Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
19.7 Legacy Series
»
Wireguard flakey
« previous
next »
Print
Pages: [
1
]
Author
Topic: Wireguard flakey (Read 2447 times)
whit
Newbie
Posts: 35
Karma: 1
Wireguard flakey
«
on:
September 05, 2019, 09:29:13 pm »
After setting up Wireguard between a new OPNsense appliance and a Linux server that's rock-solid with Wireguard connections to other Linux devices, it only intermittently works. Strangely, it will work to allow connections from the Linux end both to the Wireguard IP on the OPNsense box, and to the LAN behind it, but only for a while. After it fails for both, if I then go to the VPN:Wireguard > Endpoints page and simply press "Save" it starts working again. But after a few minutes it sometimes fails. The "List Configuration" tab however shows it as active nonetheless. Sometimes it does seem to recover on its own.
I've not seen the like between Linux Wireguard machines flake in this way. Both ends are on public IPs, and configured explicitly with those IPs.
Logged
mimugmail
Hero Member
Posts: 6761
Karma: 494
Re: Wireguard flakey
«
Reply #1 on:
September 05, 2019, 10:56:27 pm »
Did you set short keepalives?
Logged
WWW:
www.routerperformance.net
Support plans:
https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German):
https://opnsense.max-it.de/
whit
Newbie
Posts: 35
Karma: 1
Re: Wireguard flakey
«
Reply #2 on:
September 06, 2019, 03:28:36 pm »
Define "short". I haven't needed keepalives at all between Linux systems provided they're on public IPs, as is this case. Last I looked the Wireguard docs only recommend keepalives when one end is behind a NAT. In this case I had a keepalive initially at 10 minutes from the OPNsense side. Then I moved that down to 25 seconds, and also added one initiated from the Linux end, also at 25 seconds. That has kept the tunnel up overnight. So the OPNsense implementation is more dependent on keepalives in general, or else dependent on keepalives being initiated from the other side, or both.
Logged
mimugmail
Hero Member
Posts: 6761
Karma: 494
Re: Wireguard flakey
«
Reply #3 on:
September 06, 2019, 04:54:51 pm »
wireguard implementation on FreeBSD doesn't have too many active users .. there may be some problems. One of them was those so we added a keepalive field
Logged
WWW:
www.routerperformance.net
Support plans:
https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German):
https://opnsense.max-it.de/
whit
Newbie
Posts: 35
Karma: 1
Re: Wireguard flakey
«
Reply #4 on:
September 13, 2019, 10:50:36 pm »
Since adding keepalives on both ends, WireGuard has behaved well.
Logged
mimugmail
Hero Member
Posts: 6761
Karma: 494
Re: Wireguard flakey
«
Reply #5 on:
September 14, 2019, 06:50:39 am »
Great, thanks for your feedback
Logged
WWW:
www.routerperformance.net
Support plans:
https://www.max-it.de/en/it-services/opnsense/
Commercial Plugins (German):
https://opnsense.max-it.de/
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
Archive
»
19.7 Legacy Series
»
Wireguard flakey