Support forwarding IPv6 payloads

[qdii]

When using the helm chart to set up a server as an egress point, Wireguard clients will connect the endpoint in IPv4, but forward IPv6 payloads.

As forwarding is only configured for IPv4 by the init script, this result in a weird state for clients browsing the internet where certain resources on the internet work and other don't work.

[bryopsida]

Just as an additional note, the forwards can be setup for IPV6 but for it to function the kubernetes cluster CNI will also need to be configured to allocate IPV6 addresses for the pods.

For example

• https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/dual-stack-support/#prerequisite-ipv6-forwarding

[bryopsida]

Looking over the changes needed in the chart.

wireguard-chart/helm/wireguard/templates/deployment.yaml

Line 137 in 60ceb2d

- sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1

Sysctl calls for IPv6 would need to be added.

Most likely IPV6 SNAT/DNAT would need to be added since most clusters allocate IPv6 addresses from a private range/prefix instead of a public prefix.

wireguard-chart/helm/wireguard/templates/config.yaml

Line 7 in 60ceb2d

PostDown = iptables -t nat -D POSTROUTING -s {{ $natSourceNetOption }} -o eth0 -j MASQUERADE

https://linux.die.net/man/8/ip6tables-1.4.7

[qdii]

This may be relevant: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#egress-traffic