DDNS where ISP offers both IPv4 and IPv6 with no Inbound on IPv4

[DennisMF]

I recently changed ISP and purchased an RT-AXE7800 as the main AiMesh router to connect to the new fibre internet connection. This new ISP provides an IPv4 address that will not support the inbound connection required for a VPN. However their IPv6 address can be used for this purpose.

I configured a WireGuard VPN on this router and it is now working well using their IPv6 address as the end point.

They do not guarantee that the IPv6 address will not be changed. So I configured DDNS on asuscomm.com. This DNS entry contains both a A record and an AAAA record. It provides both IPv4 and IPv6 addresses.

When I replace the end point IPv6 address with the DDNS domain name in the WireGuard configuration, the WireGuard VPN will not connect.

I suspect that WireGuard is using the IPv4 address supplied by the DNS entry rather that the IPv6 from the AAAA record. The IPv4 address will not work for inbound traffic. Or possibly I am using an incorrect format for the DNS end point config.

I can manually change the WireGuard config whenever the address changes, but an automatic solution is preferable.

Any suggestions would be well received.

An option in the ASUS WireGuard configuration to force the use of IPv6 would help. Alternatively an option in the DDNS setup to only configure the IPv6 address would also probably work.

This is a growing problem as ISPs start to use shared IPv4 addresses for multiple domestic users.

Thanks and Regards,

Dennis MF

[Alex52]

You need to open web settings and change the firewall rules. Change the default IPv4 filter (no) to yes.

[jzchen]

I'm not very versed on VPNs but this may have to do with Firewall/Port forwarding rules as @Alex52 mentions.  (As per my Google search):  ASUS DDNS supports IPv6 on newer firmware versions, but the port forwarding is handled differently.  With IPv6 every device gets assigned a unique IP address, whereas IPv4 can have "local/private" IP addresses.

I can't think of an answer as I don't VPN much, but hope this is a clue/helps...