Wireguard Broken after Successful Upgrade

[tezgno]

Yesterday, I performed the upgrade from 20.1 to 20.7. After upgrading, everything appeared to be in working order. However, last night, I discovered that Wireguard, which I had installed and configured prior to the upgrade, was broken. While the enable, server, and client screens appear to work, the other screens (configuration and handshake) are broken and do not load. Uninstalling the packages or reinstalling the packages require reboots in order for the plugins to actually be visible. I'm not seeing anything in the logs either so I'm not sure if the packages are installing but not enabling or if something is failing.

Any help (or somewhere to look for the logs) would be appreciated. I would prefer to use Wireguard over OpenVPN for my VPN.

[mimugmail]

The screens were empty because WireGuard didnt start. Screenshots of local instance and endpoint please

[tezgno]

Attached are the screenshots.

[tezgno]

Update:

I figured out the problem and it appears as though if the client allowed IP range has multiple ranges, it breaks. If I change it to a single range, then it works just fine. Looking like a bug here.

[pkejval]

I can confirm that there is problem with updating from 20.1 to 20.7. If Endpoint Allowed IPs configuration contains its own LAN subnet, wireguard won't start. I admit it was completely Wireguard config misunderstood but it worked before.

Example:
GW ip 192.168.3.1/24 - if Endpoint Allowed IPs on that machine contains 192.168.1.0/24, 192.168.3.0/24 - WG won't start. Remove 192.168.3.0/24 and it will start and works as expected.

[5SpeedFun]

I've also noticed an issue that if under a "local" instance I tie more than 1 peer (even though it's allowed) wireguard stops working as well.  1 peer is OK.

I'd like to have a single WG interface with a bunch of peers (laptop/cell phone/etc) so I can tie one set of firewall rules to a bunch of devices rather than recreate for every device.

[mimugmail]

I've also noticed an issue that if under a "local" instance I tie more than 1 peer (even though it's allowed) wireguard stops working as well.  1 peer is OK.

I'd like to have a single WG interface with a bunch of peers (laptop/cell phone/etc) so I can tie one set of firewall rules to a bunch of devices rather than recreate for every device.

Endpoint has to be /32

[Manini]

I can confirm if you are using multiple ranges in Allowed IPs it wont start after the upgrade to 20.7

Found the issue:
When you are getting a route matching the range from somewhere OSPF static does not matter the wireguard will not start

[tezgno]

To expand on this further, it appears as though wg0 needs a unique route. Whatever you put into Allowed IP's creates a static route. If the route exists already, Wireguard fails to start. I created a Allowed IP range and mask that includes the 3 subnets that I want to allow and it is now working. But, if I specify the IP's like I previously had them, it fails.

[tezgno]

So, finally dug into this quite a bit and it would appear as though the way the instructions state to setup Wireguard may have worked fine in 20.1, but definitely shouldn't work in 20.1 either. The allowed IP range needs to be the /32 Wireguard address only. I think I saw another post where this is stated as well. Once I did that, problem is resolved.

[Schubbie]

Has anyone get WireGuard to work after Update 20.7 (20.7.1)?
In my case it looks like an issue with the KeyPairs.
I can´t find a failure in my configuration.
If i type a false key in the Client, the Output is another as with the correct key, so the Client should reach the Server.

[mimugmail]

Is it started?

[Schubbie]

Take a look at the list.jpg I think so.
If I type a false key in the Windows-Client I get another screen. So I think that the Server is started.

I have the issue too, that the Server didn't start, if I configure and aktivate more than 1 Client on the WireGuard-Server.

My other WireGuard-Server on my Synology runs in a VM and works after the last WireGuard Update only with WireGuard on OPNsense I have such issues.

[gurpal2000]

So, finally dug into this quite a bit and it would appear as though the way the instructions state to setup Wireguard may have worked fine in 20.1, but definitely shouldn't work in 20.1 either. The allowed IP range needs to be the /32 Wireguard address only. I think I saw another post where this is stated as well. Once I did that, problem is resolved.

Thanks this seems to have fixed it for me also. Removed all entries and then put the actual wg ip address with a /32 on the end; lastly bounced wg. Although now I can't ping other subnets.

[mimugmail]

Take a look at the list.jpg I think so.
If I type a false key in the Windows-Client I get another screen. So I think that the Server is started.

I have the issue too, that the Server didn't start, if I configure and aktivate more than 1 Client on the WireGuard-Server.

My other WireGuard-Server on my Synology runs in a VM and works after the last WireGuard Update only with WireGuard on OPNsense I have such issues.

This usually happens when endpoint has no /32