Notes on using WireGuard with OSPFv2 of pfSense flavour

Soyokaze

Only one peer per WG server, because you can't have 0/0 route for multiple clients per WG server
OSPF interface (on WG interface) should be set to point-to-multipoint ie multicast, that avoids the need to configure OSPF neighbours
As of pfSense 2.7.2 (probably 2.7.0 is also affected) the FRR process starts earlier than WireGuard and after the system renames the wg interface (why even?) it loses the track of that interface
Workaround 1 is to somehow stall the FRR launch
Workaround 2 is to manually/automatically restart the FRR process after the launch after some timeout
Workaround 3 is to throw the fancy webgui and use the manual frr.conf in which the section regarding any WG interface should be doubled up without "tun_" prefix, ie:

interface tun_wg0
 ip ospf network point-to-multipoint
 ip ospf area 0.0.0.0
!

should be accompanied by the similar section but with a name without "tun_":

interface wg0
 ip ospf network point-to-multipoint
 ip ospf area 0.0.0.0
!

This way FRR would catch up the interface before the rename and would use it fine, but if for some reason the FRR processes would be restarted it would use the new, "tun-" prefixed one.

PRO: you can skip [pfSense] interface assignment for the WG interface and all these shenanigans
CONS: you need to be proficient in FRR config without WebGUI

An example of a working FRR configuration with two routers:

!
frr defaults traditional
hostname gw7-8.testlab.arpa
password 1
log syslog
service integrated-vtysh-config
!
ip router-id 5.6.7.8
!
interface vmx1
 ip ospf area 0.0.0.0
!
interface tun_wg0
 ip ospf network point-to-multipoint
 ip ospf area 0.0.0.0
!
interface wg0
 ip ospf network point-to-multipoint
 ip ospf area 0.0.0.0
!
router ospf
 ospf router-id 5.6.7.8
 log-adjacency-changes detail
 passive-interface vmx1
 area 0.0.0.0 shortcut default
!
line vty
!

Trey

@Soyokaze Hi,

we are facing the same problem. At the moment we restart FRR after each reboot or power failure to get it recognizing the wireguard interface.

Sometimes it is also necessary after applying settings in the wireguard section.

That really really annoys everyone.

Thanks for your summery