WireGuard Widget?

sae

Is there a WireGuard widget for the dashboard in the works? I would love something like the ipsec or openvpn widgets letting me know the status of those tunnels if possible.

cmcdonald

@sae There isn't much status that can't already be deduced through other widgets (i.e. interface stats for traffic stats, gateway monitoring for checking if the peer endpoint is pingable, etc.) WireGuard is stateless so besides the latest handshake time, there really isn't much status information to display.

Run wg show via Diagnostics>Command Prompt and you'll see for yourself that there isn't anything useful there. Albeit the wg(8) command is currently not feature complete and is missing several metrics that are available on the mainline linux implementation.

jimp

WireGuard is connectionless so there really isn't any "status" in the traditional sense.

Even if wg on FreeBSD output what it does on Linux its usefulness is minimal. It can't tell you if a peer is connected now (since there is no "connection") only that it sent some traffic at some point in the past.

lra

@jimp Our Linux project generates a "WireGuard VPN Status" in PHP as follows.

First, using wg show wg0 latest-handshakes and classify by the lastest-handshake difference from the current Unix Epoch.

"stale" if current Unix Epoch is greater than 3600 seconds of lastest-handshake
"inactive" if current Unix Epoch is greater than 135 seconds of lastest-handshake
"active" for the rest

Next preform a wg show wg0 to display useful goodies and merge with the "stale/inactive/active" state by matching with common public peer keys.

The "Peer" can be replaced with a matching label or use the first 6 characters if there is no matching label to the public peer key.

Finally, display the combined results, we chose not to show "stale" tunnels, only "active" and "inactive".

pfSense supports multiple wg+ interfaces, so iterate over all of them.

Here is a sanitized example:

This has worked well for our project.

Lonnie

jimp

None of that is available on FreeBSD yet.

sae

Thanks for the info guys. I didn't realize how different WG is compared to the more traditional vpn.