If you have something like the very common setup: {internet} -> [wgserver] -> [wgclient] -> [local LAN]
Then if you have address space routed to wgserver, just route a /64 to wgclient and then normally radvd(&dhcpv6) it, done. If you only have a single /64 on the server, then indeed you need to hack around with ndproxy. But given that ISPs have near infinite IPv6 space... they should be able to route you a simple /64 and technically, from a RIR perspective should even be doing minimal /56 or even a /48... Greets, Jeroen -- > On 20210924, at 17:31, tlhackque <tlhack...@yahoo.com> wrote: > > TLDR; It seems that WireGuard isn't supporting IPv6 NDP, and it should. > Use case & a work-around. > > Full story: > > Configuration: > > WireGuard server (Linux, details below) behind a site router that > handles IPv4 NAT & an IPv6 tunnel. > > Server LAN has other hosts (and multiple subnets/vlans) - mostly dual stack. > > The WireGuard server is able to access the WireGuard peers (clients) > over IPv6. The other hosts (and the router) are not. > > The clients can't even ping the other hosts - the echo replies are > generated, but they end up with an icmp6 unreachable. > > It turns out that the other hosts (and router) send an icmp6 Neighbor > Solicitation for the clients, which is never answered. > > My interim solution was to implement > https://github.com/setaou/ndp-proxy, which will respond with Neighbor > Advertisements for the entire WireGuard subnet. > > This is a rather crude solution - since ndp-proxy doesn't know what > clients are connected, and since it requires one proxy process/wg interface. > > It seems to me that WireGuard (in this case on the server) should at > least be responding to Neighbor Solicitations for AllowedIPs of its > active peers... Of course in the case of a WireGuard tunnel between two > such sites, this is symmetric. > > I did look at net.ipv6.conf.*.proxy_ndp, but that requires adding each > address - and in any case I couldn't get it to work. Neither did > advertising the server as a "router" with radvd. > > Unless I'm missing something, it seems to me that supporting NDP is the > simplest "it just works" approach in any case... > > wireguard-tools v1.0.20210424 - https://git.zx2c4.com/wireguard-tools/ > > Linux hagrid 5.13.16-200.fc34.x86_64 #1 SMP Mon Sep 13 12:39:36 UTC 2021 > x86_64 x86_64 x86_64 GNU/Linux > >