wireguard at start up

[malac]

after reboot of my opnsense 23.7.3, wireguard does not come up, it shows green in dashboard but is not working

log shows following entry:
/usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/usr/bin/wg setconf 'wg0' '/usr/local/etc/wireguard/wg0.conf'' returned exit code '1', the output was 'Name does not resolve: `xxxyyy.com:53956' Configuration parsing error'

manually restarting wireguard helps and wireguard is running again.
I assume it is a timeing problem, because wireguard starts and at this point i do not have an official IP adress on WAN interface, because DHCP takes some time.

how can i solve this issue?

[Patrick M. Hausen]

Use an IP address instead of a DNS name for your peer.

[malac]

but peer has an dynamic ipadress

[Patrick M. Hausen]

If one end has a fixed IP address let the other one initiate the connection. You can leave the peer IP address field empty or set to 0.0.0.0 - don't exactly remember which. If both ends have dynamic addresses, bad luck. I don't work with anything but fixed for site 2 site VPNs.

The problem is that WG starts before your uplink and DNS is ready ...

[chemlud]

If the DNS is not ready at startup you can have Cron job checking for stale WG tunnels and restarting DNS resolution

https://forum.opnsense.org/index.php?topic=35732.msg173763#msg173763

...maybe your exisiting Cron job needs a work-over after renaming the job...

[malac]

If one end has a fixed IP address let the other one initiate the connection. You can leave the peer IP address field empty or set to 0.0.0.0 - don't exactly remember which. If both ends have dynamic addresses, bad luck. I don't work with anything but fixed for site 2 site VPNs.

The problem is that WG starts before your uplink and DNS is ready ...

ok, i'll try this. The central Opnsense has an fixed address, the S2S peers are "FritzBox" i'll put a persistant keepalive to conf

Let's see if this works

[malac]

ok, good idea to restart, maybe i can use monit as well

[malac]

thanks a lot for your input.

Looking good for now, that the remote site initiates the vpn connection!!

thx

[franco]

For reference: https://github.com/opnsense/plugins/issues/3565


Cheers,
Franco