Some things take a bit of time. 2 years ago, I started my first experiments to replace my OpenVPN server instances with a dockerized Wireguard sever. It worked, but Ubuntu 22.04 I used at the time did not have a built-in GUI plugin for it. As I skipped Ubuntu 24.04, I had to wait for 26.04. With this in place now, I was wondering how well Wireguard runs on this platform. The quick answer. Rock stable!
IPv6 – To Block – To Not Block – A Loophole?
Establishing a tunnel and running IPv4 traffic over it is the core functionality for me. At home and in many other places, the local network that Wireguard uses for the tunnel has IPv6 connectivity as well. In my previous OpenVPN setup, which only tunneled IPv4, I had to take special care that IPv6 traffic would not bypass the tunnel. I did this by returning empty AAAA records for DNS lookups from the OpenVPN server side. It was an ugly kludge, but it was effective. With my dockerized Wireguard server, this is fortunately not necessary at all anymore. It is also only IPv4 capable, but suppresses all IPv6 traffic by not routing it, despite IPv6 being available on the interface below the tunnel:
$ ping6 www.heise.de
PING www.heise.de (2a02:2e0:3fe:1001:7777:772e:2:85) 56 data bytes
From fdcc:ad94:bacf:61a3::1 icmp_seq=1 Destination unreachable: No route
From fdcc:ad94:bacf:61a3::1 icmp_seq=2 Destination unreachable: No route
From fdcc:ad94:bacf:61a3::1 icmp_seq=3 Destination unreachable: No routeFull IPv6 connectivity would be nice, but, truth be told, this is also fine for me. As long as no IPv6 traffic or DNS queries escape to the lower interface, it’s fine. I checked this as well and there are no DNS queries to be seen on the physical interface that provides the local Internet connectivity.
Suspend / Resume
One really nice feature of Wireguard that I did not have before is that the VPN survives a suspend/resume on the notebook. Some people might see this as a disadvantage, as the OpenVPN client removes the tunnel when the network interface below it vanishes. But from a security and privacy point of view, Wireguard’s behavior is much better.
New Wi-Fi network and Switch of Interfaces
And finally, the Wireguard tunnel also survives a change of the Wi-Fi network below it and even when I switch from Wi-Fi to Ethernet while the tunnel is established. Nothing except a tunnel shutdown triggered by the user makes the tunnel go away.
Local Printing
Also a nice touch: The local network remains accessible while the VPN tunnel is in place, so printing and other activities continue to work!
As I said, rock solid!