Wireguard won't startup after reboot.
-
Hey guys,
i have been having issue with Wiregaurd setup since i started using it on pfsense, where it just fail to start after a reboot.
the issue seems realted to WG gateway as per the logs attached.FYI im running WG only through VLAN20 network, if it does make any difference.
Also, restarting WG service does not help at all. only solutions fixing it by restarting the WG gateway or reinstalling the WG.Any help would be appreciated.
l 16 17:34:24 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:34:24 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:34:24 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:34:24 kernel wg0: changing name to 'tun_wg0' Jul 16 17:34:24 php_pfb 17179 [pfBlockerNG] filterlog daemon started Jul 16 17:34:24 php_pfb 18751 [pfBlockerNG] filterlog daemon started Jul 16 17:34:24 kernel tun_wg0: link state changed to UP Jul 16 17:34:24 php-fpm 400 /rc.filter_configure_sync: dpinger: status socket /var/run/dpinger_WG_Gateway~100.120.210.104~146.70.115.162.sock not found Jul 16 17:34:24 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:34:24 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, NONE AVAILABLE Jul 16 17:34:25 php_wg 69450 /usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, NONE AVAILABLE Jul 16 17:34:25 php_wg 73762 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Enabled all WireGuard gateways. Jul 16 17:34:25 check_reload_status 439 Syncing firewall Jul 16 17:34:25 php_wg 73762 /usr/local/pkg/wireguard/includes/wg_service.inc: Removing static route for monitor 146.70.115.162 and adding a new route through 100.120.210.100 Jul 16 17:34:27 rc.gateway_alarm 11645 >>> Gateway alarm: WG_Gateway (Addr:146.70.115.162 Alarm:1 RTT:0ms RTTsd:0ms Loss:100%) Jul 16 17:34:27 check_reload_status 439 updating dyndns WG_Gateway Jul 16 17:34:27 check_reload_status 439 Restarting IPsec tunnels Jul 16 17:34:27 check_reload_status 439 Restarting OpenVPN tunnels/interfaces Jul 16 17:34:27 check_reload_status 439 Reloading filter Jul 16 17:34:28 php-fpm 2696 /rc.openvpn: Gateway, NONE AVAILABLE Jul 16 17:34:28 php-fpm 2696 /rc.openvpn: Gateway, NONE AVAILABLE Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Updated tunnel tun_wg0. Jul 16 17:34:39 check_reload_status 439 Syncing firewall Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:34:39 check_reload_status 439 Syncing firewall Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:34:39 php-fpm 71164 /wg/vpn_wg_tunnels_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Updated peer 0 (). Jul 16 17:35:29 check_reload_status 439 Syncing firewall Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:35:29 check_reload_status 439 Syncing firewall Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:35:29 php-fpm 71164 /wg/vpn_wg_peers_edit.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:35:30 check_reload_status 439 Syncing firewall Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:35:30 check_reload_status 439 Syncing firewall Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:35:30 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Gateway, NONE AVAILABLE Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Gateway, NONE AVAILABLE Jul 16 17:35:31 check_reload_status 439 Reloading filter Jul 16 17:35:31 php-fpm 399 /wg/vpn_wg_peers.php: Removing static route for monitor 146.70.115.162 and adding a new route through 100.120.210.100 Jul 16 17:35:33 rc.gateway_alarm 92621 >>> Gateway alarm: WG_Gateway (Addr:146.70.115.162 Alarm:1 RTT:0ms RTTsd:0ms Loss:100%) Jul 16 17:35:33 check_reload_status 439 updating dyndns WG_Gateway Jul 16 17:35:33 check_reload_status 439 Restarting IPsec tunnels Jul 16 17:35:33 check_reload_status 439 Restarting OpenVPN tunnels/interfaces Jul 16 17:35:33 check_reload_status 439 Reloading filter Jul 16 17:35:34 php-fpm 400 /rc.openvpn: Gateway, NONE AVAILABLE Jul 16 17:35:34 php-fpm 400 /rc.openvpn: Gateway, NONE AVAILABLE Jul 16 17:35:41 php-fpm 71164 /wg/vpn_wg_settings.