[Solved] Wireguard - No handshake

[Arno]

Hi everyone,

Using a public wifi I'm trying to connect to my home LAN.

In the logs of OPNsense (via Graylog) I see some incoming packets on WAN port 51820 (pass).

There are no firewall rules on the wireguard interface.
There is one rule on Wireguard (Group): Any IPv4 to one private subnet (/24).

Why is there no handshake when I connect from my Linux Mint laptop?
The public wifi isn't the problem I think. There are incoming packets on OPNsense.

[Monviech (Cedrik)]

Wireguard not working are most of the time 3 things:

- Pakets from client do not reach the server or vice versa
- The Client is not added to the correct wireguard server in the configuration
- The public/private keys are wrong

[Arno]

Where in the OPNsense logs can I check those 3 cases?

The packets reach the OPN server. In the logs I see correct source and destination IP address and port 51820/udp (pass).
'Laptop' is a peer of the only wireguard instance (and is enabled).

VPN - Wireguard - Logfile is empty.
VPN - Wireguard - Satus - Handshake is empty.

If the keys are wrong, shouldn't there be at least a log message?

[Monviech (Cedrik)]

No, wireguard doesnt log anything per design. You have to guess these three things until it works.

If you want a protocol that logs actual errors, use IPsec.

Wireguard is designed to be non chatty with little emissions.

When the wireguard server does not respond, it either does not have your peer configured to the endpoint (thus doesnt know of it), doesn't receive the handshake paket of your peer, or the keys are wrong.

That makes it far simpler to troubleshoot than the chatty logging ipsec that can have 1000 different errors.

[_tribal_]

No, wireguard doesnt log anything per design.
...

That's not quite true. When compiling Wireguard from source you can specify “Debugging checks and verbose messages” and then the package will output debugging information. The package in the repository is just compiled without this option, that's all.

[Monviech (Cedrik)]

Im unsure if Debug logs meant for software developement emit anything useful for the actual users of the software.

https://www.wireguard.com/quickstart/

I mean you are right, it states here you can enable things like dynamic debugging in the linux kernel.

But if these messages would hold anything of value for the user, why would projects like this exist?

https://github.com/nikaro/wirelogd

I havent myself tested wireguard log emissions though, have you any experience in it and can tell me if they have useful information like for example ipsec or openvpn logs?

[Arno]

No, wireguard doesnt log anything per design.

Didn't knew that. Thanks.

Recreated my 'Laptop' peer. It now shows on the wireguard widget. Offline for now. Not tested with public wifi yet.
Also created an extra firewall rule on Wireguard (Group) to monitor outbound wireguard traffic (51820/udp).

In my 'Laptop' peer I left Endpoint and port empty. Is this correct?

I will report back when I have tested from public wifi.

[Monviech (Cedrik)]

Yeah that is correct since your peer is dynamic. Wireguard will auto populate that dynamically when it receives a matching handshake for that peer.

Good luck with testing.

[Arno]

No handshake yet.

When connecting from public wifi to OPNsense 'required key missing' (or similar, this is a translation) was shown on my laptop (wg client).
Have to debug a lot (routes, metric, dns, allowed ip's).

Today I came across the 'wg watch' command.
To be continued. Debug suggestions welcome.

[Seimus]

How did you configure the Client profile?
Did you use the generator or did you do it manually?

Cause if you see the client hitting the WAN and the WAN is Permitting INbound then per them messages you say appear there is a strong suggestion the problem is with the keys.

Regards,
S.

[Arno]

How did you configure the Client profile?

Oops.... 
In the client profile I used the public key of my laptop.....for the OPNsense peer.

Got a handshake  . Can't ping anything yet.
That's for another time.
This is solved for now. Thanks!

[Seimus]

Hehe no worries this happens often. Is always good to keep watch on what "debug" message you get like the

required key missing

Anyway glad you fixed it. Please mark your Topic with [SOLVED].

Regards,
S.

[_tribal_]

I havent myself tested wireguard log emissions though, have you any experience in it and can tell me if they have useful information like for example ipsec or openvpn logs?

I don't know how detailed the logs are, but there is an option to enable them when copying.