diff --git a/files/etc/init.d/parahub-vpn-tunnel b/files/etc/init.d/parahub-vpn-tunnel
new file mode 100755
index 0000000..a3eeaa5
--- /dev/null
+++ b/files/etc/init.d/parahub-vpn-tunnel
@@ -0,0 +1,71 @@
+#!/bin/sh /etc/rc.common
+# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
+# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
+# handler, so we create the tunnel manually with ip6gre.
+#
+# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
+# Destination Options extension headers (added by default encaplimit 4).
+
+START=96
+STOP=10
+
+VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
+GRE_LOCAL_IP="172.16.0.2"
+GRE_GATEWAY="172.16.0.1"
+
+start() {
+    # Only for Bumblebee role
+    [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
+
+    # Wait for Yggdrasil address (up to 60s)
+    local ygg_addr="" attempts=0
+    while [ $attempts -lt 30 ]; do
+        ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
+        [ -n "$ygg_addr" ] && break
+        attempts=$((attempts + 1))
+        sleep 2
+    done
+
+    if [ -z "$ygg_addr" ]; then
+        logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
+        return 1
+    fi
+
+    # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
+    ip -6 tunnel add gre6-vpn mode ip6gre \
+        remote "$VPS_YGG" \
+        local "$ygg_addr" \
+        encaplimit none
+    ip addr add ${GRE_LOCAL_IP}/24 dev gre6-vpn
+    ip link set gre6-vpn mtu 1400 up
+
+    # Default route through GRE (table 100 — used by guest policy routing)
+    ip route add default via "$GRE_GATEWAY" table 100
+
+    # Guest subnet direct route in table 100
+    # Without this, router's own replies (source IP in guest subnet) go through
+    # GRE instead of back to the guest client (ip rule matches source-based)
+    local guest_subnet
+    guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
+    if [ -n "$guest_subnet" ]; then
+        local guest_dev
+        guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
+        if [ -n "$guest_dev" ]; then
+            ip route add "$guest_subnet" dev "$guest_dev" table 100
+            logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
+        else
+            logger -t parahub-vpn "Warning: guest device not found for $guest_subnet"
+        fi
+    fi
+
+    # Reload firewall so vpn_tunnel zone picks up gre6-vpn device
+    /etc/init.d/firewall reload 2>/dev/null &
+
+    logger -t parahub-vpn "GRE6 tunnel up: ${GRE_LOCAL_IP} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
+}
+
+stop() {
+    ip route flush table 100 2>/dev/null
+    ip -6 tunnel del gre6-vpn 2>/dev/null
+    logger -t parahub-vpn "GRE6 tunnel down"
+}
diff --git a/files/etc/uci-defaults/99-parahub-mesh b/files/etc/uci-defaults/99-parahub-mesh
index 19b39bf..f22b607 100755
--- a/files/etc/uci-defaults/99-parahub-mesh
+++ b/files/etc/uci-defaults/99-parahub-mesh
@@ -219,15 +219,10 @@ set network.wan=interface
 set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 
-# --- GRE6 tunnel (guest traffic → VPS gateway via Yggdrasil) ---
+# --- VPN tunnel interface (device created by parahub-vpn-tunnel init script) ---
 set network.vpn_tunnel=interface
-set network.vpn_tunnel.proto='grev6'
-set network.vpn_tunnel.peeraddr='200:39f1:6a26:328a:d901:fbd2:d30d:faef'
-set network.vpn_tunnel.ipaddr='172.16.0.2'
-set network.vpn_tunnel.netmask='255.255.255.0'
-set network.vpn_tunnel.gateway='172.16.0.1'
-set network.vpn_tunnel.mtu='1400'
-set network.vpn_tunnel.ip4table='100'
+set network.vpn_tunnel.device='gre6-vpn'
+set network.vpn_tunnel.proto='none'
 
 # --- Policy routing: guest traffic → VPN table 100 ---
 add network rule
@@ -710,8 +705,9 @@ set firewall.@forwarding[-1].dest='yggdrasil'
 YGG_FW_EOF
     uci commit firewall
 
-    # Enable yggdrasil service
+    # Enable yggdrasil service + VPN tunnel (creates GRE6 after yggdrasil starts)
     /etc/init.d/yggdrasil enable 2>/dev/null || true
+    /etc/init.d/parahub-vpn-tunnel enable 2>/dev/null || true
 
     # Save yggdrasil address to node keys file
     YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")