Every VPS comparison on this site lists it: "single /128 IPv6 by default", "/64 IPv6", "no IPv6 on the base plan". It reads like a spec-sheet detail. For a self-hosted WireGuard server it is not - it decides whether your peers can have IPv6 at all.
Still choosing a host? A Contabo Cloud VPS 4 at €5.50/month (affiliate link) comes with a /64, enough to give every peer its own IPv6 address, and our free WireGuard config generator writes the server and peer files you then extend with the IPv6 lines below. Prefer a US host with a 30-day money-back guarantee? Ultahost VPS Basic is 5.52 $ a month on a 24-month term and ships with 4 dedicated IPv6 addresses instead of a /64 (read on ultahost.com on 26 October 2026): enough for the server and three peers with a public address, the rest on ULA addresses. The generator is free with no account, up to 250 devices, and its ZIP export holds every client .conf and its QR code as a PNG, handy to set up a whole office or family in one go. Another option: HostPapa Unmanaged VPS Lite (affiliate link) is 2.95 $ a month on a 3-year term, then the regular rate (1 core, 1 GB RAM, 25 GB NVMe, root SSH access, 30-day money-back guarantee, read on 28 October 2026).
Generate your WireGuard configs here
Type your server address, choose the number of devices, then scan each QR code from the app.
All keys are generated in your browser (Curve25519 / X25519). Nothing is sent to our servers - your config stays 100% private.
Public IPv4 or domain of the machine that will run WireGuard. No server yet? Leave it empty and add it later.
Free, no account: up to 250 clients, each .conf with its QR code, and one ZIP with every file.
Everything the device sends to the internet goes through your server.
Advanced settingsTunnel subnet, DNS, site-to-site LANs. The defaults work for most setups.
Optional. Enter the LAN subnet behind the server and/or behind a client that acts as a site gateway (a router, a Raspberry Pi, a NAS). The generator adds each LAN to the server's AllowedIPs, gives every peer the routes to the other LANs, and writes the forwarding rules on the gateways. Leave a field empty for a normal client.
What you download
wg0.conf
for the server
client1.conf
one per device
QR (sample)
for the phone app
Illustration only: the lines and the QR code are fictional, no real key. Your real files are generated in your browser when you click.
Still picking the VPS? Our Best VPS for a VPN compares eight hosts for self-hosting WireGuard on the price you actually pay, including the two line items that change the ranking: paid IPv4 and throttling.
WireGuard does not care which stack you use
Start with the easy part. The WireGuard documentation is explicit: "Any combination of IPv4 and IPv6 can be used, for any of the fields."
The endpoint can be IPv4 while the tunnel carries IPv6, or the reverse. There is no separate IPv6 mode to enable and no second daemon to run. A dual-stack tunnel is just two addresses on the same interface.
What /64 and /128 actually mean for you
This is where the host's spec sheet starts to matter.
A /128 is one single address. It is your server's own IPv6 and nothing more. You can give the server IPv6 connectivity, but you have no addresses left to hand out - your peers cannot each have one.
A /64 is a block. It is the standard allocation size for a single network segment, and it leaves you free to assign an address to every peer from inside it.
So a host advertising "IPv6 included" with a single /128 is telling the truth and still not giving you what a VPN server needs. That is the line worth reading twice in a comparison table, ours included.
AllowedIPs does two different jobs
This is the part people get wrong, and it is documented plainly. The same field behaves differently depending on direction:
"when sending packets, the list of allowed IPs behaves as a sort of routing table"
"when receiving packets, the list of allowed IPs behaves as a sort of access control list"
WireGuard calls the whole arrangement a Cryptokey Routing Table - "the simple association of public keys and allowed IPs".
The consequence for IPv6 is direct: if you want a peer's IPv6 traffic to go through the tunnel, ::/0 has to be in its AllowedIPs. Setting 0.0.0.0/0 alone routes IPv4 only, and the peer's IPv6 traffic leaves through its normal connection - outside the tunnel, with its real address.
That is a leak, and it is not a WireGuard bug. It is the access control list doing exactly what it was told.
The configuration in practice
On the server, give the interface both an IPv4 and an IPv6 address from your allocation. On each peer, list both stacks in AllowedIPs. If you want everything tunnelled, that is 0.0.0.0/0, ::/0; if you want a split, list the specific prefixes for each stack.
Two things to keep in mind. Forwarding has to be enabled for both families, not just IPv4 - they are separate sysctl settings, and enabling one does nothing for the other. And your firewall rules exist twice as well: iptables and ip6tables are different tables, so a masquerade or a kill switch written only for IPv4 leaves IPv6 unprotected.
Dual stack also changes your MTU: WireGuard adds 60 bytes over an IPv4 endpoint and 80 over an IPv6 one, so a PPPoE line lands at 1432 or 1412. Our free WireGuard Cheat Sheet (5-page PDF, direct download, no sign-up) keeps that MTU table, the 0.0.0.0/0, ::/0 rule for AllowedIPs and the fd00:8::/64 addressing convention used in our templates on one printable page. Download the cheat sheet.
A VPN changes your IP. It does not change your browser.
A tunnel replaces the address a service sees. It changes nothing about what your browser announces on its own - fonts, screen, time zone, graphics stack - and that combination is often stable enough to recognise you across sessions, tunnel or no tunnel.
Measure your own browser fingerprint - passive, no questions, no account, no email.
Verify rather than assume
After setting it up, check from the client that your public IPv6 is the server's and not your own. A tunnel that carries IPv4 correctly while leaking IPv6 looks perfectly healthy from the inside - the handshake succeeds, traffic flows, and nothing in the logs complains.
If your host only gives you a /128, the honest options are to run IPv4-only in the tunnel and block IPv6 on the peers so it cannot leak, or to change host. Half-configured dual stack is worse than no IPv6 at all.
Affiliate link
★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200 Mbit/s port
Self-host your VPN on your own VPS → ContaboCloud VPS 4 · 5,50 €/mo · Card or PayPal · orders from outside the EU accepted→Price checked 17 Oct 2026, 24-month term
