[PR #2609] feat: Add support for dual-stack IPv4/IPv6 configurations #2867

New issue

Open

opened 2026-10-14 21:05:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-14 21:05:50 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amnezia-client/pull/2609
Author: @farhadh
Created: 5/16/2026
Status: 🔄 Open

Base: dev ← Head: feat/farhadh/support-ipv6

📝 Commits (10+)

b944128 Add IPv6 fields and native WG config parsing
200dac2 Generate dual-stack self-hosted WG/AWG configs
764c3ab Build dual-stack desktop activation configs
4148ae5 Support IPv6 desktop routes and firewall rules
bda2300 Enable dual-stack WG/AWG on Android and Apple NE
a1117f7 Fix Codacy IPv6 memcpy findings
a890a7c Prevent IPv6 leak on mobile when server has no IPv6
6dc8de8 fix: probe container IPv6 egress over UDP instead of ICMP
86156af fix: gate server WG/AWG IPv6 address on host capability
4df7960 fix: exclude IPv6 WireGuard endpoints from the tunnel on Linux

📊 Changes

46 files changed (+1150 additions, -271 deletions)

View changed files

📝 client/android/protocolApi/src/main/kotlin/Protocol.kt (+1 -0)
📝 client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/Wireguard.kt (+31 -11)
📝 client/core/configurators/awgConfigurator.cpp (+1 -0)
📝 client/core/configurators/wireguardConfigurator.cpp (+142 -13)
📝 client/core/configurators/wireguardConfigurator.h (+2 -0)
📝 client/core/controllers/ipSplitTunnelingController.cpp (+31 -13)
📝 client/core/controllers/selfhosted/importController.cpp (+98 -18)
📝 client/core/installers/awgInstaller.cpp (+24 -7)
📝 client/core/installers/wireguardInstaller.cpp (+25 -2)
📝 client/core/models/protocols/awgProtocolConfig.cpp (+14 -2)
📝 client/core/models/protocols/awgProtocolConfig.h (+4 -2)
📝 client/core/models/protocols/wireGuardProtocolConfig.cpp (+14 -2)
📝 client/core/models/protocols/wireGuardProtocolConfig.h (+4 -2)
📝 client/core/utils/constants/configKeys.h (+3 -0)
📝 client/core/utils/constants/protocolConstants.h (+9 -0)
📝 client/core/utils/networkUtilities.cpp (+106 -10)
📝 client/core/utils/networkUtilities.h (+1 -0)
📝 client/core/utils/selfhosted/scriptsRegistry.cpp (+4 -0)
📝 client/daemon/daemon.cpp (+8 -6)
📝 client/daemon/interfaceconfig.cpp (+8 -11)

...and 26 more files

📄 Description

Summary

Adds dual-stack IPv6 support for WireGuard and AmneziaWG across config parsing/generation, self-hosted setup, desktop activation, platform routing/firewall handling, Android, and Apple NetworkExtension paths.

IPv6 client routing is generated only when WG/AWG has a real client IPv6 address and self-hosted container IPv6 egress is available. Otherwise generated configs remain IPv4-only to avoid IPv6 leaks or the previous fake ULA behavior.

Changes

Added optional WG/AWG config keys:
- client_ipv6
- subnet_ipv6_address
- subnet_ipv6_cidr
Added default IPv6 WG/AWG server subnets.
Updated native WG import parsing for:
- dual-stack Address
- IPv6 AllowedIPs
- IPv6 DNS
- bracketed IPv6 Endpoint
Updated self-hosted WG/AWG generation to:
- configure IPv4 and IPv6 interface addresses
- allocate IPv4 and IPv6 peer addresses from existing peers
- probe container IPv6 egress before issuing IPv6 client routes
- add guarded IPv6 forwarding and ip6tables NAT/forwarding rules
Updated desktop activation to split addresses, routes, DNS, and endpoints by IP family.
Updated Linux/macOS/Windows route, firewall, DNS, and endpoint handling for IPv6.
Updated Android and Apple NE WG/AWG config paths for dual-stack addresses/routes.
Added tests for IPv6 import, JSON round-trips, and desktop activation JSON.

