@arichtman__dup_55274@eigenmagic.net
Post #649851
2026-03-15 02:40 UTC
Site 2 Site Wireguard AllowedIPs question.
IPv4 both sites are private address ranges with no overlap, so to do split tunnel I just configure the client AllowedIPs to match the server's untunneled LAN range. Easy enough.
However for IPv6 everything has GUA addresses thanks to prefix delegation. Thing is, the ISP won't guarantee my prefix. So how do I guard against prefix changes... Or do I just have to update the client config then?
#Networking #Wireguard
Replies (1)
-
@futzle@old.mermaid.town 2026-03-15 02:43
@arichtman@eigenmagic.net I'd argue against using global IPv6 addresses in your VPN at all, if they're not stable. Use ULA addresses everywhere, including DNS for your well-known services, and the risk of you connecting over the public Internet from Global IPv6 at Site1 to Global IPv6 at Site2 is almost nil. If your ISP is already at risk of changing your global IPv6 prefix then you must already have a scripted way to update public DNS when one of your servers changes its prefix? Piggyback on that.