diff --git a/hosts/xlab-gateway/networking.nix b/hosts/xlab-gateway/networking.nix
index d6b8f5d..4da3b67 100644
--- a/hosts/xlab-gateway/networking.nix
+++ b/hosts/xlab-gateway/networking.nix
@@ -48,6 +48,7 @@
           chain postrouting {
             type nat hook postrouting priority filter; policy accept;
             oifname "wan99.0" masquerade
+            oifname "wg-to-wgnet" ip6 masquerade
           }
         }
 
@@ -273,7 +274,7 @@
       ];
       routes = [
         { Destination = "0.0.0.0/0"; Scope = "link"; Table = 1002; }
-        # IPv6 not routed through tunnel — wgnet peer doesn't forward it
+        { Destination = "::/0"; Scope = "link"; Table = 1002; }
       ];
     };