I am trying to setup a wireguard server on OpenWRT router. I don't have a public ipv4 address because i am under CGNAT, so i've used IPv6.
I managed to get it working with this config:
config interface 'wg0'
option proto 'wireguard'
option private_key = '....'
option listen_port '51820'
list addresses '10.5.0.1/24'
config wireguard_wg0
option description 'iPhone'
option public_key '...'
option route_allowed_ips '1'
list allowed_ips '10.5.0.10/32'
option endpoint_host 'DDNS IPv6 address of router'
On my vpn client (iPhone), if i put 192.168.1.0/24 as allowed IP i am able to connect to local device in my home network, and i am able to use internet on my iphone using LTE ipv4 and ipv6 address. If i put 0.0.0.0/0, ::0 i am able to reach internet using IPV4 address of my home network, but IPV6 is not working (neither of LTE or home network). I would like to know how should i set up the vpn in order to reach internet using ipv6 address of my home network.
my idea is that you have "at home" OWRT router which hide IPv4 local addresses behind NAT. So anything that try to go to WAN from LAN, will be NAT-ed (masquerade). It is normal/expected. So your "whatever ipv4 Iphone wirequard" will work as it is automaticaly NAT-ed trough WAN
but
in case of IPv6, things are different
Default OWRT settings does NOT do NAT on IPv6 WAN6
so, it depends on available v6 addresses you have
either you need valid v6 address from pool (PD) assigned to your router by ISP to route trough WG
or
simpy assign random LUA address to WG an do IPv6 NAT on WAN6 interface
Any Wireguard tunnel can carry both IPv4 and IPv6 simultaneously inside the tunnel, regardless of which address type is being used on the outside (encrypted) packets.
For anything IPv6 to work inside the tunnel, both ends of the tunnel need (link unique) link-local addresses, which OpenWrt does not automatically assign. I usually use fe80::1/64 and fe80::2/64.
Exactly. If you have full IPv6 service with a routed prefix you can put option ip6assign 64 on the Wireguard interface and run an RA server on it, and the phone will typically see the RAs and set up IPv6 on its end of the tunnel automatically. Since the phone chooses the last 64 bits of its address randomly, the whole /64 needs to be an allowed_ip. This means you'll need a completely separate Wireguard interface per road warrior, i.e. each one is a point to point connection; instead of multiple remotes sharing one "server" interface. When Wireguard is point to point you can simply set allowed_ips ::/0 on both ends and control routing externally. This prevents needing to change the Wireguard settings if the ISP changes your prefixes.
If you don't have a routed prefix then all the usual workarounds to share a single /64 apply.
since you using (suppose) relay mode to pass one /64 from wan6 to lan ...
it is a bit complicated
lets say that LAN->WAN is straight
and WG->WAN is from "side"
then maybe you could assign ULA fd00::1/64 fd00::2/64 for WG and Iphone
and then in firewall try something like
if src is fd00::/64
and dst is WAN6
then masqerade ipv6
key is src address
this should "hide" your Iphone behind existing /64
and will leave LAN as it is
You should be able to do it with LuCi: firewall WAN zone > Advanced Settings, enable IPv6 MASQUERADING and add the ULA source address like described by @NPeca75.
Sorry for the offtopic but what is the ISP? They need to be listed on the list of shame. /56 is the absolute minimum a ISP should allocate and /48 should be the standard.
are you sure? I remember reading wireguard had to be either ipv4 or ipv6, not both. I setup a server and client with both but never got it to give out ipv6 address. I think as long as the server can access ipv6 address you can still use them, but I dont think wireguard can actually assign both. I could be wrong and this could just be from years ago.
The single /64 is industry standard for LTE. Since almost every LTE connection is a single endpoint, not a router, I don't think that anyone has bothered to build an LTE network that can route additional prefixes to a customer.
I have changed some settings: now I have a separate firewall zone for the wireguard VPN and I have enabled masquerade on LAN so I can access all the LAN devices in 192.168.1.0/24 from the VPN.
On my Wireguard client if i set 0.0.0.0/0, ::/0 I can use IPv4 of my home network, but IPv6 is not working (neither the client IPv6 or the home IPv6).
I have a /64 dynamic prefix assigned by the ISP every 4 hours and I would like to allow the wireguard client to use one of the IPv6 of the LAN.
I don't know whether to assign this IP through DHCPv6 or SLAAC, but SLAAC is working on my LAN and i have the entire /64 prefix there (so i think i can't make it working)
I don't want to negatively impact the home LAN network.
Can someone help me? I read that i should enable IPv6 masquerading on wan zone (does this cause something negative to my existing LAN network?) and then add ULA source address. Where do i need to assign the ULA address? Do i need to enable relay mode of RA?
Source fd00::/64 does not cover the fd55:etc IPs that you are using (it means exactly a 64 bit prefix of fd and 56 zeros: fd00:0000:0000:0000). To include any "non central" ULA use fd00::/8.
