3 ms·

First step of activating any VPN app on Linux: Disabling IPV6... If you don't and just WireGuard towards a ProtonVPN or MullVad exit-node, you'll find that your

First step of activating any VPN app on Linux: Disabling IPV6... If you don't and just WireGuard towards a ProtonVPN or MullVad exit-node, you'll find that your IPv6 address is nicely un-VPN-ed, and only via IPv4 does your location show you're accessing the internet from the other side of the world. That was pretty annoying when I first realized that and I have since then fallen back on using the apps of the VPN providers to automate disabling IPv6. The apps I experienced are meh in quality. They are slow and mess with existing WG connections. Although that is probably what you want. I find the TailScale/Mullvad solution to be particularly elegant and would prefer Proton to offer the same so I can haz access to Home Assistant AND download Linux ISOs.

jeroenhd 2y ago
Mullvad supports IPv6: https://mullvad.net/en/blog/ipv6-support https://mullvad.net/en/blog/ipv6-support Seems like ProtonVPN is at least ten years behind Mullvad on this. I'd expect better from a company like Proton to be honest, if any company should know how do to networking it's a VPN company. Of course your config files do need to apply the routing rules for IPv6 or you'll still leak traffic, but that's a configuration issue and not really a VPN issue.
kmbfjr 2y ago
A failsafe method is to create a vlan with a gateway that is the VPN. Using Linux routing tables, the vlan device routes to the wgX as the gateway. If the VPN app dies, there isn't a route to the internet for hosts on the vlan. As far as IPv6 is concerned, there is no entry in the routing tables so IPv6 packets can't leave the network.
yonatan8070 2y ago
WireGuard will only forward traffic with dst IPs that match the AllowedIPs setting, if it only has 0.0.0.0/0 and no IPv6 entry, it won't send IPv6 traffic through the tunnel, did your configuration have the IPv6 address there?

jeroenhd 2y ago

Mullvad supports IPv6: https://mullvad.net/en/blog/ipv6-support https://mullvad.net/en/blog/ipv6-support Seems like ProtonVPN is at least ten years behind Mullvad on this. I'd expect better from a company like Proton to be honest, if any company should know how do to networking it's a VPN company. Of course your config files do need to apply the routing rules for IPv6 or you'll still leak traffic, but that's a configuration issue and not really a VPN issue.

kmbfjr 2y ago

A failsafe method is to create a vlan with a gateway that is the VPN. Using Linux routing tables, the vlan device routes to the wgX as the gateway. If the VPN app dies, there isn't a route to the internet for hosts on the vlan. As far as IPv6 is concerned, there is no entry in the routing tables so IPv6 packets can't leave the network.

yonatan8070 2y ago

WireGuard will only forward traffic with dst IPs that match the AllowedIPs setting, if it only has 0.0.0.0/0 and no IPv6 entry, it won't send IPv6 traffic through the tunnel, did your configuration have the IPv6 address there?