All Wireguard gateways disabled upon boot/reboot

Laxarus

Hi,
pfSense Plus 26.03.1
For some reason, all my wireguard gateways are disabled upon boot/reboot and no matter what I did, I could not find out what is the problem.

I have interfaces assigned for WG which are enabled.

Upon boot/reboot, I have to enable WG Gateways manually.

Checking console during boot, I see that the interface configuration for WG interfaces are done.
WG_S2S
VPNAC_WG

However, there are two entries which are confusing to me:

route: route has not been found
route: route has not been found

checking the configuration history, I see that for some reason wireguard gateways have all been disabled. Who is disabling them????

Checking the wireguard package,
I see that the service is stopped upon boot.

I tried service watchdog but it also did not help

and my logs

I either have to enable the gateways manually or go to one of the wireguard interface assignment and save it without changing anything to make it work.

This is a huge problem for remote managing via a s2s wg if that is the only means to access the remote gateway.

tinfoilmatt

I'd remove the WireGuard watchdog. It seems to be leading to some kind of race condition. Test a reboot without it.

Those "route: route has not been found" log entries are 'normal'. I see a bunch of those at boot on a system with multiple WG tunnels configured, presumably due to the order of initialization.

luckman212

Yup, can confirm that there is almost surely a timing or race condition issue during boot when you have a S2S WG tunnel or 2 configured. There are already a couple of WireGuard related redmines open, eg here and here so hopefully some touchups will be coming soon.

I get those route: route has not been found errors logged too. But, eventually my tunnels settle into a happy state without needing manual intervention. A touch /verbose_rc to enable debug boot logging might shed some more light on your situation.

Laxarus

@luckman212
Interesting issues but they are mostly related to failover gateway configuration.

I also forgot to mention, I started experiencing this issue after playing with some system tunables and loader.conf. They were the only changes made. Mostly for tuning.

Laxarus

@tinfoilmatt
Tried with watchdog wireguard disabled > no luck
@luckman212
Tried touch /verbose_rc > nothing related to wireguard being disabled on the logs, everything seems normal

iphoneking

Here’s what I did to resolve it for me:

After reboot, I went into the disabled WireGuard gateway, clicked save and applied the changes.
Went back into the gateway, unticked the disabled checkbox, saved and applied the changes.

After doing these steps the WireGuard gateway now starts enabled after a reboot.