{"id":2023,"date":"2025-07-02T11:55:33","date_gmt":"2025-07-02T09:55:33","guid":{"rendered":"https:\/\/bergs.biz\/blog\/?p=2023"},"modified":"2025-07-02T11:58:37","modified_gmt":"2025-07-02T09:58:37","slug":"wireguard-on-openwrt-no-ipv6-routing","status":"publish","type":"post","link":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/","title":{"rendered":"WireGuard on OpenWrt: no IPv6 routing?"},"content":{"rendered":"\n

I recently configured my router to be a WireGuard gateway, so that I can dial into my home to reach my NAS. After I had set it up and all seemed to be working well, I noticed that IPv6 packets didn’t get out to the internet, when I did a ping on my laptop:<\/p>\n\n\n\n

$ ping6 ipv6.example.net
PING6(56=40+8+8 bytes) fd00:9::4 --> 2a01:123:456:7890::2
^C
--- ipv6.example.net ping6 statistics ---
624 packets transmitted, 0 packets received, 100.0% packet loss<\/kbd><\/p>\n\n\n\n

I immediately suspected a routing issue, and so I did the below test on my router:<\/p>\n\n\n\n

root@gw:~# ping6 -I fd00:9::1 ipv6.example.net
PING ipv6.example.net (2a01:123:456:7890::2) from fd00:9::1: 56 data bytes
ping6: sendto: Network unreachable<\/kbd><\/p>\n\n\n\n

This seemed to have confirmed my suspicion. But why is there a routing issue?<\/p>\n\n\n\n

I remembered that the WireGuard clients are all using reserved IP addresses — both IPv4 and IPv6. For IPv4 my router is doing masquerading, but it doesn’t do so for IPv6. It passes these addresses (from public address space!) out to the internet, which is the default setup for OpenWrt.<\/p>\n\n\n\n

Now, in the case of the VPN network, where reserved addresses from the range of fd00:9::1\/64<\/code> are used, packets with source addresses from the reserved IP address range can’t be routed on the internet, which is why I was seeing the “Network unreachable” error message.<\/p>\n\n\n\n\n\n\n\n

So I needed to enable masquerading. I followed the instructions from OpenWrt’s wiki<\/a>., which are as follows:<\/p>\n\n\n\n

