How to Fix Surfshark WireGuard IPv6 Issues on OpenWrt Routers

Surfshark’s WireGuard setup on OpenWrt is fast, lightweight, and usually very stable, but IPv6 can make it confusing. You may see failed IPv6 tests, websites loading slowly, DNS leaks, or traffic bypassing the VPN even though IPv4 looks perfectly protected. The reason is simple: many VPN setups are configured mainly for IPv4, while OpenWrt and modern ISPs often enable IPv6 automatically.

Why IPv6 Causes Problems with Surfshark WireGuard on OpenWrt

OpenWrt is a powerful router operating system because it gives you direct control over routing, firewall zones, DNS, and network interfaces. That flexibility is also why IPv6 issues can appear. If your ISP provides IPv6, OpenWrt may advertise IPv6 addresses to your devices on the LAN. Those devices can then send IPv6 traffic directly through your normal WAN connection while IPv4 traffic goes through Surfshark’s WireGuard tunnel.

This creates a classic IPv6 leak: your VPN appears to be working, but some traffic still exposes your real ISP connection. In other cases, IPv6 does not leak but simply fails, causing browsers, streaming apps, or game clients to wait for IPv6 before falling back to IPv4. That delay can feel like a slow VPN, even though the real problem is broken IPv6 routing.

Image not found in postmeta

Step 1: Confirm the Actual Symptom

Before changing your router, identify what is happening. Connect a device through your OpenWrt router and visit an IPv6 test website, a DNS leak test, and an IP checker. You are looking for one of three outcomes:

• IPv6 leak: IPv4 shows Surfshark, but IPv6 shows your ISP.
• Broken IPv6: IPv6 tests fail, and some websites load slowly.
• No IPv6: IPv6 is unavailable, but IPv4 is safely routed through the VPN.

The third result is often acceptable. If your VPN provider does not give you routed IPv6 through the tunnel, having no IPv6 is much safer than leaking ISP IPv6 traffic.

Step 2: Check Your WireGuard Peer Settings

In OpenWrt, go to Network > Interfaces, open your WireGuard interface, and inspect the peer configuration. For a full-tunnel VPN, the peer usually has this under Allowed IPs:

0.0.0.0/0

This sends all IPv4 traffic through Surfshark. For IPv6, a full tunnel would normally also need:

::/0

However, do not blindly add ::/0 unless your Surfshark WireGuard configuration includes a valid IPv6 tunnel address and the service supports IPv6 routing for that setup. If the VPN endpoint does not provide IPv6 inside the tunnel, adding ::/0 can break IPv6 completely. In many Surfshark-on-router setups, the practical solution is not to force IPv6 through WireGuard, but to prevent IPv6 from bypassing WireGuard.

Step 3: Disable IPv6 on the WAN Side If You Do Not Need It

The most reliable fix is to disable ISP IPv6 on the router. In the OpenWrt web interface, go to Network > Interfaces and look for an interface usually named WAN6. If you do not need IPv6, disable or delete the WAN6 interface.

You can also do this with SSH. The exact interface name may vary, but commonly:

uci set network.wan6.disabled='1'
uci commit network
/etc/init.d/network restart

This prevents OpenWrt from receiving and distributing IPv6 connectivity from your ISP. It is a clean solution for users who want a VPN-first router and do not care about native IPv6.

Step 4: Stop Advertising IPv6 to LAN Clients

Even after disabling WAN6, you should make sure OpenWrt is not still handing out IPv6 configuration to LAN devices. Go to Network > Interfaces > LAN > DHCP Server > IPv6 Settings. Consider setting the following options to disabled:

• Router Advertisement-Service: disabled
• DHCPv6-Service: disabled
• NDP-Proxy: disabled

From SSH, the settings often look like this:

uci set dhcp.lan.ra='disabled'
uci set dhcp.lan.dhcpv6='disabled'
uci set dhcp.lan.ndp='disabled'
uci commit dhcp
/etc/init.d/odhcpd restart

After applying this, reconnect your client devices or renew their network leases. Phones and laptops can hold old IPv6 addresses for a while, so a reboot or Wi-Fi reconnect is often necessary.

Image not found in postmeta

Step 5: Use Firewall Rules to Block IPv6 Leaks

If you prefer to keep IPv6 components enabled but want to prevent leaks, add firewall protection. The idea is simple: LAN clients should not be allowed to send IPv6 traffic directly through the normal WAN zone. If IPv6 cannot go through the VPN, it should be blocked.

In Network > Firewall, inspect your zones. Your LAN zone should forward to the Surfshark WireGuard zone, not freely to WAN, if you are building a VPN-only router. Many users create a dedicated firewall zone for the WireGuard interface, often named vpn or wg.

A strong kill-switch style design looks like this:

• LAN to VPN: allowed
• LAN to WAN: rejected or removed
• WAN to LAN: rejected
• Masquerading on VPN zone: enabled
• MSS clamping on VPN zone: enabled, if needed

This prevents both IPv4 and IPv6 from escaping through the ISP connection if the tunnel goes down. If you only remove IPv6 but leave unrestricted LAN-to-WAN forwarding, your router may still leak traffic during VPN failure.

Step 6: Check DNS Behavior

IPv6 problems are not always routing problems. Sometimes they are DNS problems. If your clients receive IPv6 DNS servers from your ISP, they may query those servers outside the VPN. In OpenWrt, you can force clients to use the router for DNS and configure the router to use Surfshark-compatible DNS servers through the tunnel.

Check Network > DHCP and DNS. Make sure unwanted ISP DNS servers are not being advertised to clients. If you have disabled IPv6 advertisement, this becomes easier because clients should no longer receive IPv6 DNS information from the router.

For stricter control, many OpenWrt users also redirect or block outside DNS requests from LAN clients. This is especially useful for smart TVs, streaming boxes, and IoT devices that try to ignore your router’s DNS settings.

Step 7: Restart and Retest Properly

After making changes, restart the network service or reboot the router. Then reconnect your test device. Do not rely on a single browser tab that was already open before the change. Clear the browser cache or use a private window, then run fresh tests.

1. Check your public IPv4 address.
2. Run an IPv6 test.
3. Run a DNS leak test.
4. Disconnect WireGuard briefly to confirm your kill switch blocks traffic.
5. Reconnect WireGuard and confirm browsing works normally.

Common Mistakes to Avoid

• Adding ::/0 without IPv6 tunnel support: This may break connectivity instead of fixing leaks.
• Disabling WAN6 but not LAN IPv6 advertisements: Clients may keep stale IPv6 settings until they reconnect.
• Forgetting DNS leaks: Your IP may look protected while DNS queries still reveal your ISP.
• Leaving LAN-to-WAN forwarding enabled: This weakens your VPN kill switch.
• Testing too soon: Devices often cache IPv6 addresses and DNS information.

Final Thoughts

Fixing Surfshark WireGuard IPv6 issues on OpenWrt is mostly about deciding what you want IPv6 to do. If your VPN setup does not provide working IPv6 through the tunnel, the safest answer is to disable or block IPv6 so it cannot leak through your ISP. For most home VPN routers, that is a practical and privacy-friendly configuration.

OpenWrt gives you the tools to solve the issue properly: disable WAN6, stop LAN IPv6 advertisements, tighten firewall forwarding, and verify DNS behavior. Once configured correctly, Surfshark WireGuard can run cleanly on your router without IPv6 leaks, slow fallbacks, or accidental exposure of your real connection.