client, as you noted, and also the laptop itself is already perfectly working with IPv6 when joining the main home network.... hell, even on the wgtest wifi it gets IPv6 address, DNS and the whole setup (it just cannot do anything with it since only wireguard, dns and dhcp are open). Same story if I join the phone hotspot.
you get the firewall either right or out of the way
(all in all, Windows probably has the same issues and I know next to nothing about Windows firewall, yay)
EDIT: in case anyone wonders, for firewalld on Linux:
I placed the wifi connection in the "public" zone
I added a policy to let icmp echo request / reply through anyway
(alternatively one could modify the allow-host-ipv6 policy: for modification the prio can stay unchanged, for extension it should be changed)
I placed the wireguard connection in the "home" zone
if the wifi interface ends up in the same zone as the wireguard connection (like when I am at my parent's place and the connection is also classified as "home"), then setting rpfilter=loose in firewalld.conf keeps everything running
