Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WireGuard doesn't come up at boot

    WireGuard
    3
    11
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • cmcdonaldC
      cmcdonald Netgate Developer @dem
      last edited by

      @dem Next time you boot, try sending traffic across the tunnel via a ping. If one side is behind a NAT, then the tunnel has to be initiated from behind that NAT out to the remote peer. Without that kick-start, the remote peer fundamentally cant punch through the NAT.

      Need help fast? https://www.netgate.com/support

      demD 1 Reply Last reply Reply Quote 0
      • demD
        dem @cmcdonald
        last edited by

        @vbman213 I have WireGuard assigned to an interface with the gateway monitoring IPs set to the remote side of the tunnel, so there's lots of pinging going on.

        1 Reply Last reply Reply Quote 0
        • demD
          dem
          last edited by

          This issue might be caused by the Interface Description having been left empty. Now that it is no longer empty the connection is coming up properly at boot.

          However, trying to modify the Description causes a panic.

          Now on 2.5.0.a.20210126.2350.

          jimpJ 1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate @dem
            last edited by

            @dem said in WireGuard doesn't come up at boot:

            This issue might be caused by the Interface Description having been left empty. Now that it is no longer empty the connection is coming up properly at boot.

            An empty description wouldn't be related to that.

            However, trying to modify the Description causes a panic.

            Now on 2.5.0.a.20210126.2350.

            Do you have the textdump from the panic? Or at least the backtrace?

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            demD 1 Reply Last reply Reply Quote 0
            • demD
              dem @jimp
              last edited by

              @jimp textdump.tar.0

              WireGuard failed to come up again on my last boot. Perhaps there's a race somewhere.

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                What exactly do you mean by "failed to come up"?

                Is the wg0 interface not present? Is it present but not configured? Is it configured but not passing traffic?

                Or are you only basing it on the gateway status and nothing else?

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                demD 1 Reply Last reply Reply Quote 0
                • demD
                  dem @jimp
                  last edited by

                  @jimp I mean gateway pings to the other side of the tunnel fail and the other side does not see a WireGuard handshake.

                  I can see wg0 from ifconfig when in this state. At one point I tried ifconfig wg0 down and then back up but that didn't help.

                  And after this last boot it started working after a few minutes. I don't see any log messages associated with it starting to work except for the alarms clearing about 5.5 minutes after the boot completed.

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    What about traffic that isn't ping? Or a LAN-to-LAN ping?

                    What does the entry in the state table for the ping look like?

                    I suspect something fishy like the ping starts before the WireGuard interface is configured so it's exiting the wrong interface. And since you are trying the same ping source/dest that monitoring is trying, it's failing the same way.

                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    demD 1 Reply Last reply Reply Quote 0
                    • demD
                      dem @jimp
                      last edited by

                      @jimp I've got a client I'm policy routing through the WireGuard interface and when the interface isn't working running "curl icanhazip.com" on the client returns the actual external address. When WireGuard comes up properly it returns the external address of the server on the other side.

                      I'll see what else I can find. Or we can blame VirtualBox. 😃

                      demD 1 Reply Last reply Reply Quote 0
                      • demD
                        dem @dem
                        last edited by

                        OK don't blame VirtualBox, blame me.

                        I think the issue was that I didn't have "Hardware Clock in UTC Time" set in VirtualBox so the system clock was jumping when NTP kicked in which disrupted something, perhaps crypto-related.

                        Sorry for my error.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.