WireGuard Connection Status

[arrmo]

Hi,

I have WireGuard up and running, really like it, but ... in webConfigurator, is there a way to have the Peers show as a different state (color?) when connected?

Thanks!

[Gertjan]

@arrmo
Check out the announcing blog page : https://www.netgate.com/blog/wireguard-for-pfsense-software.html : it mentions the documentation where status is explained.

[jimp]

The WireGuard protocol is connectionless -- there is no status, up/down, etc.

If it's a site-to-site, you could assign it as an interface and configure gateway monitoring to ping the other side for an idea of whether or not it's working, but that's about it.

If it's for a remote access style setup the most you can do is see what the last known endpoint address is for a given key, but that doesn't mean it's connected now, just that it sent some traffic at some point since the last time the interface was configured. So not very useful.

WireGuard is weird compared to traditional VPN protocols, it will take some getting used to.

[arrmo]

@jimp said in WireGuard Connection Status:

WireGuard is weird compared to traditional VPN protocols, it will take some getting used to.

Agreed there ... LOL! The #1 problem here is my head wrapping around this, that I agree with completely .

But just a thought ... WireGuard does a regular handshake (check for connectivity?). Perhaps that could be a trigger?

No biggie at all, just trying to understand. Thanks for the comments!

[jimp]

There is no real handshake/trigger as such, certainly nothing that fires off an event that gets tracked anywhere in a way we can use it.

We can only go by the information available from the wireguard utilities (e.g. wg) and it doesn't print anything notable except the active configuration, plus if it's a dynamic endpoint it outputs the last known endpoint address for a peer.

No counters, timers, etc.

[arrmo]

@jimp That makes sense, thanks for the details!

[dem]

The Linux version of wg shows information that can be helpful in determining which peers have recently been active. I gather this is missing from the FreeBSD version.

[jimp]

Yeah there is nothing like that in the wg output on FreeBSD. Not that I've seen yet anyhow.