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:41 check_reload_status 439 Syncing firewall Jul 16 17:35:43 php_wg 68052 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Disabled all WireGuard gateways. Jul 16 17:35:43 kernel tun_wg0: link state changed to DOWN Jul 16 17:35:43 check_reload_status 439 Syncing firewall Jul 16 17:35:43 check_reload_status 439 Reloading filter Jul 16 17:35:44 php-fpm 399 /rc.filter_configure_sync: The gateway: WG_Gateway is invalid or unknown, not using it. Jul 16 17:35:46 php-fpm 400 /status_services.php: The command '/usr/local/etc/rc.d/wireguardd stop' returned exit code '1', the output was '' Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:35:46 check_reload_status 439 Syncing firewall Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:35:46 check_reload_status 439 Syncing firewall Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:46 kernel wg0: changing name to 'tun_wg0' Jul 16 17:35:46 kernel tun_wg0: link state changed to UP Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:35:46 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:47 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, NONE AVAILABLE Jul 16 17:35:47 php_wg 71299 /usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, NONE AVAILABLE Jul 16 17:35:47 check_reload_status 439 Reloading filter Jul 16 17:35:47 php_wg 97413 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Enabled all WireGuard gateways. Jul 16 17:35:47 check_reload_status 439 Reloading filter Jul 16 17:35:47 php_wg 97413 /usr/local/pkg/wireguard/includes/wg_service.inc: Removing static route for monitor 146.70.115.162 and adding a new route through 100.120.210.100 Jul 16 17:35:51 php-fpm 400 /wg/vpn_wg_settings.php: Configuration Change: admin@192.168.1.10 (Local Database): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:35:51 check_reload_status 439 Syncing firewall Jul 16 17:36:00 php-fpm 71164 /status_services.php: Removing static route for monitor 146.70.115.162 and adding a new route through 100.120.210.100 Jul 16 17:36:13 php_wg 18967 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Disabled all WireGuard gateways. Jul 16 17:36:13 kernel tun_wg0: link state changed to DOWN Jul 16 17:36:13 check_reload_status 439 Syncing firewall Jul 16 17:36:13 check_reload_status 439 Reloading filter Jul 16 17:36:14 php-fpm 71164 /rc.filter_configure_sync: The gateway: WG_Gateway is invalid or unknown, not using it. Jul 16 17:36:16 php-fpm 399 /status_services.php: The command '/usr/local/etc/rc.d/wireguardd stop' returned exit code '1', the output was '' Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:36:16 check_reload_status 439 Syncing firewall Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:36:16 check_reload_status 439 Syncing firewall Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:36:16 kernel wg0: changing name to 'tun_wg0' Jul 16 17:36:16 kernel tun_wg0: link state changed to UP Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed earlyshellcmd(s). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed earlyshellcmd(s). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed interface group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed interface group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] De-installed Unbound ACL group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Installed Unbound ACL group (WireGuard). Jul 16 17:36:16 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Applied package default settings as necessary. Jul 16 17:36:17 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, NONE AVAILABLE Jul 16 17:36:17 php_wg 24067 /usr/local/pkg/wireguard/includes/wg_service.inc: Gateway, NONE AVAILABLE Jul 16 17:36:17 check_reload_status 439 Reloading filter Jul 16 17:36:17 php_wg 50321 /usr/local/pkg/wireguard/includes/wg_service.inc: Configuration Change: (system): [pfSense-pkg-WireGuard] Enabled all WireGuard gateways. Jul 16 17:36:17 check_reload_status 439 Reloading filter Jul 16 17:36:17 php_wg 50321 /usr/local/pkg/wireguard/includes/wg_service.inc: Removing static route for monitor 146.70.115.162 and adding a new route through 100.120.210.100
my FW rules.
-
BTW Im on the latest CE 2.7.2 and WG 0.2.1
-
Well the first thing I would do is remove or disable that static port outbound rule you have on WAN. Or at least set the source to something better defined than 'any'. That will be over matching at translating all traffic including the Wireguard encrypted traffic that is sourced from WAN anyway.
What is the public monitoring IP you're using there?
The gateway logs shown there don't have any obvious issues. I'd expected that when it first connects.
Steve
-
@stephenw10 I will try to adjust the outbound rule, although i feel like its not related.
Also i was using the ip address of the endpoint to give an accurate ping time for the gateway, but i changed it yesterday to 1.1.1.1 but i have not rebooted my Firewall yet to double check if it might help or not.Appreciate your support.
-
Incorrectly NATing the VPN traffic could definitely be an issue.