Testing

Passed:

Docker Qt/CMake configure
Docker build target: test_multiple_imports
Docker CTest: MultipleImportsTest
Docker Android Kotlin compile:
- :protocolApi:compileDebugKotlin
- :wireguard:compileDebugKotlin
macOS host Swift syntax parse:
- WGConfig.swift
- PacketTunnelProvider+WireGuard.swift
git diff --check HEAD~6..HEAD

Notes

Full iOS/macOS NetworkExtension xcodebuild was not run because this host only has Command Line Tools installed, without full Xcode or iOS SDKs. OpenVPN, Xray, and IKEv2 IPv6 behavior is intentionally unchanged in this pass. WireGuard and AmneziaWG/AWG, including direct Amnezia tunnels, gain dual-stack support when a real client IPv6 address and server/container IPv6 egress are available.

ETA: some clarity to avoid confusion.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amnezia-client/pull/2609 **Author:** [@farhadh](https://github.com/farhadh) **Created:** 5/16/2026 **Status:** 🔄 Open **Base:** `dev` ← **Head:** `feat/farhadh/support-ipv6` --- ### 📝 Commits (10+) - [`b944128`](https://github.com/amnezia-vpn/amnezia-client/commit/b94412856d50052e4c94d15ecbca3dcd810801a4) Add IPv6 fields and native WG config parsing - [`200dac2`](https://github.com/amnezia-vpn/amnezia-client/commit/200dac2cbfedea5346fb43c9650709d76e79f7f1) Generate dual-stack self-hosted WG/AWG configs - [`764c3ab`](https://github.com/amnezia-vpn/amnezia-client/commit/764c3ab18d09196140163a6898fbdc25441fe6b2) Build dual-stack desktop activation configs - [`4148ae5`](https://github.com/amnezia-vpn/amnezia-client/commit/4148ae5d9c7368e203eb5fba035774ac099a405d) Support IPv6 desktop routes and firewall rules - [`bda2300`](https://github.com/amnezia-vpn/amnezia-client/commit/bda2300bdeb6a858b96cab2078009b03a205fcf3) Enable dual-stack WG/AWG on Android and Apple NE - [`a1117f7`](https://github.com/amnezia-vpn/amnezia-client/commit/a1117f727b517e96f3fd8ad5b88bd528ce27c82f) Fix Codacy IPv6 memcpy findings - [`a890a7c`](https://github.com/amnezia-vpn/amnezia-client/commit/a890a7c53c568961fc480a4e9bb7b9091bfc65b8) Prevent IPv6 leak on mobile when server has no IPv6 - [`6dc8de8`](https://github.com/amnezia-vpn/amnezia-client/commit/6dc8de8165b45c93ce59edbda9af58d9329a471c) fix: probe container IPv6 egress over UDP instead of ICMP - [`86156af`](https://github.com/amnezia-vpn/amnezia-client/commit/86156af4e0a21f0ee2a47f4ccf26e710843868ba) fix: gate server WG/AWG IPv6 address on host capability - [`4df7960`](https://github.com/amnezia-vpn/amnezia-client/commit/4df7960dd81b86f63572df569316adbfa6dd1372) fix: exclude IPv6 WireGuard endpoints from the tunnel on Linux ### 📊 Changes **46 files changed** (+1150 additions, -271 deletions) <details> <summary>View changed files</summary> 📝 `client/android/protocolApi/src/main/kotlin/Protocol.kt` (+1 -0) 📝 `client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/Wireguard.kt` (+31 -11) 📝 `client/core/configurators/awgConfigurator.cpp` (+1 -0) 📝 `client/core/configurators/wireguardConfigurator.cpp` (+142 -13) 📝 `client/core/configurators/wireguardConfigurator.h` (+2 -0) 📝 `client/core/controllers/ipSplitTunnelingController.cpp` (+31 -13) 📝 `client/core/controllers/selfhosted/importController.cpp` (+98 -18) 📝 `client/core/installers/awgInstaller.cpp` (+24 -7) 📝 `client/core/installers/wireguardInstaller.cpp` (+25 -2) 📝 `client/core/models/protocols/awgProtocolConfig.cpp` (+14 -2) 📝 `client/core/models/protocols/awgProtocolConfig.h` (+4 -2) 📝 `client/core/models/protocols/wireGuardProtocolConfig.cpp` (+14 -2) 📝 `client/core/models/protocols/wireGuardProtocolConfig.h` (+4 -2) 📝 `client/core/utils/constants/configKeys.h` (+3 -0) 📝 `client/core/utils/constants/protocolConstants.h` (+9 -0) 📝 `client/core/utils/networkUtilities.cpp` (+106 -10) 📝 `client/core/utils/networkUtilities.h` (+1 -0) 📝 `client/core/utils/selfhosted/scriptsRegistry.cpp` (+4 -0) 📝 `client/daemon/daemon.cpp` (+8 -6) 📝 `client/daemon/interfaceconfig.cpp` (+8 -11) _...and 26 more files_ </details> ### 📄 Description ## Summary Adds dual-stack IPv6 support for WireGuard and AmneziaWG across config parsing/generation, self-hosted setup, desktop activation, platform routing/firewall handling, Android, and Apple NetworkExtension paths. IPv6 client routing is generated only when WG/AWG has a real client IPv6 address and self-hosted container IPv6 egress is available. Otherwise generated configs remain IPv4-only to avoid IPv6 leaks or the previous fake ULA behavior. ## Changes - Added optional WG/AWG config keys: - `client_ipv6` - `subnet_ipv6_address` - `subnet_ipv6_cidr` - Added default IPv6 WG/AWG server subnets. - Updated native WG import parsing for: - dual-stack `Address` - IPv6 `AllowedIPs` - IPv6 `DNS` - bracketed IPv6 `Endpoint` - Updated self-hosted WG/AWG generation to: - configure IPv4 and IPv6 interface addresses - allocate IPv4 and IPv6 peer addresses from existing peers - probe container IPv6 egress before issuing IPv6 client routes - add guarded IPv6 forwarding and `ip6tables` NAT/forwarding rules - Updated desktop activation to split addresses, routes, DNS, and endpoints by IP family. - Updated Linux/macOS/Windows route, firewall, DNS, and endpoint handling for IPv6. - Updated Android and Apple NE WG/AWG config paths for dual-stack addresses/routes. - Added tests for IPv6 import, JSON round-trips, and desktop activation JSON. ## Testing Passed: - Docker Qt/CMake configure - Docker build target: `test_multiple_imports` - Docker CTest: `MultipleImportsTest` - Docker Android Kotlin compile: - `:protocolApi:compileDebugKotlin` - `:wireguard:compileDebugKotlin` - macOS host Swift syntax parse: - `WGConfig.swift` - `PacketTunnelProvider+WireGuard.swift` - `git diff --check HEAD~6..HEAD` ## Notes Full iOS/macOS NetworkExtension `xcodebuild` was not run because this host only has Command Line Tools installed, without full Xcode or iOS SDKs. OpenVPN, Xray, and IKEv2 IPv6 behavior is intentionally unchanged in this pass. WireGuard and AmneziaWG/AWG, including direct Amnezia tunnels, gain dual-stack support when a real client IPv6 address and server/container IPv6 egress are available. ETA: some clarity to avoid confusion. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-14 21:05:50 +00:00

bsakaguchi referenced this issue

2026-10-14 21:06:43 +00:00

[PR #2867] [MERGED] Feat: Force update #2991