Hi everyone,
I'm trying to setup my Mullvad VPN connection on my OPNsense. I have IPv4 connection working great, but I'm trying to setup the IPv6 peer with no luck. Also important note here, I do not have native IPv6 from my ISP, I am utilizing Hurricane Electric's IPv6 tunnel broker, which is also working great on my LAN network. But for some reason the wireguard instance won't even attempt to try to handshake on IPv6.
Things I've tried
1. I can successfully ping the Mullvad Peer IP from the firewall console
2. Packet capture on my IPv6 WAN interface going to Hurricane Electric, absolutely no traffic even attempting on port 51820
3. Looking at the wireguard status, there is no sent bytes, like it's not even attempting to handshake.
4. Changed MTU settings on the gif interface and the wireguard instance.
5. I spun up OPNsense on a virtual machine behind my primary OPNsense and assigned it an IPv6 address from the primary LAN's subnet pool, so that way this from the perspective of this second firewall it's a native IPv6 connection from my ISP and not a tunnel. I put the exact same wireguard configuration in that one and it peered up instantly and works.
So my suspicion is either this just simply isn't supported, or there's a bug in OPNsense where the wireguard service isn't utilizing a gif interface as it's WAN connection.
My Configuration:
root@OPNsense:~ # wg show wg2
interface: wg2
public key: (hidden)
private key: (hidden)
listening port: 51820
peer: (hidden)
endpoint: [2a02:6ea0:d80b:3::b75f]:51820
allowed ips: ::/0
persistent keepalive: every 20 seconds
root@OPNsense:~ # cat /usr/local/etc/wireguard/wg2.conf
####################################################
# Interface settings, not used by `wg` #
# Only used for reference and detection of changes #
# in the configuration #
####################################################
# Address = fc00:bbbb:bbbb:bb01::9:5ecc/128
# DNS =
# MTU = 1420
# disableroutes = 1
# gateway =
# debug = 0
[Interface]
PrivateKey = (redacted)
ListenPort = 51820
[Peer]
# friendly_name = Mullvad_us-sea-wg-001-IPv6
PublicKey = (redacted)
Endpoint = 2a02:6ea0:d80b:3::b75f:51820
AllowedIPs = ::0/0
PersistentKeepalive = 20