WireGuard doesn't work over HE IPv6 Tunnel Broker

[kasper93]

Hi,

I have fairly simple setup, but cannot make WireGuard work over IPv6.

Interfaces:
WAN: My ISP provided IPv4
WANv6: HE IPv6 Tunnel Broker
WG: WireGuard

Now when I use IPv4 endpoint on client peer it works flawlessly. But when I use IPv6 it doesn't work. Handshake packets come through from client as I see peer IPv6 address on opnsense and I see both TX/RX traffic. But on client peer I see only TX, never got any packet back. Looks like WG server responses are lost.

Any idea how to diagnose/resolve this?

Thanks,
Kacper

[newsense]

Might need to adjust the MTU there, did you set any value for it ? Give it a shot with 1480

https://forums.he.net/index.php?topic=67.0

[300cpilot]

My experience with HE required a 1280 MTU. This was through a sonicwall though, just know that it took a while to figure out which value worked. The value you use has to divide by 8 evenly for it to work. (1280/8=160, no remainder) I am going to be setting up HE this week on this OPNSence firewall to replace the Sonicwall. So I am in here searching for others that have blazed the trail already.

[newsense]

I've seen 1280 being discussed on much older threads so I'd try it as an option if 1480 won't cut it.

[Napsterbater]

By default i believe GIF interfaces on OPNsense are 1280mtu, but you can go to your Tunnel interface and set the MTU of that assigned interface to 1480 (if you have a WAN MTU of 1500, otherwise WAN MTU - 20 = Tunnel MTU).

Then you can goto the HE Tunnel broker site and confirm the MTU for that tunnel is set 1480 there as well, though I think it is by default.

Then if you had to set the MTU of the tunnel interface to less then 1480, then (Tunnel Interface MTU) - 60 = (Wireguard MTU), note this must be set on both Wireguard Clients/server.

[kasper93]

Thanks guys for suggestions, but it turns out my ISP on mobile is a culprit. Actually it was working perfectly some time ago, but with pfsense, I made a switch to opnsense and it stopped working, so I assumed this is the problem. But it turns out in the same time my mobile ISP changed something on their end. I didn't have time to diagnose it further, but basically looks like the traffic is filtered...