How to Build a Dual-Stack (IPv4 + IPv6) WireGuard VPN Server with Unbound DNS on Netcup

# 1. Identify your primary Netcup network interface name (usually eth0 or ens3)
PRIMARY_IF=$(ip -4 route show default | awk '{print $5; exit}')
echo "Detected Primary Netcup Interface: ${PRIMARY_IF}"

# 2. Configure persistent dual-stack IP forwarding and BBR congestion control
sudo tee /etc/sysctl.d/99-wireguard-router.conf > /dev/null <<'EOF'
# Enable IPv4 and IPv6 packet forwarding across interfaces
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.default.forwarding = 1

# Enable loose Reverse Path Filtering so asymmetric VPN return paths are not dropped
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2

# Enable BBR TCP congestion control for high-bandwidth VPN throughput
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF

sudo sysctl --system

Detected Primary Netcup Interface: eth0
* Applying /etc/sysctl.d/99-wireguard-router.conf ...
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

sudo apt update
sudo apt install -y wireguard wireguard-tools qrencode iptables unbound dns-root-data

# Create locked-down key and client storage directories
sudo mkdir -p /etc/wireguard/{keys,clients}
sudo chmod -R 0700 /etc/wireguard

# Generate server private and public Curve25519 keys with strict umask 077
sudo sh -c 'umask 077; wg genkey | tee /etc/wireguard/keys/server_private.key | wg pubkey > /etc/wireguard/keys/server_public.key'

# Verify key permissions
sudo ls -la /etc/wireguard/keys/

drwx------ 2 root root 4096 Oct 29 11:15 .
-rw------- 1 root root   45 Oct 29 11:15 server_private.key
-rw------- 1 root root   45 Oct 29 11:15 server_public.key

server:
    num-threads: 2
    interface: 127.0.0.1
    interface: 10.66.66.1
    interface: fd42:66:66::1
    port: 53

    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes

    # Restrict recursive queries strictly to localhost and the WireGuard subnet
    access-control: 0.0.0.0/0 refuse
    access-control: ::0/0 refuse
    access-control: 127.0.0.0/8 allow
    access-control: 10.66.66.0/24 allow
    access-control: fd42:66:66::/64 allow

    # Privacy & Security Hardening
    hide-identity: yes
    hide-version: yes
    qname-minimisation: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: yes
    prefetch: yes

    # Memory Cache Sizing (Lightweight ~64MB total footprint)
    msg-cache-size: 16m
    rrset-cache-size: 32m
    neg-cache-size: 4m
    so-rcvbuf: 4m
    so-sndbuf: 4m

sudo sed -i '/port: 53/a \    ip-freebind: yes' /etc/unbound/unbound.conf.d/wg-vpn.conf
sudo unbound-checkconf
sudo systemctl enable --now unbound
dig @127.0.0.1 netcup.com +dnssec +short

unbound-checkconf: no errors in /etc/unbound/unbound.conf
46.38.224.21

PRIMARY_IF=$(ip -4 route show default | awk '{print $5; exit}')
SERVER_PRIVKEY=$(sudo cat /etc/wireguard/keys/server_private.key)

sudo tee /etc/wireguard/wg0.conf > /dev/null <<EOF
[Interface]
Address = 10.66.66.1/24, fd42:66:66::1/64
ListenPort = 51820
PrivateKey = ${SERVER_PRIVKEY}
MTU = 1420
SaveConfig = false

# Enable forwarding, TCP MSS clamping, and dual-stack NAT Masquerade
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostUp = iptables -t mangle -A FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostUp = iptables -t mangle -A FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostUp = iptables -t nat -A POSTROUTING -s 10.66.66.0/24 -o ${PRIMARY_IF} -j MASQUERADE
PostUp = ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -A FORWARD -o wg0 -j ACCEPT
PostUp = ip6tables -t mangle -A FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostUp = ip6tables -t mangle -A FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostUp = ip6tables -t nat -A POSTROUTING -s fd42:66:66::/64 -o ${PRIMARY_IF} -j MASQUERADE

