Wireguard broken: ip6tables-restore (nf_tables): Couldn't load match `addrtype':No such file or directory


I had working Wireguard VPN from Turris to a remote server. The Wireguard is running from a LXC container with Alpine Linux. Some recent updates broke the Wireguard.

$ wg-quick up vpn
[#] ip link add vpn type wireguard
[#] wg setconf vpn /dev/fd/63
[#] ip -4 address add dev vpn
[#] ip -6 address add xxxxxxxxxxxxxxxxxxxxxxxxxxxxx/128 dev vpn
[#] ip link set mtu 1420 up dev vpn
[#] resolvconf -a vpn -m 0 -x
[#] wg set vpn fwmark 51820
[#] ip -6 route add ::/0 dev vpn table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip6tables-restore -n
Warning: Extension addrtype is not supported, missing kernel module?
ip6tables-restore v1.8.10 (nf_tables): Couldn't load match `addrtype':No such file or directory

Error occurred at line: 2
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
[#] resolvconf -d vpn -f
[#] ip -6 rule delete table 51820
[#] ip -6 rule delete table main suppress_prefixlength 0
[#] ip link delete dev vpn

That’s strange, because the module is there:

$ lsmod | grep addrtype
xt_addrtype            16384  0 
x_tables               24576 59 xt_connlimit,iptable_nat,xt_state,xt_nat,xt_helper,xt_conntrack,xt_connmark,xt_connbytes,xt_REDIRECT,xt_MASQUERADE,xt_FLOWOFFLOAD,xt_CT,ipt_REJECT,xt_time,xt_tcpudp,xt_tcpmss,xt_statistic,xt_recent,xt_quot

When I try the same, but only with IPv4, it complains about two modules:

[#] iptables-restore -n
Warning: Extension addrtype revision 0 not supported, missing kernel module?
Warning: Extension comment revision 0 not supported, missing kernel module?
iptables-restore v1.8.10 (nf_tables): Could not fetch rule set generation id: Invalid argument

But the xt_comment module is also loaded.
What could be wrong?

TurrisOS 6.5.0, kernel 5.15.146, Alpine Linux 3.19, wireguard-tools v1.0.20210914

I did rollback of the TurrisOS up to 6.4.3 with kernel 5.15.130 and wg-quick is still not working. For sure it was working back then. So it means the problem is on the side of Alpine.