WireGuard lives!

JeGr

@theonemcdonald Hi! Just to clarify, will this be available in pfSense 2.5.1 Package Manager ?

Not currently as it's not recommended for stable. So if you want to run it on 2.5.x, download the packages from GitHub and install it manually.

chrisjmuk

@emikaadeo I am currently just using the Dev build 1.6.xxxx and just install the package via the package manager and seems to work great.

chrisjmuk

@vjizzle i am using the same and this is my CPU spec and i am only using 3% on idle but does jump to 40% on a speed which it would normally even without the wireguard.

Intel(R) Celeron(R) CPU N2940 @ 1.83GHz
Current: 1826 MHz, Max: 1827 MHz
4 CPUs: 1 package(s) x 4 core(s)

vajonam

@chrisjmuk think you mean 2.6.xx ?

vjizzle

@chrisjmuk I have the following specs on my testlab pfSense 2.6:

CPU Type Intel(R) Core(TM) i3-6100U CPU @ 2.30GHz
2 CPUs: 1 package(s) x 1 core(s) x 2 hardware threads
AES-NI CPU Crypto: Yes (inactive)
QAT Crypto: No

The load does not bother me that much, my main pfSense is a core i5 beast :) so no worries there. But by the time this is ready for production I expect it to be better optimized for performance. The developer said there will be tweaks and tuning.

emikaadeo

Downloaded packages from GitHub and installed manually v0.0.9 on 2.5.1-RELEASE (amd64) in this order:

wireguard-kmod-0.0.20210503.txz
wireguard-tools-lite-1.0.20210424.txz
pfSense-pkg-WireGuard-0.0.9.txz

Works great so far (using Mullvad VPN)
Is there any best/safe method to upgrade packages when new versions will be available?

dersch

So if i update to 2.5.1 i need to manually install the package?

emikaadeo

@dersch
The new WireGuard port is currently not available officially in 2.5.1 Package Manager (only in 2.6.0 development) so yes, you have to install packages manually.

martywd

I'm running 2.5.1 with the pfsense wireguard v0.0.9 pkgs installed. I configured wireguard 3+ days ago to connect my VPN (Windscribe) and since then all is working flawlessly. Nice.

Now I see that the v0.1.1 pkgs were released a few hours ago, so like @emikaadeo asked previously, what is/are the "best/safe method to upgrade packages when new versions will be available?"

Thanks!
.

dersch

@martywd same for me.

@theonemcdonald can you advise please how to upgrade?

with

pgk upgrade pfSense-pkg-WireGuard-new.version.txz

it is asking to install it new. So do we need to remove the old.version first? will the config persist?

vajonam

@dersch

Yes as long as the "keep settings" is checked on the settings tab. It will persist. but its always good to make a backup of your config before you upgrade. Recreating the wg tunnels is quite easy once you have the settings.

However I have done the upgrade on many boxes and it runs it fine. Just be careful if you are upgrading wireguard over the wire guard tunnel itself like a remote router.

tquade

@vajonam

Having no success upgrading to 0.1.1 from 0.0.9 on pfSense 2.6.0-DEVELOPMENT.

Have tried the following with result:

[2.6.0-DEVELOPMENT][admin@pfSense.localdomain]/root: pkg upgrade pfSense-pkg-WireGuard-0.1.1_1.txz
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
pkg: pfSense-pkg-WireGuard-0.1.1_1.txz is not installed, therefore upgrade is impossible
Checking integrity... done (0 conflicting)
Your packages are up to date.

[2.6.0-DEVELOPMENT][admin@pfSense.localdomain]/root: pkg install pfSense-pkg-WireGuard-0.1.1_1.txz
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
pkg: No packages available to install matching 'pfSense-pkg-WireGuard-0.1.1_1.txz' have been found in the repositories

[2.6.0-DEVELOPMENT][admin@pfSense.localdomain]/root: pkg add https://github.com/theonemcdonald/pfSense-pkg-WireGuard/releases/download/v0.1.1/pfSense-pkg-WireGuard-0.1.1_1.txz
Fetching pfSense-pkg-WireGuard-0.1.1_1.txz: 100% 26 KiB 26.6kB/s 00:01
Installing pfSense-pkg-WireGuard-0.1.1_1...
the most recent version of pfSense-pkg-WireGuard-0.0.9 is already installed

I'm out of ideas.
Ted Quade

vajonam

@tquade

pkg remove 0.0.9 and then pkg install 0.1.1_1

I think the issue is that you cannot upgrade a _1 (REVISION) package when you dont have 0.1.1 package installed.

remove should not lose your configuration.

tquade

@vajonam

Thanks for the pointers.

I had to run pkg add ...........-0.1.1_1
instead of pkg install ..........-0.1.1_1

Ted Quade

vajonam

Just a best practice. when using the command line, always remove and install new versions.

Eventually when we move to a gui installer (Package Manager) it will do this anyway. this way no files are left around because of an upgrade.

cmcdonald

@tquade if you are side loading you should always pkg remove first and then pkg add. The GUI package manager doesn't perform in place upgrades as that can leave obsolete files on disk.

Edit: @vajonam beat me lool

tquade

@theonemcdonald
@vajonam I leave a little wiser. Thanks to both of you.

Ted

vjizzle

Hi. I have version 0.0.8 installed on pfsense 2.6 using the package manager in pfsense. But it does not show me the newer version so I can upgrade. Is this normal (for now at least)?

vajonam

@vjizzle yes. There is open pull request to include it into the 2.6.0 ports repository once that happens it will show up.

Likely to be sometime next week.

vajonam

Just to be clear on changes

If you are on 0.0.8 or 0.0.9. Here is list of major changes for 0.1.1

unbound ACL creation for non assigned interfaces
service daemonization, reliable startup shutdown eliminate zombie process/services.
- enables smooth upgrade of the kmod when the upstream kmod is updated. because stopping the service unloads the kernel module so it can be upgraded.
redone status page with show/hide peers
bug fixes / better validation for initial peer / tunnel setup.
move away from wg-quick and dependency on bash. better response for enabling / disabling peers and tunnels.

If you are using for just private internet access and there aren't very many changes that affect you.

more importantly on the wiregurad-kmod side

upgrading to wireguard-kmod-0.0.20210503.txz fixes a kernel panic that I had reported and this was fixed upstream.

@theonemcdonald please feel free to add anything if missed anything.