OPNsense Forum

Archive => 20.7 Legacy Series => Topic started by: qdrop on September 03, 2020, 02:19:18 pm

Title: Wireguard-Go not able to start tunnel if WAN not available on boot
Post by: qdrop on September 03, 2020, 02:19:18 pm

Hi there.

We face an issue with the wireguard-go plugin: If the WAN port of the OPNsense-appliance comes up delayed (maybe 10-20secs), Wireguard does not manage to resolve the configured endpoint properly:

Code: [Select]

...
Name does not resolve: 'hostname.domain.tld:51820'
Configuration parsing error
[#] rm -f /var/run/wireguard/wg0.sock

When opening the webinterface and clicking on "Save" within the Wireguard configuration, the tunnel establishes just fine.
This issue is a bit critical as we're using the tunnel itself to manage the deployed gateways.

Any help is highly appreciated.

qdrop

Title: Re: Wireguard-Go not able to start tunnel if WAN not available on boot
Post by: mimugmail on September 03, 2020, 02:38:19 pm

Then you have to create a rc.late hook to restart again, or you just use IP address instead of DNS

Title: Re: Wireguard-Go not able to start tunnel if WAN not available on boot
Post by: qdrop on September 03, 2020, 04:32:55 pm

I implemented another workaround: A static mapping within the unbound resolver.

Still, how can this rc.late hook be implemented exactly?

Title: Re: Wireguard-Go not able to start tunnel if WAN not available on boot
Post by: mimugmail on September 03, 2020, 04:35:13 pm

Go to /usr/local/etc/rc.syshook.d/start/, copy 50-wireguard to 99-wireguard and make the call
/usr/local/etc/rc.d/wireguard restart

Title: Re: Wireguard-Go not able to start tunnel if WAN not available on boot
Post by: qdrop on September 04, 2020, 11:19:55 am

Quote from: mimugmail on September 03, 2020, 04:35:13 pm

Go to /usr/local/etc/rc.syshook.d/start/, copy 50-wireguard to 99-wireguard and make the call
/usr/local/etc/rc.d/wireguard restart

Will this work even if the appliance gets online at a much later point in time? Like after couple of minutes?

Title: Re: Wireguard-Go not able to start tunnel if WAN not available on boot
Post by: franco on September 04, 2020, 12:00:13 pm

Wireguard does not use a newwanip type event listener that would help recover from these scenarios...

See e.g.: https://github.com/opnsense/plugins/blob/ee487f15f6a1ebbc416c68b74c3397edc3aa404b/net/igmp-proxy/src/etc/inc/plugins.inc.d/igmpproxy.inc#L61


Cheers,
Franco