Full Stack WireGate on Mobile Data

[HojichaOtter]

Is there a specific way to activate IPV6 on a fullstack Docker Compose with Tor enabled? I tried using this Reddit post as a reference but got stuck on how to edit the postup/postdown scripts.

[HojichaOtter]

I'm on jasper-beta because I heard the betas have IPV6 capabilities and realized that the reason why my previous attempts wouldn't connect on mobile data is because I always checked Pre-Shared Key before.

[NOXCIS]

@HojichaOtter
Assign an IPv6 address to the interface then create a new peer. The new peer will have an assigned ipv4 and ipv6. This can be done from inside the dashboard with the Raw config editor in config settings and With the respective iptables script editors.

NOTE: Your host and Cellular ISP IPv6 support may vary. Further IPv6 fowarding configuaration may also be required if using openWRT on home router.

Post Up Script

#!/bin/bash
# Copyright(C) 2024 NOXCIS [https://github.com/NOXCIS]
# Under MIT License

WIREGUARD_INTERFACE=ADMINS
WIREGUARD_LAN=10.0.0.1/24
WIREGUARD_LAN6=fd42:42:42::1/64
MASQUERADE_INTERFACE=eth0

CHAIN_NAME="WIREGUARD_$WIREGUARD_INTERFACE"

# Add NAT masquerading for IPv4
iptables -t nat -I POSTROUTING -o $MASQUERADE_INTERFACE -j MASQUERADE -s $WIREGUARD_LAN

# Add a WIREGUARD chain to the FORWARD chain
iptables -N $CHAIN_NAME
iptables -A FORWARD -j $CHAIN_NAME

# Accept related or established traffic
iptables -A $CHAIN_NAME -o $WIREGUARD_INTERFACE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Accept traffic from any WireGuard IP address connected to the WireGuard server
iptables -A $CHAIN_NAME -s $WIREGUARD_LAN -i $WIREGUARD_INTERFACE -j ACCEPT

# Allow traffic to the local loopback interface
iptables -A $CHAIN_NAME -o lo -j ACCEPT

# Drop everything else coming through the WireGuard interface
iptables -A $CHAIN_NAME -i $WIREGUARD_INTERFACE -j DROP

# Return to FORWARD chain
iptables -A $CHAIN_NAME -j RETURN

# Add NAT masquerading for IPv6
ip6tables -t nat -I POSTROUTING -o $MASQUERADE_INTERFACE -j MASQUERADE -s $WIREGUARD_LAN6

# Add a WIREGUARD chain to the FORWARD chain for IPv6
ip6tables -N $CHAIN_NAME
ip6tables -A FORWARD -j $CHAIN_NAME

# Accept related or established traffic for IPv6
ip6tables -A $CHAIN_NAME -o $WIREGUARD_INTERFACE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Accept traffic from any WireGuard IPv6 address connected to the WireGuard server
ip6tables -A $CHAIN_NAME -s $WIREGUARD_LAN6 -i $WIREGUARD_INTERFACE -j ACCEPT

# Allow traffic to the local loopback interface for IPv6
ip6tables -A $CHAIN_NAME -o lo -j ACCEPT

# Drop everything else coming through the WireGuard interface for IPv6
ip6tables -A $CHAIN_NAME -i $WIREGUARD_INTERFACE -j DROP

# Return to FORWARD chain for IPv6
ip6tables -A $CHAIN_NAME -j RETURN

Pre Down Script

#!/bin/bash
# Copyright(C) 2024 NOXCIS [https://github.com/NOXCIS]
# Under MIT License

WIREGUARD_INTERFACE=ADMINS
WIREGUARD_LAN=10.0.0.1/24
WIREGUARD_LAN6=fd42:42:42::1/64
MASQUERADE_INTERFACE=eth0

CHAIN_NAME="WIREGUARD_$WIREGUARD_INTERFACE"

# Remove NAT masquerading for IPv4
iptables -t nat -D POSTROUTING -o $MASQUERADE_INTERFACE -j MASQUERADE -s $WIREGUARD_LAN

# Remove and delete the IPv4 WIREGUARD chain
iptables -D FORWARD -j $CHAIN_NAME
iptables -F $CHAIN_NAME
iptables -X $CHAIN_NAME

# Remove NAT masquerading for IPv6
ip6tables -t nat -D POSTROUTING -o $MASQUERADE_INTERFACE -j MASQUERADE -s $WIREGUARD_LAN6

# Remove and delete the IPv6 WIREGUARD chain
ip6tables -D FORWARD -j $CHAIN_NAME
ip6tables -F $CHAIN_NAME
ip6tables -X $CHAIN_NAME

[HojichaOtter]

When trying to follow these instructions, I couldn't save because the chain name was missing. On what I thought was a fresh install, all my peers couldn't connect to the internet even if there were handshakes. docker compose down -v seems to erase the volumes, I have deleted the configs, and I still couldn't connect to WiFi or Mobile Data. So, now I have a different problem. I'll try this configuration edit again once I figure out how to get a working install.

[NOXCIS]

You shouldnt have to reinstall your deployement just change the varable in the iptables stricpt to match your setup. Also, you should bring down the config/ interface when making major changes to the iptables scripts to avoid that chain name issue.