IPv6 Routing Rules Not Working to Redirect Local Devices Via Wireguard VPN Clients

[wildland_hondo]

I have the following configuration / setup on my router:

1. Setup 1x OpenVPN client via user Merlin user interface
2. Setup 5x Wireguard VPN clients via the Merlin user interface
3. Router setup as an exit node for Tailscale (via tailmon)
4. Use VPN director to route Tailscale IPv4s into VPN tunnels with failover
5. Manually add Tailscale IPv6 to ip -6 routing table to route IPv6 traffic over VPN (works for wg not for ovpn)

But when I try to do the same for local IP addresses, it works for IPv4 addresses but not for IPv6.

I have tried the following:

Serial​	Action​	IPv4 Result​	IPv6 Result​
1​	Manually add IPv4 and IPv6 (GUA) addresses to routing tables	Routed​	Failed​
2​	Add IPv4 via GUI and IPv6 (GUA) manually to routing tables	Routed​	Failed​
3​	Added IPv6 (LL) to routing tables	N/A ​	Failed​
4​	Created client MAC ipsets and marked traffic with fwmark 0x30/0xf0 and used this rule: ip(6)tables -t mangle -A PREROUTING -m set --match-set client_macs src -j MARK --set-mark 0x30/0xf0 along with ip rules to redirect marked traffic to VPN interfaces	Routed​	Failed​
5​	Tried to do the same as serial 4 but with two ipsets (one for ipv4 and one for ipv6) to route traffic to VPN interfaces	Routed​	Failed​

Could someone tell me what I am doing wrong and why tailscale IPv6 get routed but those of my local devices do not?

Please note that I am not proficient in Linux networking and used forums and AI help to do what I did.

Grateful for all your help. Thanks.



PS: Is there any plan to switch VPN director to use MAC addresses rather than IP addresses and for it to support dual stack VPNs?