Wireguard fails after reboot (2.8.0)

[Buffalo0207]

@stephenw10 Here is the list of all the packages I have installed...

1. acme
2. Avahi - not enabled as I have recently installed mDNS-Bridge
3. Cron
4. mDNS-Bridge
5. nut
6. pfBlockerNG-devel
7. Service_Watchdog
8. sudo
9. System_Patches
10. Wireguard

Except for Avahi, all other packages are enabled and configured and seem to be working ok.

In case you need this info too, here are all the services that I have running...

1. dpinger
2. kea-dhcp4
3. kea-dhcp6
4. mdns-bridge
5. miniupnpd
6. ntpd
7. nut
8. pfb_dnsbl
9. pfb_filter
10. radvd
11. sshd
12. syslog
13. unbound
    14 - wireguard

Would you like me to send you my configuration file download?

[stephenw10]

Do you see any errors when you reinstall WG?

If you look in /conf you should see the pkg_log file for fro the last install.

[Misterb]

@Buffalo0207 Try restarting dpinger followed by starting wireguard.

[Buffalo0207]

@Misterb Thanks - that semi worked. Although WG still stops after a reboot, by restarting dpinger, I no longer need to reinstall the WG package as the 'restart service' tab works.

[Buffalo0207]

@stephenw10 The only errors I see are the php errors.

pkg_log_pfSense-pkg-WireGuard.txt

[stephenw10]

Hmm, when it stops and fails to start when you try to start it manually do you see anything logged then?

I can't replicate that on anything I have here.

Try running pkg upgrade and see if it offers any upgrades. Something may not have upgraded.

[Buffalo0207]

@stephenw10 When it stops and fails to start and then I try to start it manually there are no new pkg_log files. The WG pkg_log file remains on the date 13/08/25. Even when I reinstall the WG package, the log remains the same.

I did, however, get the following error...

check_upgrade: "Updating repositories metadata" returned error code 1 @ 2025-08-16 00:22:12

BTW - yesterday, I reinstalled all 10 packages, in case something hadn't installed correctly.

[stephenw10]

Yes you won't see anything in the pkg_log, that only covers the pkg install, but I'd expect to see something logged in the main log. For example when I restart it I see in the main log:

Aug 16 02:15:46 	php-fpm 	77985 	/status_services.php: The command '/usr/local/etc/rc.d/wireguardd stop' returned exit code '1', the output was ''
Aug 16 02:15:47 	kernel 		wg0: changing name to 'tun_wg0'
Aug 16 02:15:47 	kernel 		tun_wg0: link state changed to UP
Aug 16 02:15:47 	php_wg 	19350 	/usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, none 'available' for inet6, use the first one configured. 'GIF0_TUNNELV6' 

If any of those things failed with an error I'd expect to see that there too.

[Misterb]

@Buffalo0207 The problem seems to be remarkably similar to one discussed in 2023 Wireguard Site-to-Site Gateways disabled after reboot - service not starting

[Buffalo0207]

@stephenw10 Can you tell me exactly where the main log is and I will download it for you. I also have WinSCP, so can access it from there if this is easier.

[Buffalo0207]

@Misterb Thanks for this. I will add a cron job to automatically install the WG package.

[stephenw10]

It should appear in the main system log in Status > System Logs > System > General. For example:

[Buffalo0207]

@stephenw10 This is immediately after I rebooted without reinstalling WG. Let me know if you need another one after WG has been reinstalled.

[stephenw10]

So what new logs appear there if you try to start WG when it fails?

[Buffalo0207]

@stephenw10 This is immediately after I tried restarting WG (and fails) from the UI Service Status page, without restarting dpinger.

[stephenw10]

Hmm, that was some time it booted?

It's triggering a bunch of rc.bootup events which seems odd. Perhaps you have something preventing it ever reaching 'bootup complete'.

Do you see 'bootup complete' in the system logs after booting?

Do you see /var/run/booting still present?

[Buffalo0207]

@stephenw10 Can you tell me exactly where I can see this information?

