Messages

Cleaned up  #2.

nano /usr/local/opnsense/scripts/wireguard/wg0_monit_start.sh

#!/bin/bash

# Test the wg0 connection state and if no packets are received ( a match )
# then wg0 needs to be restarted with exit 0
# which uses ZeroStatus test to re-start wg0

#==
# pulls vpn end-tunnel address from ifconfig wg0
ip_addr=$(ifconfig wg0 | awk '/inet / {print $2}')


read -ra fields <<< "$(netstat -i | grep -E '\swg0\s')"
#echo "rx_packets= ${fields[4]}"

# Test wg0 column 5 or fields[4]
# add echo protection 070726

[[ -n "${fields[4]}" && "${fields[4]}" -eq 0 ]] \
&& { echo "_wg0 !connected $(date +"%Y-%m-%d %H:%M:%S")"; exit 0; } \
|| { echo "_wg0 connected to $ip_addr $(date +"%Y-%m-%d %H:%M:%S")"; exit 1; }

#==

# equals a '0'  -> match -> exit 0 -> re-starts wg0
# not equal condition  ->   no match -> do not restart wg0

# Verification
# netstat -i | grep wg0
# wg0      1420 <Link#9>          wg0                                  0    0    0    4528    0    0
# wg0          - xxx.xxx.xxx.xxx/32   xxx.xxx.xxx.xxx                        0    -    -    -


Program 'wg0_monit_start'
  status                      OK
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  last exit value              1
  last output                  _wg0 connected to xxx.xxx.xxx.xxx 2026-07-09 07:55:54
  data collected              Thu, 09 Jul 2026 07:57:54

I wrote a monit script that uses wg0_monit_start.sh to automatically restart wg0 by monitoring netstat -i | grep wg0. It will take 2-3 minutes.

The new monit status is updated periodically.

https://forum.opnsense.org/index.php?topic=52172.0

Updated the script with an alternatuve method
====
#!/bin/bash
#Alternative
shopt -s extglob

# Test the wg0 connection state using monit ZeroStatus test
# RC =1 is the connection state which defaults the wg0 as being connected -> exit 1
# reports as 'status =1'

RC=1

# If no wg0 packets are received, it needs to be restarted with RC =0 -> exit 0
# Important: need to report 'status =0' to the opnsense monit ZeroStatus test
# which will re-start the wg0 connection

# in-line command
#[[ $(netstat -i | grep -F -- "          0     - " | grep "100.80.224.xxx"  | wc -l) -eq "1" ]] \
#&& RC=0 && echo "!connected"   $(date +"%Y-%m-%d %H:%M:%S") && exit $RC \
#|| echo "connected"  $(date +"%Y-%m-%d %H:%M:%S") && exit $RC


RC=`netstat -i | grep -F -- "          0     - " | grep "100.80.224.xxx" | wc -l`
#echo $RC
[$RC -eq  1 ] && RC="0" || RC="1"

case $RC in
0) printf "wg0 !connected  $(date +"%Y-%m-%d %H:%M:%S") \n" && exit 0;;
1) printf "wg0  connected  $(date +"%Y-%m-%d %H:%M:%S") \n" && exit 1;;
*) printf "Issue with wg0_monit_start.sh \n";;
esac



====

I wrote a monit/bash to restart wg0
https://forum.opnsense.org/index.php?topic=52172.0

Had problems connecting to wg0 interface that required re-starting wg0, so I am sharing my monit implementation.
It is equivalent to re-starting/toggling the dashboard's WG.
Monit needs to start first (3 to 4 minutes) before Monit re-starts WG.

Tested under OpnSense 26.1.10


Monit Implementation
Steps
#1 Set Opnsense Monit Service setings and Service tests settings
#2 Add wg0_monit_start.sh
#3 Service -> Monit -> Status


#1
Opnsense Services Monit
Service Settings
Name: wg0_monit_start
Type: custom
Path: /usr/local/bin/bash  /usr/local/opnsense/scripts/wireguard/wg0_monit_start.sh
Start: /bin/sh -c '/usr/local/sbin/pluginctl -s wireguard restart'
Tests: ZeroStatus

Service Tests Settings
Name: ZeroStatus
Condition: status == 0
Action: Start

#2
nano /usr/local/opnsense/scripts/wireguard/wg0_monit_start.sh
======
#!/bin/bash

# RC is the connection state which defaults = 1
RC=1

# Test wg0 connection state and if no packets are received it needs to be restarted with RC=0
# RC=0 uses the ZeroStatus test to re-start wg0

[[ $(netstat -i | grep -F -- "          0    - " | \
grep "VPN Instance Tunnel IP address"  | wc -l) -eq "1" ]] &&  RC=0 && echo !connected  && exit $RC \
|| echo connected && exit 1
======

chmod + /usr/local/opnsense/scripts/wireguard/wg0_monit_start.sh



#3
Program 'wg0_monit_start'
  status                      OK
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  last exit value              1
  last output                  connected
  data collected              Fri, 19 Jun 2026 11:49:02


====

Retried with the IP address and it worked.

