Wireguard fails after reboot (2.8.0)

[Buffalo0207]

@stephenw10

[Buffalo0207]

This post is deleted!

[Buffalo0207]

@stephenw10 I decided to do a fresh install of pfsense 2.8.1, and restored my original config.xml. The PHP_errors have now completely disappeared. However, the wireguard package still does not start at bootup.

I installed the shellcmd package and noticed that wireguard has an earlyshellcmd at bootup. I think it starts, but then immediately stops as I noticed that both my wireguard gateways that I have setup on tun_wg1 and tun_wg2 in System>Routing are 'stopped' (greyed out) after a reboot - I have to manually start them both and then start Wireguard on the opening GUI page.

I have uninstalled wireguard and reinstalled it, but the issue still persists.

Could there be an issue in my config.xml file? I am happy to send you the relevant parts of the xml file if you tell me what to send.

Otherwise, in the meantime, would you know the line of code that i can use in shellcmd to autommatically restart the two wireguard gateway interfaces so I don't have to manually start them on every reboot?

[stephenw10]

It feels more like some sort of race condition at boot. Like Wireguard tries to start on an interface that hasn't been setup yet, maybe a VPN or other tunnel type. That GIF tunnel perhaps? Can you try disabling that as a test?

[Buffalo0207]

This post is deleted!

[Buffalo0207]

@stephenw10 I think we are getting somewhere and maybe to the route of the issue.

I disabled the GIF tunnel (Hurricane Electric) as you suggested, rebooted, and the wireguard gateways and wireguard service status were stopped. However, when i started the GIF tunnel again, the wireguard gateways and wireguard service status automatically started up.

There is a secondary issue however - once the wireguard service starts, the GIF Tunnel changes to 'Offline, Packetloss'. If I then restart the GIF tunnel, it remains 'Offline, Packetloss'.

There definitely seems to be a link between the wireguard service and the GIF tunnel.

[stephenw10]

Hmm, is there some IP/subnet conflict between the GIF and Wireguard tunnels?

[Buffalo0207]

@stephenw10 Not that I can see. The GIF tunnel (Hurricane Electric) is using 216.66.80.26 and the two wireguard tunnels use 10.102.1.114 and 10.102.100.206.

[Buffalo0207]

This post is deleted!

[Buffalo0207]

@stephenw10 @stephenw10 I decided to consult chatgpt and have it write a bash script that runs immediately after boot in /usr/local/etc/rc.d/restart_gateways.sh. The wireguard tunnels now start automatically without any manual intervention. It seems that it was just a timing issue all along. The bash script works perfectly by first stopping and then restarting dpinger, and then waiting 20 secs to give the wireguard tunnels time to fully enable, before starting the wireguard service.

I did try to use the shellcmd package, but it didn't work as a delay is needed between making sure the wireguard gateways have fully started, before enabling the wireguard service.

#!/bin/sh
#
# Restart dpinger 5 sec after boot, then delay starting WireGuard by 20 secs
#

case "$1" in
    start)
        # Wait 5 secs before stopping dpinger
        /bin/sleep 5
        /usr/local/sbin/pfSsh.php playback svc stop dpinger
        /usr/local/sbin/pfSsh.php playback svc start dpinger

        # Wait 20 secs before starting WireGuard
        /bin/sleep 20
        /usr/local/sbin/pfSsh.php playback svc start wireguard
        ;;
    stop)
        # Nothing special on stop
        ;;
    restart)
        $0 stop
        $0 start
        ;;
esac

I haven't had any issues with the GIF tunnel (Hurricane Electric) since - i think it was just an anomally, as I have tested this script many times and it has started online every time since.

[stephenw10]

You could try an afterfilterchange shellcmd to trigger a script. That would be triggered when any tunnel comes up.

[Buffalo0207]

This post is deleted!

[Buffalo0207]

This post is deleted!