Wireguard client disconnect in Opensense 24.1

[HTop]

Identified Wireguard VPN client disconnect issue with upgrade from 23.7.12 to 24.1 to VPN providers.  Only way to resolve issue is to restart Wireguard (Disable / Enable in Wireguard Settings)

24.1  Release Notes state the following:
- wireguard: installed by default using the bundled FreeBSD 13.2 kernel module
- core inclusion of the os-firewall and os-wireguard plugins
(os-wireguard plugins are no longer available in v24.1.)

A disconnect of Router WAN port (ADSL2+ which is very unstable in remote location) causes the VPN tunnel to fail (100%).  v23.7.12 had the same issue but reverted to the older os-wireguard-go plugin (non kernel version) to resolve the issue.  Only way to fix issue is to fully restart wireguard service on every WAN disconnect.  Also setup CRON job to restart FW every 24 hours as small workaround to issue.

Investigated numerous fixes to resolve issue including adjusting MTU, keepalives, inspecting routes etc.  Nothing has resolved the issue.  V24.1 no longer has option to revert to os-wireguard-go package.  Opensense has been working well through multiyear upgrades, so unlikely to be fundamental configuration error.
https://forum.opnsense.org/index.php?topic=33927.0

On error, the gateway configuration will show the status of the WG VPN tunnel as "offline" (see attached screenshot).

On restart of the VPN connection, error in VPN logs:
/usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/sbin/route add -'inet' '10.25.169.200' -interface 'wg3'' returned exit code '1', the output was 'add host 10.25.169.200: gateway wg3 fib 0: route already in table'

Suggestions for fix will be welcome.  Happy to experiment as Opensense running as Proxmox VM with snapshots, so rollback of a broken config is very easy.

[mtltt]

I have the same problem and figured out, that a stale state is the problem. OPNsense doesn't kill/reset all states when WAN goes down/up. Manually clearing all states/the VPN connection states (Firewall->Diagnostics->States) is resolving this for me. But this is just a bad workaround and not a fix.

This also helps me in my dual WAN failover setup. When the backup connections kicks in, I get the same problem. The WireGuard client doesn't reconnect automatically, because it is in a stale state.

I tied to automate the state resetting with Monit and gateway alerts, but couldn't get it working.

[freegoer]

I am experiencing the same issue when WG client gets disconnected. Unable to reconnect until I restart the WG service on OPNSense. Happy to help troubleshoot if anyone has ideas for a fix.


Update 3/27/2024: I have ZenArmor running on my FW. I disabled it on the roadwarrior WG interface that I was experiencing WG reconnect issues and the issue seems to have gone away for now. I will update if anything changes.

[vinet]

OPNsense 24.1.4-amd64

i had similar error with routing adding. (Error   wireguard   /usr/local/opnsense/scripts/Wireguard/wg-service-control.php: The command '/sbin/route -q -n add -'inet' )

i fixed also the - "os-wireguard (missing)"
in System - Frimware - Plugins

also i found in the peerings my ip that dosent work double listed, so my fault and sure that it doesnt work. The Tunnel Adress was reachabl at any time also the handshakes worked.

[LovelyCupOfTea]

I've had endless issues setting up wireguard in both opnsense and pfsense

Gave up and used openwrt on a gl.inet and it took about 5 min

[mtltt]

I have finally "solved" this problem with the following workaround:
I use Monit to ping the IP address of the WireGuard server. If the connection is stale, WireGuard is restarted.
To do this, you need the following Monit settings:

WireGuard instance id:
You need the ID (UUID) of the WireGuard instance that should be restarted when it becomes stale. I couldn't find an easy way to get the UUID. So I opened the developer tools in the browser on the WireGuard instance page and inspected the 'Edit' button of the instance I wanted to be restarted when stale. The edit button had the UUID embedded in the HTML tag (data-row-id="<instance uuid>")

Monit:
1. Service settings:
Add test:
- Condition: failed ping4 count 3 with timeout 3 seconds for 2 cycles
- Action: Execute
- Path: /usr/local/bin/bash -c '/usr/local/opnsense/scripts/Wireguard/wg-service-control.php restart <ID of the WireGuard instance>'

Note: the usr/local/bin/bash -c '<command>' is the important part. I could not get it to work with the direct command.

2. Add a service:
- Type: "Remote Host"
- Address: <the WireGuard server's IP address>.
- Tests: <the defined ping test>

Result:
If the ping of the WireGuard server's IP address fails 3 times with a timeout of 3 seconds for 2 times, the WireGuard instance is restarted.