I am following the July 29th version by @egc using OpenWrt version 25.12.5 and I have a few questions:
On page 10: why do we leave "endpoint host" empty? This is confusing, since later I have to enter this information for the peers
Anyhow, after rebooting, it connected, so far so good...
is it normal that the ULA address is remapped to the wan's own /64 address? No tempaddr at all? The pppoe interface has a /56
do we really need to reboot after adding a peer? In my case, I am the only user but otherwise I expect this requirement to be pretty annoying in a household
according to "wg show" the phone is connecting via IPv4, even if full IPv6 connectivity is available on the router AND within the vpn itself. Any way to set a preference? Or perhaps is it falling back because of some issue?
In the weekend I will try shutting down the he.net tunnel with static address, get openvpn out of the way and check the loose ends, like the 1-click script (though the qr generator is quite nice)
In the meantime, @egc, thanks for the guide, good job!
Having it empty is optional, but on that area you are refering to that is the side of the server, most of the times it just listens on 0.0.0.0 (itself), or the router itself.
What you have to type later is for the peer, and that of course need a more direct connection.
I never had a problem with just restarting the interface, that is better than a full restart.
Hmm this requires some more information please post the contents of /etc/config/network redact mac addresses and private and public keys + other sensitive information like public ip, ipv6.
it is possible you have no virtual local ipv6 address defined in the interface, and also not gave the peer this alowedips address inside the server area ?
^ I want to make a distinction here the allowedips in luci are for the wgserver, but the allowedips in peer need to be 0.0.0.0/0, ::/0 that way the peer gets a ip inside the tunnel.
Also with my bit of inexperienced ipv6 knowledge I think you do not need ipv6 connectivity to get ipv6 inside wireguard, this is thanks to the link local address, so translation is possible aslong the tunnel is correctly configurated, the other external end must have working ipv6 if that is for resolving websites.
v4 and v6 can exist (even simultaneously) inside a wg tunnel regardless of the address family used to transport the outer encrypted packets. In order for the outside of the tunnel to run v6 you need (D)DNS to resolve your house to an IPv6 address, and a v6 capable connection at the remote peer.
On a "server," endpoint_host is typically not configured since that is used to originate an outgoing connection to a particular IP. Clients do that with the IP of the server. Servers listen for connections from anywhere on listen_port.
Most of the things are already adequately answered
already answered but it is correct leave it empty and later fill in your proper endpoint address (ususally a DDNS address) in the peer config
Yes we setup the easy way with NAT66, but you can also use NPT6 to remap instead of NAT66 it is mentioned in the guide.
The reboot is after you are done setting up with all the peers you want so basically after you are done configuring.
A service network restart from the command line is also working but for not so experienced users a simple reboot is easier, It is mentioned in the guide:
Note: when adding a second peer later, be sure to restart the network (service network restart) or reboot the router to take effect.
Answered already by @mk24, if you also have a public IPv6 address you can use that to connect, set it as endpoint on your phone (needs bracketing) or let the DDNS resolve your IPV6 address.
In the end it does not matter as both IPv4 and IPv6 traffic is carried over the connection regardless of the endpoint address
Thanks to all who responded, here are my comments:
endpoint host: right, makes sense now... I guess I imagined this would be exported as client config but even then it would just mess up installations where a server is also a client.
interface restart: yeah, I was thinking about that, since rebooting my 4040 takes ages.
IPv6 connectivity: both phone and router have native IPv6 access, so I wanted to allow for all combinations. I have just tried hardcoding the IPv6 addresses of both tunnel and ISP connections, the phone can estabilish the vpn and "wg show" displays matching information, so.... it is always DNS
IPv6 tests are all ok, as far as I could see
DNS: the endpoint host in the phone config is a CNAME pointing to my DuckDNS address, both the aliased and the real hostnames resolve to IPv4 and IPv6 addresses... need to try with a different client (non-Android), could be that too
NAT66 is next on the list of things to try, good to know
Weird thing happening when setting up a second peer: both the QR code and the displayed config snippet contain DNS information but the downloaded file says "DNS not defined". Ok, adding it manually.
Also, importing the config (with DNS info) in network-manager on Linux gives working IPv4 but not IPv6... same happens with the wireguard windows app.... BUT, and here it gets weirder, importing this same config via QR on Android gives 10/10 on test-ipv6
EDIT: definitely a client issue, had a friend test my config and it was fine on test-ipv6
EDIT: frigging Android hotspot
Instead o "::/0" in the peer's AllowedIPs I had to use "::/1, 8000::/1"
Why not use an anvanced ai of you choice to conceive a config generator for your setup scenerio, take time to prepare your prompt, feed necessary info for it to properly understand the situation like the device, the openwrt version, providing it with a copy of latest development changes made to the version in use on your device. You will just have everything up and working in some minutes.
OpenWRT is being widely adopted in enterprises since the advent of AI, and since 2024 I myself encounter setup in multiple enterprise site in some european and asian countries.
Why would I ignore the perfectly good work @egc did with the guide?
Mind you, the server works already and the config worked too, as long as you're not connecting over IPv6 from an Android hotspot
Also, in my experience, AI can generate plausible looking configs which... fail the real life test. Not to mention the fact that hardly ever I get anything remotely complex right at the first try, no matter how many details I list explicitly: I always need to remind it that the package manager is now apk, you'd think that mentioning the current release would be enough but alas... that's not the case.
What I did find useful was a mix of Gemini and Lumo to debug the issue, that was indeed quicker than sifting through tons of blogs and manuals, for sure.
I configured a second Android client (on a Redmi9), connected to the hotspot of my main phone (a Pixel8a) and... the bloody thing can't even establish a connection, even if it has IPv6 via the hotspot, in addition to NAT'ed IPv4. No packets are received by the server, not even over IPv6 transport (hardcoded address). The second phone can ping the server over both IPv6 and IPv4.
On a whim I moved the wireguard server and the firewall rule from 51820 to 1194 and... the second phone connected immediately (over IPv4) and got 10/10 on test-ipv6.
Then I turned off the hotspot and connected my laptop via USB tethering, changed the port to 1194 as well and... no, no happy end here: no connection at all, even if ping is ok.
The effect of the port change makes me think the telco might have something to do with it, but overall it looks like the android hotspot isn't really doing its job well, right?