# Cleanly remove rules when wg0 stops
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = iptables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = iptables -t nat -D POSTROUTING -s 10.66.66.0/24 -o ${PRIMARY_IF} -j MASQUERADE
PostDown = ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -D FORWARD -o wg0 -j ACCEPT
PostDown = ip6tables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = ip6tables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
PostDown = ip6tables -t nat -D POSTROUTING -s fd42:66:66::/64 -o ${PRIMARY_IF} -j MASQUERADE
EOF

sudo chmod 0600 /etc/wireguard/wg0.conf
sudo ufw allow 51820/udp comment 'WireGuard VPN'
sudo systemctl enable --now wg-quick@wg0
sudo wg show wg0

interface: wg0
  public key: <SERVER_PUBLIC_KEY>
  private key: (hidden)
  listening port: 51820

sudo tee /usr/local/sbin/wg-add-peer > /dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

if [[ $# -lt 2 ]]; then
  echo "Usage: sudo wg-add-peer <client-name> <octet-2-to-254>"
  echo "Example: sudo wg-add-peer macbook-pro 10"
  exit 1
fi

CLIENT_NAME="$1"
OCTET="$2"
SERVER_IP=$(ip -4 addr show "$(ip -4 route show default | awk '{print $5; exit}')" | awk '/inet / {split($2,a,"/"); print a[1]; exit}')
SERVER_PUBKEY=$(cat /etc/wireguard/keys/server_public.key)
CLIENT_DIR="/etc/wireguard/clients/${CLIENT_NAME}"

if [[ -d "${CLIENT_DIR}" ]]; then
  echo "Error: Peer ${CLIENT_NAME} already exists in ${CLIENT_DIR}"
  exit 1
fi

umask 077
mkdir -p "${CLIENT_DIR}"
wg genkey | tee "${CLIENT_DIR}/private.key" | wg pubkey > "${CLIENT_DIR}/public.key"
wg genpsk > "${CLIENT_DIR}/preshared.key"

CLIENT_PRIVKEY=$(cat "${CLIENT_DIR}/private.key")
CLIENT_PUBKEY=$(cat "${CLIENT_DIR}/public.key")
CLIENT_PSK=$(cat "${CLIENT_DIR}/preshared.key")

# 1. Append Peer block to /etc/wireguard/wg0.conf
cat >> /etc/wireguard/wg0.conf <<PEER_EOF

# Peer: ${CLIENT_NAME}
[Peer]
PublicKey = ${CLIENT_PUBKEY}
PresharedKey = ${CLIENT_PSK}
AllowedIPs = 10.66.66.${OCTET}/32, fd42:66:66::${OCTET}/128
PEER_EOF

# 2. Hot-reload wg0 configuration without dropping active VPN tunnels
wg syncconf wg0 <(wg-quick strip wg0)

# 3. Generate client .conf file
cat > "${CLIENT_DIR}/${CLIENT_NAME}.conf" <<CLIENT_EOF
[Interface]
PrivateKey = ${CLIENT_PRIVKEY}
Address = 10.66.66.${OCTET}/32, fd42:66:66::${OCTET}/128
DNS = 10.66.66.1, fd42:66:66::1
MTU = 1420

[Peer]
PublicKey = ${SERVER_PUBKEY}
PresharedKey = ${CLIENT_PSK}
Endpoint = ${SERVER_IP}:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
CLIENT_EOF

echo "==> Created peer profile: ${CLIENT_DIR}/${CLIENT_NAME}.conf"
echo "==> Scan QR code below with the official WireGuard iOS/Android app:"
qrencode -t ansiutf8 < "${CLIENT_DIR}/${CLIENT_NAME}.conf"
EOF

sudo chmod 0700 /usr/local/sbin/wg-add-peer
sudo /usr/local/sbin/wg-add-peer iphone-16 10