[GH-ISSUE #2607] Linux: IPv6 endpoint not bracketed before wireguard-go IPC, peer creation fails with IPC error -22 #1184

New issue

Open

opened 2026-10-13 20:36:01 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-13 20:36:01 +00:00

Owner

Originally created by @BenjaminWilson13 on GitHub (May 15, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2607

Describe the bug
When the AmneziaWG .conf Endpoint is a hostname that resolves to both an A and an AAAA record, the Amnezia Linux daemon picks the AAAA result and passes the endpoint to wireguard-go's IPC layer as <ipv6>:<port> instead of the required [<ipv6>]:<port>. wireguard-go rejects the malformed string, peer creation fails with IPC error -22, the wireguard interface is created but never gets a peer, and the GUI sits at "Connecting…" indefinitely waiting for a handshake that physically cannot be sent.

To Reproduce
Steps to reproduce the behavior:

Generate or import any AmneziaWG .conf whose Endpoint = is a hostname that has both A and AAAA records. (Any Firewalla DDNS qualifies, since Firewalla advertises an IPv6 SLAAC AAAA alongside the WAN IPv4 A.)
On a Linux client where getaddrinfo returns AAAA first (default systemd-resolved behavior), click Connect.
Observe: amn0 interface is created, peer creation fails, GUI hangs in connecting state, daemon log shows the IPC error above.

Expected behavior
Should connect via the AAAA record without issue.

Log files

Daemon log (from `journalctl -u AmneziaVPN`)

[DEBUG] Amnezia WireguardUtilsLinux : Configuring peer <REDACTED_PUBKEY>= via <IPV6_REDACTED>
[DEBUG] Amnezia LinuxRouteMonitor  : Adding exclusion route for <IPV6_REDACTED>/128
[DEBUG] Amnezia                    : Gateway 192.168.1.1 for interface enx00e04cfdba3f
[DEBUG] Amnezia LinuxRouteMonitor  : Adding exclusion route for /999999
[WARNING] Amnezia LinuxRouteMonitor : Invalid destination prefix
[DEBUG] Amnezia LinuxRouteMonitor  : Netlink request failed: Numerical result out of range
[DEBUG] Amnezia WireguardGo : ERROR: (amn0) IPC error -22: failed to set endpoint <IPV6_REDACTED>:37777: invalid ip:port "<IPV6_REDACTED>:37777", IPv6 addresses must be surrounded by square brackets
[ERROR] Amnezia WireguardUtilsLinux : Peer configuration failed: Unknown error -22
[ERROR] Amnezia Daemon              : Peer creation failed.
[ERROR] Amnezia DaemonLocalServerConnection : Failed to activate the interface

The key line is the WireguardGo IPC error: failed to set endpoint <ipv6>:<port>: ..., IPv6 addresses must be surrounded by square brackets. wireguard-go uses Go's netip.ParseAddrPort, which requires [<ipv6>]:<port> form.

Desktop (please complete the following information):

AmneziaVPN client 4.8.15.4 (build 2edd7de)
Ubuntu 26.04 LTS (x86_64)
Container: amnezia-awg
Server: Firewalla AmneziaWG (beta). Endpoint hostname is a Firewalla DDNS (*.d.firewalla.org) which has both an A record (WAN IPv4) and an AAAA record (Firewalla's IPv6 SLAAC).
System resolver: systemd-resolved (returns AAAA first in resolvectl query output)

Additional context
Add any other context about the problem here.

Originally created by @BenjaminWilson13 on GitHub (May 15, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2607 **Describe the bug** When the AmneziaWG `.conf` Endpoint is a hostname that resolves to **both** an A and an AAAA record, the Amnezia Linux daemon picks the AAAA result and passes the endpoint to wireguard-go's IPC layer as `<ipv6>:<port>` instead of the required `[<ipv6>]:<port>`. wireguard-go rejects the malformed string, peer creation fails with `IPC error -22`, the wireguard interface is created but never gets a peer, and the GUI sits at "Connecting…" indefinitely waiting for a handshake that physically cannot be sent. **To Reproduce** Steps to reproduce the behavior: 1. Generate or import any AmneziaWG `.conf` whose `Endpoint =` is a hostname that has both A and AAAA records. (Any Firewalla DDNS qualifies, since Firewalla advertises an IPv6 SLAAC AAAA alongside the WAN IPv4 A.) 2. On a Linux client where `getaddrinfo` returns AAAA first (default systemd-resolved behavior), click Connect. 3. Observe: `amn0` interface is created, peer creation fails, GUI hangs in connecting state, daemon log shows the IPC error above. **Expected behavior** Should connect via the AAAA record without issue. **Log files** ### Daemon log (from `journalctl -u AmneziaVPN`) ``` [DEBUG] Amnezia WireguardUtilsLinux : Configuring peer <REDACTED_PUBKEY>= via <IPV6_REDACTED> [DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for <IPV6_REDACTED>/128 [DEBUG] Amnezia : Gateway 192.168.1.1 for interface enx00e04cfdba3f [DEBUG] Amnezia LinuxRouteMonitor : Adding exclusion route for /999999 [WARNING] Amnezia LinuxRouteMonitor : Invalid destination prefix [DEBUG] Amnezia LinuxRouteMonitor : Netlink request failed: Numerical result out of range [DEBUG] Amnezia WireguardGo : ERROR: (amn0) IPC error -22: failed to set endpoint <IPV6_REDACTED>:37777: invalid ip:port "<IPV6_REDACTED>:37777", IPv6 addresses must be surrounded by square brackets [ERROR] Amnezia WireguardUtilsLinux : Peer configuration failed: Unknown error -22 [ERROR] Amnezia Daemon : Peer creation failed. [ERROR] Amnezia DaemonLocalServerConnection : Failed to activate the interface ``` The key line is the `WireguardGo` IPC error: `failed to set endpoint <ipv6>:<port>: ..., IPv6 addresses must be surrounded by square brackets`. wireguard-go uses Go's `netip.ParseAddrPort`, which requires `[<ipv6>]:<port>` form. **Desktop (please complete the following information):** - AmneziaVPN client **4.8.15.4** (build `2edd7de`) - Ubuntu 26.04 LTS (x86_64) - Container: `amnezia-awg` - Server: Firewalla AmneziaWG (beta). Endpoint hostname is a Firewalla DDNS (`*.d.firewalla.org`) which has both an A record (WAN IPv4) and an AAAA record (Firewalla's IPv6 SLAAC). - System resolver: `systemd-resolved` (returns AAAA first in `resolvectl query` output) **Additional context** Add any other context about the problem here.

bsakaguchi commented

2026-10-13 20:36:02 +00:00

Author

Owner

@aglu commented on GitHub (Jul 28, 2026):

It's actual for version 5.0.0.5

@aglu commented on GitHub (Jul 28, 2026): It's actual for version 5.0.0.5

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1184

No description provided.

Rows
Columns

[GH-ISSUE #2607] Linux: IPv6 endpoint not bracketed before wireguard-go IPC, peer creation fails with IPC error -22 #1184

Daemon log (from journalctl -u AmneziaVPN)

Daemon log (from `journalctl -u AmneziaVPN`)