WireGuard Client IPv4 working not IPv6

DoubleDuck · September 29, 2022, 12:07pm

Hello

                (A)  IPv4 and IPv6 works on macOS WG-client

So I have been using the Official WireGuard client on macOS with a wg configuration-file (provided by a VPN service). Installed via drag and drop.

When I go to https://test-ipv6.com/ , I see that I get 1 IPv4 address and 1 IPv6 address. This is what I want on (B)!

                (B) Only IPv4 works on OpenWRT WG-client

I disable the tunnel on the macOS app and take the same wg configuration-file to OpenWrt 22.03.0 freshly installed with all WireGuard packages Luci needs. I create a new Interface (WireGuard) I import the wg configuration-file file via drag and drop. I enable Route allowed IPs (0.0.0.0/0 and ::/0) and I assign it Firewall Zone "vpn". reject,accept,reject, masquerading yes. I add the VPN to Lan (Allow forward to destination zones --> VPN) and removed WAN/WAN6 (For Kill switch layout). + a few minor changes for DNS (not happy with setup, but at least now I get no leaks)
Save and apply, reboot.

When I go to https://test-ipv6.com/ I see that I get 1 IPv4 address but no IPv6 address.
I have gotten IPv6 addresses before, but clear ones that did not go though the tunnel.

Questions:
What must I do so all connected clients to the router gets WG-tunneled IPv4 and IPv6 addresses on the internet?
................................................................................................................................................................
Thanks for reading this far, and btw, I'm not skilled in IT at all so if some cool souls want to help, then please, keep it simple. And yes, I have used the search function. (waiting for "no you have not, link")

................................................................................................................................................................

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd27:70fa:5c1d::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'wan'
	option macaddr 'XXXXXXXXXXXXXXXXXXXXXXX'

config interface 'wan'
	option device 'wan'
	option proto 'dhcp'

config interface 'wan6'
	option device 'wan'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'

config interface 'wg0'
	option proto 'wireguard'
	option private_key 'XXXXXXXXXXXXXXXXXXXXXXX'
	list addresses '10.0.192.39/24'
	list addresses 'fdab:1337:1337:192::39/64'
	option peerdns '0'
	list dns '2001:9b1:8826::53'
	list dns '2001:9b0:4:2601::53'
	list dns '98.128.186.86'
	list dns '155.4.89.136'
	option force_link '1'

config wireguard_wg0
	option description 'wireguard1.conf'
	option public_key 'XXXXXXXXXXXXXXXXXXXXXXX'
	list allowed_ips '0.0.0.0/0'
	list allowed_ips '::/0'
	option endpoint_host 'wireguard.5july.net'
	option endpoint_port '48574'
	option route_allowed_ips '1'

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	option cachesize '0'
	list server '98.128.186.86'
	list server '155.4.89.136'
	list server '2001:9b1:8826::53'
	list server '2001:9b0:4:2601::53'
	option strictorder '1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

/etc/config/firewall

onfig defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option mtu_fix '1'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'vpn'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wg0'
	option input 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'vpn'

Should you find any information above that reduces my privacy (mac addresses, keys, other) please let me now so I can edit em away!

_bernd · September 29, 2022, 2:41pm

That's why. This address is ULA, unique local address. It's "private use" IP space.
Linux, and therefore OpenWrt, will not route traffic from ULA to GUA, global unique address.

It can be done by enable masquerade, I think in your case on the wireguard interface.
Maybe I missed that part but are you using the latest stable 22.03 with nftables and firewall4?
If yes: then, if I followed the discussion correctly, masquerade for ipv6 traffic should work too.

~~Edit: yeah you miss the masq6 setting in the firewall config on your VPN device. Try to enable it and teat again.~~

Edit2: nope I'm wrong. sorry. You will need a "special" route to route from ULA via the remote wg peer. I assume your VPN provider does masquerade. You can set the route on the command line but I do not know how to do so with luci/webgui as I do not use it.

ip -6 route add default from fc00::/7 dev wg0

DoubleDuck · September 30, 2022, 3:26am

Thanks for telling me, will do some reading on ULA and GUA!

About:

ip -6 route add default from fc00::/7 dev wg0

I SSH into router and pasted that line and rebooted the router. Sadly nothing really happened. But thank you regardless for the effort!

_bernd · September 30, 2022, 5:47am

this command is not persistent and you need no reboot.

DoubleDuck · September 30, 2022, 7:11am

oh I see,

DoubleDuck · October 3, 2022, 2:27pm

Hello again,

I'm sorry to say that I'm yet to find a working solution.
I would very much appreciate a wee bit of assistance .

lleachii · October 3, 2022, 11:01pm

I assume you've found the hundreds of threads on setting normal IPv4/IPv6 Wireguard
(i.e. when you're issued a properly-sized IPv6 subnet for the network you wish to address). If not, just let us know what issue you're having. https://forum.openwrt.org/search?q=wireguard%20vpn%20setup
For IPv6, you need to setup NAT for IPv6 (I've never personally set this up before) - see: IPv6 prefix from the VPN server side (FYI, when that post was written, it was an older version of OpenWrt in use)

BTW, this is already some kinda private IPv6 address issued by the provider.

y2kbugleung · June 24, 2023, 12:37am

@DoubleDuck I am facing the same problem. Have you got yours solved?