Setting Up WireGuard IPv6 Tunnel with Prefix Delegation (PD) on OpenWRT

WireGuard is a lightweight, fast, and secure VPN that supports IPv6. Many users want to use WireGuard to get IPv6 connectivity on their OpenWRT routers, including Prefix Delegation (PD) to distribute IPv6 addresses to LAN devices.

However, OpenWRT does not automatically show the IPv6-PD in the UI, meaning users must manually configure the prefix. This guide walks you through setting up a WireGuard IPv6 tunnel with proper prefix delegation (PD).

1. Why Use WireGuard for IPv6-PD?

If your ISP or upstream provider does not provide native IPv6, a WireGuard VPN can serve as an alternative. With the correct configuration, OpenWRT can:

Route all IPv6 traffic via WireGuard (::/0).
Use a dedicated prefix (e.g., /48, /56 , /60 or /64) for LAN devices.
Support Router Advertisement (RA) and DHCPv6 for automatic IPv6 address assignment.

2. Issue: OpenWRT UI Does Not Show IPv6-PD

When configuring WireGuard in OpenWRT’s LUCI UI, users may notice that IPv6-PD (Prefix Delegation) does not appear by default.
For example, in the UI, only an IPv6 address (/126) appears, but no IPv6-PD entry:

IPv6: 2001:db8::2/126
IPv6-PD: 2001:db8:a::/60  <-- NOT VISIBLE IN UI!

This missing entry means that OpenWRT does not automatically delegate the prefix to LAN devices. You must manually specify it in the configuration file.

3. Configuring WireGuard IPv6 with Prefix Delegation

Step 1: Modify WireGuard (wan6) Configuration

Edit the /etc/config/network file:

config interface 'wan6'
    option proto 'wireguard'
    option private_key 'YOUR_PRIVATE_KEY'
    option mtu '1420'
    list dns '2606:4700:4700::1111'
    list dns '2606:4700:4700::1001'
    list addresses '2001:db8::2/126'  # Main IPv6 address
    option ip6prefix '2001:db8:a::/60'  # Manually set IPv6-PD (IMPORTANT!)

config wireguard_wan6
    option public_key 'YOUR_PEER_PUBLIC_KEY'
    option endpoint_host 'your-wg-server.example.com'
    option endpoint_port '51820'
    option persistent_keepalive '25'
    list allowed_ips '::/0'  # Route all IPv6 traffic
    option route_allowed_ips '1'

WAN6 Settings

Why manually add option ip6prefix?
Because OpenWRT does not automatically detect the delegated prefix (2001:db8:a::/60) in the UI.

Step 2: Configure LAN to Use the IPv6 Prefix

After ensuring the WireGuard tunnel has an IPv6 prefix, we must tell OpenWRT to use it for LAN devices.

UI Settings

Edit /etc/config/network and modify the lan section:

config interface 'lan'
    option device 'br-lan'
    option proto 'static'
    option ipaddr '192.168.151.1'
    option netmask '255.255.255.0'
    option ip6assign '64'  # Assign IPv6 to LAN
    list ip6class 'local'
    list ip6class 'wan6'  # Assign prefix from WireGuard

Why add list ip6class 'wan6'?
Because OpenWRT needs to know which interface provides the IPv6 prefix. Without this, LAN devices will not receive IPv6 addresses.

Step 3: Configure DHCPv6 & Router Advertisement (RA)

To allow LAN devices to automatically receive IPv6 addresses, enable RA and DHCPv6.

IPv6 Settings

IPv6 RA Settings

Edit /etc/config/dhcp:

config dhcp 'lan'
    option interface 'lan'
    option dhcpv6 'server'
    option ra 'server'
    option ndp 'relay'
    option ra_management '1'

Restart the DHCP service:

service odhcpd restart

Now, LAN devices should automatically get an IPv6 address from 2001:db8:a::/60.

4. Testing & Troubleshooting

After restarting the network, verify that IPv6 is working.

Step 1: Check WireGuard Interface

Run:

ip -6 addr show dev wan6

You should see:

2001:db8::2/126

Step 2: Verify IPv6 Routing

ip -6 route show

You should see:

2001:db8:a::/60 dev br-lan  # LAN prefix

Step 3: Test IPv6 on a LAN Device

On a LAN device (PC, phone, etc.), check if it gets an IPv6 address in 2001:db8:a::/60:

ip -6 addr show

Then test IPv6 connectivity:

ping6 google.com

If everything is correct, the IPv6 test should succeed.

5. Conclusion

WireGuard can provide an IPv6-PD to OpenWRT, but the UI does not show it.
You must manually add option ip6prefix in wan6 for OpenWRT to recognize it.
LAN needs list ip6class 'wan6' to correctly use the delegated IPv6 range.
With correct DHCPv6 settings, LAN devices will automatically get IPv6.

Now your OpenWRT router can use WireGuard for full IPv6 support! Let me know if you need further tweaks!