Dmitriy K wrote in #note-3:
afaik, NPt does this, no?
Sadly, NPt does not work for my use case. I have a situation where a network service is utterly broken on IPv4 due to network congestion, is intermittently broken on the HE IPv6 tunnel broker due to network congestion and works fine on Cloudflare Warp+. The device that must access it supports IPv6, but not Wireguard, so I set up Wireguard on my pfSense router. I decided to workaround the network congestion and device limitations by routing traffic Cloudflare Warp+ through my pfSense router, so I:
1. Configure wireguard on pfsense using the output of wgcf
2. Assign the interface while setting the upstream gateways to the IPv4 /32 and IPv6 /128 provided by cloudflare.
3. Add an outbound hybrid NAT rule for both IPv4 and IPv6.
4. Make policy based routing rules for the device so that all traffic is routed over Cloudflare Warp+.
Then I observe that only IPv4 traffic is routed over Cloudflare Warp+ while IPv6 traffic is still going over the HE tunnel broker. Oddly enough, `sudo pfctl -s nat` seems to have the same rules for IPv4 and IPv6, so it is not clear to my why this is working for IPv4, but not for IPv6:
nat on tun_wg0 inet from <tonatsubnets> to any port = isakmp -> 172.16.0.2 static-port
nat on tun_wg0 inet6 from <tonatsubnets> to any port = isakmp -> fd01:5ca1:ab1e:xxxx:xxxx:xxxx:xxxx:xxxx static-port
nat on tun_wg0 inet from <tonatsubnets> to any -> 172.16.0.2 port 1024:65535
nat on tun_wg0 inet6 from <tonatsubnets> to any -> fd01:5ca1:ab1e:xxxx:xxxx:xxxx:xxxx:xxxx port 1024:65535
I noticed that different devices get different /128 IPv6 addresses, so I censored the IPv6 address. Also, I probably should look into why there are isakmp rules, but getting back to my problem, I cannot use NPt because Cloudflare does not give me a /64 (maybe I'll try using one without permission and see how that goes). I have been frustrated over the poor routing situation over which I have no control, found a way to route around it and then hit a wall because pfSense does not support IPv6 outbound NAT.
I know that NAT is problematic when you do peer to peer connectivity, which is why the IPv6 developers wanted to do away with it. That is great in theory, but in practice, it does not let me work around poor routing when I am too small to have my own ASN, negotiate peering and do BGP. If everyone did the right thing, none of that would be necessary, but I find that expecting everyone to do the right thing is unrealistic. I suppose cloudflare could just provide a /64 to let me use NPt, but they do not have any reason to do that (although I will probably ask). For my application, I do not need peer to peer connectivity, so using NAT should work around the network congestion without any obvious downsides.
Here is what I see myself doing if I do not figure out a way to make this work on pfSense:
1. Setup a Linux machine.
2. Have pfSense send IPv6 traffic for this device to it.
3. Have the Linux machine do outbound IPv6 NAT to send traffic over Cloudflare Warp+.
Updated by Kill Bill 
Updated by 
Updated by 
Updated by 
Updated by 
