Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix the IPv6 support #847

Open
Someguy123 opened this issue Nov 7, 2024 · 3 comments
Open

Fix the IPv6 support #847

Someguy123 opened this issue Nov 7, 2024 · 3 comments
Assignees
Labels
bug Something isn't working

Comments

@Someguy123
Copy link

Someguy123 commented Nov 7, 2024

Is your feature request related to a problem? Please describe.
I just installed Defguard for us to consider using it at our company instead of pure wireguard, unfortunately it seems Defguard doesn't seem to allow IPv6 addresses for the gateway subnet, endpoint, nor for DNS - which renders Defguard useless for our company as our existing Wireguard VPN network is almost exclusively IPv6-only. Defguard does appear to accept IPv6 subnets in the Allowed IPs section but that's not very useful when the VPN has no IPv6 address or subnet

More and more companies (including my own) are using IPv6 especially for their internal networks such as VPNs to conserve IPv4 addresses, so it's important for Defguard to have at least basic IPv6 support

Describe the solution you'd like
It would be great if Defguard could add support for IPv6 addresses / subnets ideally alongside IPv4 - for example:

  • it should be possible to enter 10.1.2.1/24,2a07:e01::1/48 in the "Gateway VPN IP address and netmask" box so that the VPN has both IPv4 and IPv6 addresses
  • ideally Defguard should be able to automatically provision either /128's, /64's, or /48's from the IPv6 subnet provided (user should have control over the subnet size it hands out) - but static addressing would be a good start
  • it should be possible to enter IPv6 DNS servers e.g. 2a07:e00::333 - preferably allow for multiple DNS servers with mixing and matching IPv4 and IPv6 DNS servers
  • it should be possible to enter an IPv6 endpoint e.g. 2a07:e01::1
  • Settings which involve connecting to external services such as SMTP configuration, LDAP, etc. should support IPv6 addresses - currently SMTP configuration complains "enter a valid endpoint" if I enter an IPv6 address
  • Documentation will likely need to explain that a routed subnet is required for full IPv6 connectivity (which should be firewalled with iptables FORWARD rules on the VPN endpoint), unless they use a private subnet with NAT for outside connectivity

All of the above is supported with native Wireguard, so it's purely Defguard itself which requires updating to support IPv6

Additional context

Screenshots showing Defguard v1.0.0 rejecting IPv6 addresses/subnets on the "Edit Location" screen:

image image image
@Someguy123 Someguy123 added the feature New feature or request label Nov 7, 2024
@teon
Copy link
Contributor

teon commented Nov 7, 2024

@Someguy123 you are right! in the middle of the 1.0 release battle, testing multiple components we forgot about the frontend changes for IPv6.
We did introduce full IPv6 for client and server - we just need to change the input frontend rules. We will do so In the upcoming quick fix 1.0.1 release. Sorry about that!

@teon teon added bug Something isn't working and removed feature New feature or request labels Nov 7, 2024
@teon teon moved this to In Progress in Backlog & Roadmap Nov 7, 2024
@teon teon changed the title IPv6 support Fix the IPv6 support Nov 8, 2024
@teon teon moved this from In Progress to Testing in Backlog & Roadmap Nov 12, 2024
@teon teon moved this from Testing to Done in Backlog & Roadmap Nov 18, 2024
@t-kitipot
Copy link

I test the new 1.1.0 version today,
The other boxes work fine, except the "Gateway VPN IP address and netmask" box.
If I only input ipv4 or ipv6 it works.

image

@t-aleksander
Copy link
Contributor

t-aleksander commented Nov 21, 2024

@t-kitipot this is currently not supported but we are planning to add it. See DefGuard/wireguard-rs#81 for details/progress.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
Status: Done
Development

No branches or pull requests

4 participants