pdxltd
Member OP
NAT64 + WireGuard for IPv4 exit
Key points and gotchas inside
MTU issues on mobile carriers
Running WireGuard exit node on IPv6-only NAT VPS
quinnbizz
Member
Running WireGuard exit node on IPv6-only NAT VPS
IMO this is a solid niche setup. YMMV depending on your provider's NAT64 implementation. Take it with a grain of salt if you're on mobile carriers with strict MTU policies.
I have this running on a Contabo IPv6-only plan. Key points: use NAT64 prefix 64:ff9b::/96 for IPv4 reachability, set AllowedIPs to ::/0, and configure your DNS to return AAAA records where possible.
The main gotcha is some carriers clamp MSS too aggressively. I set MTU to 1280 to be safe.
...
Hello, I try make a server up with this guide but have problem. My VPS is from GreenCloudVPS, only IPv6, I configure WireGuard but no have IPv4 exit.
I add NAT64 from go6lab.si but still not work. Maybe I need make something more? I use https://www.debian.org, Debian 12.
Regards
Heads up: Oracle free tier IPv6 instances work with this but need specific steps.
1. Enable IPv6 in VCN subnet first, it is not default
2. Open egress for UDP 51820 in security list, not just iptables
3. For NAT64, use prefix from GreenCloudVPS if they offer it, or run your own tayga instance
4. Pro tip: set PersistentKeepalive = 25 on mobile clients, Oracle drops idle UDP fast
MTU issue: start with 1420, only lower if you see fragmentation. Some carriers need 1280, others fine at 1400.
licensing is a suggestion
maksim
Member
Mobile carrier in my country drops packet bigger than 1280. What you see - connection work on wifi, broken on 4G. This is MTU problem, yes.
Set MTU 1280 in WireGuard config, Interface section. Also check phone itself not have lower MTU. ))))
GuruDeutschlag
Member
Important heads up for the Mobilfunk MTU Problem: I have tested three German Carriers and all show different behavior. Deutsche telekom needs 1280, Vodafone works with 1420, O2 drops everything above 1320. This is a Nightmare for consistent Configuration.
My workaround: set Interface MTU to 1280 and be done with it. The Performancecost is minimal for most Exitnode usecases. Yes, this is not elegant but it is robust.
Also check your WireGuard endpoint configuration if you use IPv4Literal inside IPv6NAT64 translated Addresses, some Implementations have Bugs there.
Thread pinned for visibility. This guide has generated useful community additions around NAT64 integration and MTU troubleshooting.
Quick summary of findings:
- Multiple providers affected by upstream MTU clamping on mobile networks
- 1280 MTU recommended as safe default
- Carrier-specific behavior varies significantly
We have added a note to the wiki. Thanks to all contributors.
— Admin
sudo make me a sandwich