[stephenw10]

Bootup Complete should appear in the main system log like:

You can check the boot file from the CLI like:

[2.8.0-RELEASE][admin@t70.stevew.lan]/root: ls /var/run
charon.ctl                                      ld-elf.so.hints
charon.pid                                      ld-elf32.so.hints
charon.vici                                     log
charon.wlst                                     logpriv
check_reload_status                             miniupnpd.pid
cron.pid                                        nginx-webConfigurator.pid
daemon-charon.pid                               ntpd.pid
daemon_sshguard.pid                             openvpn_server1.pid
devd.pid                                        pfSense_version
devd.pipe                                       pfSense_version.rc
devd.seqpacket.pipe                             php-fpm.pid
dhclient.igb0.pid                               php-fpm.socket
dmesg.boot                                      ping_hosts.pid
dnsbl.pid                                       powerd.pid
dnsmasq.pid                                     sshd.pid
dpinger_VTI0_VTIV4~10.66.11.1~10.66.11.2.pid    sshguard.pid
dpinger_VTI0_VTIV4~10.66.11.1~10.66.11.2.sock   suricata-ctrl-socket-60565
dpinger_WAN_DHCP~172.21.16.239~172.21.16.1.pid  suricata_igb160565.pid
dpinger_WAN_DHCP~172.21.16.239~172.21.16.1.sock syslog.pid
expire_accounts.pid                             unbound.pid
filter_reload_status                            update_alias_url_data.pid
filterdns.pid                                   updaterrd.sh.pid
filterlog.pid                                   utmp
ipsec_keepalive.pid                             utx.active

[Buffalo0207]

@stephenw10 Sorry for the delayed reply - I have just got back from a business trip. Anyway, this is the output from the CLI

[2.8.1-RC][root@pfSense.mymain.local]/root: ls /var/run
check_reload_status
cron.pid
daemon_sshguard.pid
devd.pid
devd.pipe
devd.seqpacket.pipe
dhclient.igb0.pid
dmesg.boot
dnsbl.pid
dpinger_VPNUNLIMITED_L2TP~10.240.0.2~10.240.0.1.pid
dpinger_VPNUNLIMITED_L2TP~10.240.0.2~10.240.0.1.sock
dpinger_WANV6_TUNNELV6~2001:470:1f08:84a::2~2001:470:1f08:84a::1.pid
dpinger_WANV6_TUNNELV6~2001:470:1f08:84a::2~2001:470:1f08:84a::1.sock
dpinger_WAN_DHCP~82.13.203.142~82.13.202.1.pid
dpinger_WAN_DHCP~82.13.203.142~82.13.202.1.sock
dpinger_wg1GW~10.102.1.114~10.102.1.114.pid
dpinger_wg1GW~10.102.1.114~10.102.1.114.sock
dpinger_wg2GW~10.102.100.206~10.102.100.206.pid
dpinger_wg2GW~10.102.100.206~10.102.100.206.sock
expire_accounts.pid
filter_reload_status
filterlog.pid
ipsec_keepalive.pid
kea
kea2fib6.cache
kea4-ctrl-socket
kea4-ctrl-socket.lock
kea6-ctrl-socket
kea6-ctrl-socket.lock
l2tp_opt9.pid
ld-elf.so.hints
ld-elf32.so.hints
log
logpriv
mdns-bridge.pid
miniupnpd.pid
nginx-webConfigurator.pid
ntpd.pid
pfSense_version
pfSense_version.rc
php-fpm.pid
php-fpm.socket
ping_hosts.pid
radvd.pid
sshd.pid
sshguard.pid
syslog.pid
unbound.pid
update_alias_url_data.pid
updaterrd.sh.pid
utmp
utx.active
wireguardd.pid
[2.8.1-RC][root@pfSense.mymain.local]/root: [2.8.1-RC][root@pfSense.mymain.local]/root: ls /var/run
kea4-ctrl-socket.lock
kea6-ctrl-socket
kea6-ctrl-socket.lock
l2tp_opt9.pid
[2.8.1-RC][root@pfSense.mymain.local]/root:: Too many arguments.
[2.8.1-RC][root@pfSense.mymain.local]/root: check_reload_status
ld-elf.so.hints
ld-elf32.so.hints
log
logpriv
mdns-bridge.pid
miniupnpd.pid
nginx-webConfigurator.pid
ntpd.pid
pfSense_version
pfSense_version.rc
php-fpm.pid
php-fpm.socket
ping_hosts.pid
radvd.pid
sshd.pid
sshguard.pid
syslog.pid
unbound.pid
update_alias_url_data.pid
updaterrd.sh.pid
utmp
utx.active
wireguardd.pid

[stephenw10]

OK so the file is not present which indicates it has completed boot.

Do you see the 'bootup complete' line in the system logs?