# Configure firewall\nuci set firewall.@zone[1].masq6=\"1\"\nuci commit firewall\nservice firewall restart\n\n# Configure network\nuci set network.wan6.sourcefilter=\"0\"\nuci commit network\nservice network restart<\/pre>\n\n\n\n
After applying the above changes, my “road warrior” (laptop with WireGuard client active) could now properly route IPv6 addresses. Hooray!<\/p>\n\n\n\n
As I didn’t want to enable masquerading for all<\/em> networks I have on my network (I have multiple as I use VLANs), but just for the VPN network, I made a small modification.<\/p>\n\n\n\n
I went into Network > Firewall > Zones and clicked “Edit” for the “wan” zone. On the “Advanced Settings” tab, there is an entry field to “Restrict Masquerading to given source subnets”, in which I entered the VPN IPv6 network range of fd00:9::1\/64<\/code>. This is obviously called “Limited masquerading” by OpenWrt and shows as below (note the “warning” triangle in the “Masquerading” column):<\/p>\n\n\n\n
\"\"
Network > Firewall > Zones settings<\/figcaption><\/figure>\n\n\n\n
After I had applied these settings, IPv6 routing was still<\/em> working, but using a service like WhatIsMyIpAddress<\/a> I confirmed that now my router’s<\/strong> public IPv6 address was used as the client address for my requests, instead of a client-specific address from the delegated range that my normal LAN clients use. For the normal LAN clients, no masquerading was applied, but their public IPv6 address continues to be used for communications towards the internet.<\/p>\n\n\n\n
In case this was helpful for you, I’d appreciate some quick feedback from you. Thank you.<\/p>\n","protected":false},"excerpt":{"rendered":"
I recently configured my router to be a WireGuard gateway, so that I can dial into my home to reach my NAS. After I had set it up and all seemed to be working well, I noticed that IPv6 packets didn’t get out to the internet, when I did a ping on my laptop: $ […]<\/p>\n","protected":false},"author":2,"featured_media":2024,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,122,84,134],"tags":[202,83,217,380],"class_list":["post-2023","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computers","category-english","category-networking-computers","category-routers","tag-ipv6","tag-openwrt","tag-vpn","tag-wireguard"],"yoast_head":"\nWireGuard on OpenWrt: no IPv6 routing? - Ralf's Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WireGuard on OpenWrt: no IPv6 routing? - Ralf's Blog\" \/>\n<meta property=\"og:description\" content=\"I recently configured my router to be a WireGuard gateway, so that I can dial into my home to reach my NAS. After I had set it up and all seemed to be working well, I noticed that IPv6 packets didn’t get out to the internet, when I did a ping on my laptop: $ […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/\" \/>\n<meta property=\"og:site_name\" content=\"Ralf's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-02T09:55:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-02T09:58:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2025\/07\/image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1599\" \/>\n\t<meta property=\"og:image:height\" content=\"558\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ralf Bergs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ralfbergs\" \/>\n<meta name=\"twitter:site\" content=\"@ralfbergs\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ralf Bergs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/\"},\"author\":{\"name\":\"Ralf Bergs\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/#\\\/schema\\\/person\\\/354e37390b493c875f972bd313d29201\"},\"headline\":\"WireGuard on OpenWrt: no IPv6 routing?\",\"datePublished\":\"2025-07-02T09:55:33+00:00\",\"dateModified\":\"2025-07-02T09:58:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/\"},\"wordCount\":454,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/#\\\/schema\\\/person\\\/354e37390b493c875f972bd313d29201\"},\"image\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/image.png\",\"keywords\":[\"IPv6\",\"OpenWRT\",\"VPN\",\"WireGuard\"],\"articleSection\":[\"Computers\",\"English\",\"Networking\",\"Routers\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/\",\"url\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/\",\"name\":\"WireGuard on OpenWrt: no IPv6 routing? - Ralf's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/image.png\",\"datePublished\":\"2025-07-02T09:55:33+00:00\",\"dateModified\":\"2025-07-02T09:58:37+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#primaryimage\",\"url\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/image.png\",\"contentUrl\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/image.png\",\"width\":1599,\"height\":558},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/2025\\\/07\\\/02\\\/wireguard-on-openwrt-no-ipv6-routing\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WireGuard on OpenWrt: no IPv6 routing?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/\",\"name\":\"Ralf's Blog\",\"description\":\"Just another WordPress weblog\",\"publisher\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/#\\\/schema\\\/person\\\/354e37390b493c875f972bd313d29201\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/#\\\/schema\\\/person\\\/354e37390b493c875f972bd313d29201\",\"name\":\"Ralf Bergs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Ralf-Tower-2026-1024x1024.jpg\",\"url\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Ralf-Tower-2026-1024x1024.jpg\",\"contentUrl\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Ralf-Tower-2026-1024x1024.jpg\",\"width\":1024,\"height\":1024,\"caption\":\"Ralf Bergs\"},\"logo\":{\"@id\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/Ralf-Tower-2026-1024x1024.jpg\"},\"description\":\"Geek, computer guy, licensed and certified electrical and computer engineer, husband, best daddy.