Wireguard with IPv6
-
I guess i described that not correctly.
What i did is, i created a new tunnel with 192.168.4.4 as the interface address for tun1 and 192.168.4.0/24 as the network for tunnel clients.
As i learned earlier from stephen and JKnott, this address is not really the address wireguard listens on but instead wireguard listens on all addresses assigned to any interface, be it IPv6 or IPv4 (by default) and its up to the user to give grant access via firewall-rules. -
@FreeYourMind said in Wireguard with IPv6:
As i learned earlier from stephen and JKnott, this address is not really the address wireguard listens on but instead wireguard listens on all addresses assigned to any interface, be it IPv6 or IPv4 (by default) and its up to the user to give grant access via firewall-rules.
It can not listen to that because this is the address space of your tunnel. To create that tunnel, WireGuard needs to listen on your WAN-IP for example on port 5120 or whatever. WireGuard is listening on all interfaces, every WAN and every LAN interface you got. But there is no point of listening on the tunnel-interface itself...
-
Yes, i understand. I did not describe that earlier correctly. My bad.
-
Do you guys have any other ideas?
I honestly don't know how to troubleshoot my issue.Like i described earlier, the wireguard connection to one of the available (globally unique) IPv6 addresses on my Netgate router works fine and i can also ping the tun interface of wireguard once the connectiuon is established. I can also ping other (physical) interfaces on the netgate from the remote peer but i cannot connect to any service, doesn't matter if its DNS or accessing the web interface.
The firewall rules are all set up properly, i double checked but it just doesn't work. -
On my WireGuardVPN server - for road warriors remote access. To access the WEB GUI I have a firewall rule in the WireGuardVPN server rules page directing/routing access to the WEBGUI the source I have is an Alias of all the Wireguard Client Static IP's, however to be less restrictive use wireguard/vPN Server address or Subnets and the destination should be the This Firewall (self) and the port you are using for the WEB GUI.
I also believe you will have to do the same to gain remote access to other computers, NAS etc.
Hope I am providing help, never sure.
-
@FreeYourMind said in Wireguard with IPv6:
The firewall rules are all set up properly, i double checked but it just doesn't work.
Maybe you should show them here.
-
Yup probably going to need some screenshots to review at this point.
-
Sure. :)
Rule to allow access from anywhere to one IPv6 address on the UDP port WG is listening on:
Allow everything on the tunnel interface, so connected clients are not restricted at all. (for testing purposes only)
Let me know if you need some additional information.
Thank you. -
@FreeYourMind said in Wireguard with IPv6:
Let me know if you need some additional information.
Usually one would use the WAN-address-Alias or, if you don't have one, the LAN-address-Alias for example (your first screenshot) and not a real address.
According to your problem description, the problem must be in the interface called WireGuard, show that. Or you need to set MTU and MSS to 1420 on your assigned interface.
-
Yup the WireGuard interface group will apply first before any assigned interface so if you have any rules there they will take precedence.
-
Yes, i have just set it up for testing purposes. Once the problem is solved i will absolutely use an alias for the actual IPv6.
As far as i know (and correct me if i am wrong) the rules under the interface wireguard only apply for
"unassigned wireguard tunnel interfaces"
In my case i did assign an interface and named it TEST_VPN, hence why i showed your the firewall rules for TEST_VPN.
There are no rules for the wireguard interface at the moment.I tried to change the MTU / MSS to 1420 like you said (under Interfaces -> TEST_VPN) but unfortunately it still did not work after that.
-
Thats actually good to know, i wasn't aware of that. In my case there are no rules under the wireguard interface at the moment.
-
Sorry for bringing this up again but i wasn't able to find a solution so far.
There is one thing though that seems interesting which i didn't mention earlier.I am still not able to connect to the pfsense webui from a wireguard peer.
Other than that there is a NAS in the network the wg peer has access to. Like i described earlier, i can ping the NAS just fine but i am not able to access the web interface of it. Interestingly enough, i can SSH into the NAS from said wireguard peer but i cannot find out why i am not able to connect to its web interface. There is still nothing that pops out in the firrewall logs and i am a bit out of ideas tbh.Ok quick edit from me:
I was finally able to find the solution. You were already suggesting to lower the MTU to 1420 bytes. I tried that but it didn't work initially.
Now i tried it again but this time i lowered it to 1380 bytes and that did the trick for me. So the MTU suggestion was right after all.
Thank you very much for your help. :) -
Ah, nice catch!
-
Thank you stephen.
Allow me to come back to this topic one more time because i had a discussion with someone on another forum (about the same topic) and he insisted that my WAN interface is incorrectly configured because in his opinion i should definitely get a GUA IPv6 assigned to my
WAN interface. I told him my ISP doesn't assign a GUA to my WAN interface directly but only delegates a prefix to it and that is
(even if maybe not that common) a completely viable setup. Am i wrong here, cause i am starting to doubt myself a little bit based on what he said and you guys probably also have a lot of experience about IPv6 and how ISPs deal with it.Thank you.
-
Nope you are not wrong. My ISP only provides only a prefix so I have no routable IPv6 address on the WAN directly. That's BT, the largest ISP here in the UK.
-
@stephenw10 said in Wireguard with IPv6:
Nope you are not wrong. My ISP only provides a prefix so I have no routable IPv6 address on the WAN directly. That's BT, the largest ISP here in the UK.
Thank you stepehen. Helps a lot. :)
