IPv4 and IPv6 enter through different doors
Mac-local and downstream IPv4 traffic use the supported mihomo TUN path. Downstream IPv6 is captured from the selected physical interface by a macOS BPF broker and handed to the project-patched opensurge-packet listener in mihomo's userspace gVisor stack.
The packet channel carries source MAC identity alongside the layer-3 packet. That lets the IPv6 connection reuse the same device mapping, policy overlays, and outbound selection model.
Topology remains a hard requirement
Automatic downstream IPv6 uses dnsmasq RA, SLAAC, and RDNSS in supported topologies. A shared layer-2 network must not have a competing IPv6 router advertisement or default route. Bypass-router mode uses a manual ULA setup instead of pretending it can selectively override another router's RA.
Reachability is not the same as native IPv6
An IPv6 destination can work through a proxy exit even when the ISP does not provide native public IPv6. Native DIRECT IPv6 still requires upstream addressing and a valid route; OpenSurge cannot manufacture carrier connectivity.
The capability remains experimental because packet ingress, topology control, device identity, QUIC, and stop-time withdrawal all need host-network validation—not only unit tests.
FAQ
Questions people ask before changing the network
Does IPv6 traffic go through the macOS utun interface?
Downstream IPv6 does not. It uses the BPF broker and patched mihomo userspace packet listener. The overall gateway still requires transparent mode to remain set to TUN.
Do I need native ISP IPv6?
Not for every proxied IPv6 destination. You do need native upstream IPv6 for true DIRECT public IPv6 egress; otherwise reachability depends on an IPv6-capable proxy exit.