\",\"sameAs\":[\"https:\\\/\\\/bergs.biz\\\/\",\"https:\\\/\\\/linkedin.com\\\/in\\\/ralfbergs\\\/\",\"https:\\\/\\\/x.com\\\/ralfbergs\"],\"url\":\"https:\\\/\\\/bergs.biz\\\/blog\\\/author\\\/rabe\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WireGuard on OpenWrt: no IPv6 routing? - Ralf's Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/","og_locale":"en_US","og_type":"article","og_title":"WireGuard on OpenWrt: no IPv6 routing? - Ralf's Blog","og_description":"I recently configured my router to be a WireGuard gateway, so that I can dial into my home to reach my NAS. After I had set it up and all seemed to be working well, I noticed that IPv6 packets didn’t get out to the internet, when I did a ping on my laptop: $ […]","og_url":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/","og_site_name":"Ralf's Blog","article_published_time":"2025-07-02T09:55:33+00:00","article_modified_time":"2025-07-02T09:58:37+00:00","og_image":[{"width":1599,"height":558,"url":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2025\/07\/image.png","type":"image\/png"}],"author":"Ralf Bergs","twitter_card":"summary_large_image","twitter_creator":"@ralfbergs","twitter_site":"@ralfbergs","twitter_misc":{"Written by":"Ralf Bergs","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#article","isPartOf":{"@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/"},"author":{"name":"Ralf Bergs","@id":"https:\/\/bergs.biz\/blog\/#\/schema\/person\/354e37390b493c875f972bd313d29201"},"headline":"WireGuard on OpenWrt: no IPv6 routing?","datePublished":"2025-07-02T09:55:33+00:00","dateModified":"2025-07-02T09:58:37+00:00","mainEntityOfPage":{"@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/"},"wordCount":454,"commentCount":2,"publisher":{"@id":"https:\/\/bergs.biz\/blog\/#\/schema\/person\/354e37390b493c875f972bd313d29201"},"image":{"@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#primaryimage"},"thumbnailUrl":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2025\/07\/image.png","keywords":["IPv6","OpenWRT","VPN","WireGuard"],"articleSection":["Computers","English","Networking","Routers"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/","url":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/","name":"WireGuard on OpenWrt: no IPv6 routing? - Ralf's Blog","isPartOf":{"@id":"https:\/\/bergs.biz\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#primaryimage"},"image":{"@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#primaryimage"},"thumbnailUrl":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2025\/07\/image.png","datePublished":"2025-07-02T09:55:33+00:00","dateModified":"2025-07-02T09:58:37+00:00","breadcrumb":{"@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#primaryimage","url":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2025\/07\/image.png","contentUrl":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2025\/07\/image.png","width":1599,"height":558},{"@type":"BreadcrumbList","@id":"https:\/\/bergs.biz\/blog\/2025\/07\/02\/wireguard-on-openwrt-no-ipv6-routing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/bergs.biz\/blog\/"},{"@type":"ListItem","position":2,"name":"WireGuard on OpenWrt: no IPv6 routing?"}]},{"@type":"WebSite","@id":"https:\/\/bergs.biz\/blog\/#website","url":"https:\/\/bergs.biz\/blog\/","name":"Ralf's Blog","description":"Just another WordPress weblog","publisher":{"@id":"https:\/\/bergs.biz\/blog\/#\/schema\/person\/354e37390b493c875f972bd313d29201"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/bergs.biz\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/bergs.biz\/blog\/#\/schema\/person\/354e37390b493c875f972bd313d29201","name":"Ralf Bergs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2026\/04\/Ralf-Tower-2026-1024x1024.jpg","url":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2026\/04\/Ralf-Tower-2026-1024x1024.jpg","contentUrl":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2026\/04\/Ralf-Tower-2026-1024x1024.jpg","width":1024,"height":1024,"caption":"Ralf Bergs"},"logo":{"@id":"https:\/\/bergs.biz\/blog\/wp-content\/uploads\/2026\/04\/Ralf-Tower-2026-1024x1024.jpg"},"description":"Geek, computer guy, licensed and certified electrical and computer engineer, husband, best daddy.","sameAs":["https:\/\/bergs.biz\/","https:\/\/linkedin.com\/in\/ralfbergs\/","https:\/\/x.com\/ralfbergs"],"url":"https:\/\/bergs.biz\/blog\/author\/rabe\/"}]}},"_links":{"self":[{"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/posts\/2023","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/comments?post=2023"}],"version-history":[{"count":2,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/posts\/2023\/revisions"}],"predecessor-version":[{"id":2027,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/posts\/2023\/revisions\/2027"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/media\/2024"}],"wp:attachment":[{"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/media?parent=2023"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/categories?post=2023"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bergs.biz\/blog\/wp-json\/wp\/v2\/tags?post=2023"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}