---
title: "IPv6 WireGuard Peering"
description: "Fly.io presents WireGuard Peering as a way to connect applications running on its platform privately to AWS, GCP, or other networks, while preserving automatic communication among apps in an organization. Each organization receives a private IPv6 network called a 6PN, with addresses encoding organization, host, and instance identifiers; BPF enforces isolation, and internal DNS resolves app, regional, and peer names. Because WireGuard’s cryptokey routing does not allow overlapping Allowed IPs, Fly swaps the address’s network and host chunks before and after routing, giving the mesh non-overlapping prefixes without changing IPv6 checksums. Users create regional peer configurations with flyctl wireguard create, receiving /120 delegations and organization-specific DNS. The post says this works for database gateways such as an AWS RDS setup, direct app-instance access, and arbitrary services, with connectivity remaining direct between nodes."
---

# IPv6 WireGuard Peering

[Fly.io](https://yomu.fyi/company/fly-io) · Dec 23, 2020

**Type:** Announcement

## Summary

Fly.io presents WireGuard Peering as a way to connect applications running on its platform privately to AWS, GCP, or other networks, while preserving automatic communication among apps in an organization. Each organization receives a private IPv6 network called a 6PN, with addresses encoding organization, host, and instance identifiers; BPF enforces isolation, and internal DNS resolves app, regional, and peer names. Because WireGuard’s cryptokey routing does not allow overlapping Allowed IPs, Fly swaps the address’s network and host chunks before and after routing, giving the mesh non-overlapping prefixes without changing IPv6 checksums. Users create regional peer configurations with flyctl wireguard create, receiving /120 delegations and organization-specific DNS. The post says this works for database gateways such as an AWS RDS setup, direct app-instance access, and arbitrary services, with connectivity remaining direct between nodes.

## Context

Fly.io wanted to make it straightforward to run and connect more than conventional web applications on its platform. The design also addresses WireGuard’s restriction that peer Allowed IPs cannot overlap, which conflicts with a 6PN prefix spanning multiple hosts.

## Approach / What changed

Fly.io assigns each organization a private IPv6 6PN and embeds organization, host, and instance information in addresses. BPF enforces 6PN isolation and swaps network and host address chunks around WireGuard routing. Internal DNS provides service discovery, while flyctl wireguard create generates peer configurations for external networks and devices.

## Takeaways

- Each Fly.io organization has a private 6PN, with every app instance receiving a /112 delegation; the organization has an effective /48 prefix.
- BPF swaps the host and network portions of IPv6 addresses before and after WireGuard routing, avoiding overlapping Allowed IPs while leaving IPv6 checksums unchanged.
- WireGuard peers receive /120 delegations, organization-specific DNS, and names under \_peer.internal; an AWS gateway can connect outward without exposing management services on the AWS side.

**Tags:** [BPF](https://yomu.fyi/topic/bpf), [IPv6](https://yomu.fyi/topic/ipv6), [WireGuard](https://yomu.fyi/topic/wireguard)

- Source: [Fly.io](https://fly.io/blog/ipv6-wireguard-peering)
- Source URL: https://fly.io/blog/ipv6-wireguard-peering
- Ingested by Yomu: 2026-09-03T01:26:19.539Z

[Read original post](https://fly.io/blog/ipv6-wireguard-peering)