HowTo: OPNsense using Wireguard with IPv6 support

[twistabled4alt 0]

On 6/28/2026 at 2:22 PM, DeepAnger said:

You don't need IPv6 from your ISP to use IPv6 from or in AirVPN. I use OpenWrt and I disabled the wan6 interface then added a ULA IPv6 server on my LAN interface. I'm sorry that I can't help you more. It took me a few weeks to be able to achieve that under OpenWrt and I'm no specialist of it. Using your ISP IPv6 is just adding a big risk of leaking it.
 

Thank you for your reply. Could you please elaborate on how you can achieve ipv6 out only using ipv4 to connect to the vpn tunnel? And do you think I could keep my ISP ipv6 for normal browsing??
Thx

[DeepAnger 0]

On 6/30/2026 at 5:50 PM, twistabled4alt said:

Thank you for your reply. Could you please elaborate on how you can achieve ipv6 out only using ipv4 to connect to the vpn tunnel? And do you think I could keep my ISP ipv6 for normal browsing??
Thx

My OpenWrt router is configured to use only IPv4 on its WAN interface (wan6 disabled : my choice, not the OpenWrt defaults). The LAN interface acts as a IPv6 DHCP and has SLAAC enabled. Routing sends everything in the WreGuard interface, IPv4 and IPv6 alike.
A windows 11 PC on the LAN running qBittorrent uses both IPv4 and IPv6 local (private) addresses.

I gave configuration details with screenshots in this message :

[DeepAnger 0]

On 6/30/2026 at 5:50 PM, twistabled4alt said:

And do you think I could keep my ISP ipv6 for normal browsing??

The router sends almost everything in the VPN, except for a few destinations that are sent to the wan interface with Policy Based Routing. I use it only for IPv4 but it may work for IPv6 as well. Why would you want to send your "normal browsing" to your ISP ? Why having a VPN at all ?

[twistabled4alt 0]

Like could I keep the normal ipv6 route to ISP, that way having both routes working

[Aleksas123 0]

Interesting discussion. Would keeping the ISP IPv6 route alongside the VPN route increase the risk of IPv6 leaks, especially if the WireGuard tunnel temporarily goes down? Would policy-based routing be the safer option here?

[DeepAnger 0]

7 hours ago, Aleksas123 said:

Interesting discussion. Would keeping the ISP IPv6 route alongside the VPN route increase the risk of IPv6 leaks, especially if the WireGuard tunnel temporarily goes down? Would policy-based routing be the safer option here?

It seems to me that you answer your own question. No ISP IPv6 <=> No ISP IPv6 leak. OpenWrt does not route to the default ISP route when the VPN interface goes down but this should probably vary depending on your firewall and the rules you apply.