Used the new endpoint address and still getting "name does resolve ". What is the format using the ip address instead? Do I need to add the port number?

Windscribe AI chat provided the answer.
"Yeah, you nailed it — the name change is what's biting you here. The New York – Empire location used to use different endpoint hostnames that recently got updated during our infrastructure refresh. The newer naming convention (whiskergalaxy.com) replaced the older one, so your old config references a domain that's no longer resolving.
Here's how to fix it:
Go to the Config Generator.
Re‑generate a fresh WireGuard config for New York – Empire — don't reuse the old one."

Having a Wireguard endpoint address issue on
26.1.8_5 but not on 25.7.11_9. Also using AdGuard but zero problem on 25.7
This is the wireguard log. Any suggestions?

/usr/local/opnsense/scripts/wireguard/wg-service-control.php:
The command </usr/bin/wg syncconf 'wg1' '/usr/local/etc/wireguard/wg1.conf'>
returned exit code 1 and the output was "Name does not resolve:
`jfk-384-wg.whiskergalaxy.com:80' Configuration parsing error"

Yes, make sure you are on 26.1.1 and run this from the console:

# opnsense-patch 4912a67

Thanks, did it last night and it helped and works !

What WiFi card are u using in opnsense 26.1.1? I want to do the same thing.

Is there a recommended WiFi 7 card that is opnsense compatible?

It's 1.16 - what exactly is the problem?

Just asking. Thanks

What is the latest version of os-adguardhome-maxit (installed)   1.16? How do I get the latest? How do I upgrade?

fetch -o /usr/local/etc/pkg/repos/mimugmail.conf.new https://www.routerperformance.net/mimugmail.conf
pkg update'''fetch -o /usr/local/etc/pkg/repos/mimugmail.conf https://www.routerperformance.net/mimugmail.conf
pkg update

#1
Versions
OPNsense 25.7.11_9-amd64
FreeBSD 14.3-RELEASE-p7
OpenSSL 3.0.18

#2
Yes
See below


Proceed with this action? [26.1/y/N]: 26.1

Hi there,

For over 11 years now, OPNsense is driving innovation through
...
etc,etc,etc

Mmmh that looks good, what key are you pressing at the end of the text, 'q'?

I was selecting enter. When the ':' I enter 'q'. An it is now installing.
Thank u very much!

===
Download links, an installation guide[1] and the checksums for the images
can be found below as well.

Fetching packages-26.1-amd64.tar: ...

Update: via console took about an hour to upgrade to 26.1_4 and the vpn + other packages worked

#1
Versions
OPNsense 25.7.11_9-amd64
FreeBSD 14.3-RELEASE-p7
OpenSSL 3.0.18

#2
Yes
See below


Proceed with this action? [26.1/y/N]: 26.1

Hi there,

For over 11 years now, OPNsense is driving innovation through
...
etc,etc,etc

Mmmh that looks good, what key are you pressing at the end of the text, 'q'?

I was selecting enter. When the ':' I enter 'q'. An it is now installing.
Thank u very much!

===
Download links, an installation guide[1] and the checksums for the images
can be found below as well.

Fetching packages-26.1-amd64.tar: ...

Putty ssh, login as root, menu select 12, 26.1 nothing happens...

From what version are you upgrading? And after you enter '26.1' (not 'y') did you see some changelog text?

#1
Versions
OPNsense 25.7.11_9-amd64
FreeBSD 14.3-RELEASE-p7
OpenSSL 3.0.18

#2
Yes
See below


Proceed with this action? [26.1/y/N]: 26.1

Hi there,

For over 11 years now, OPNsense is driving innovation through
modularising and hardening the open source firewall, with simple
and reliable firmware upgrades, multi-language support, fast adoption
of upstream software updates, modern IPv6 support, as well as clear
and stable 2-Clause BSD licensing.

26.1, nicknamed "Witty Woodpecker", features almost a full firewall
MVC/API experience as automation rules have been promoted to the new
rules GUI, Suricata version 8 with inline inspection mode using "divert",
assorted IPv6 reliability and feature improvements, router advertisements
MVC/API, full code shell command escaping revamp, default IPv6
mode now using Dnsmsaq for client connectivity, Unbound blocklist source
selection, an automatic host discovery service, plus much more.

etc,etc,etc