Having WireGuard and NetBird simultaneously installed causes UI issues

mcfly9

I started playing with NetBird on pfsense. After a while, I have noticed, that it broke the WireGuard configuration UX on pfsense admin page:
When making any changes, the pfsense GUI would timeout after 180 seconds with a 50x php error. The running wireguard config (wg show) will not contain the change, but pfsense's config.xml would pick up the change. It would also leave the WireGuard settings page in a dirty state claiming there's an unapplied change. Trying to apply the change too many times (8+) would render the pfsense GUI unresponsive.

The background of the issue seems to be that when applying WireGuard changes, the code tries destroying "rogue" WireGuard tunnels. The code flags NetBird's wt0 as rogue.
The destroy command hangs, and this leads to the php 50x error page.

I was able to remedy the problem by patching the wireguard UI code using the following patch:

--- usr/local/pkg/wireguard/includes/wg_api.inc
+++ usr/local/pkg/wireguard/includes/wg_api.inc
@@ -474,7 +474,8 @@
  * Returns an array of running WireGuard tunnel interfaces per wg(8)
  */
 function wg_get_running_ifs() {
-	return array_keys(wg_get_running_config());
+	// NetBird owns wt0 and keeps its tun cdev open; destroying it deadlocks in tun_destroy().
+	return array_values(array_diff(array_keys(wg_get_running_config()), array("wt0")));
 }
 
 /*

This patch omits wt0 from the rogue interfaces to be destroyed upon WireGuard change save.

While the patch seems to work OK on my system, it might cause other issues. Use it at your own risk.
Would be great if someone from the pfsene / wireguard team could look at this problem.

johnpoz

@mcfly9 I wasn't aware netbird was an official pfsense package. I would think you should reach out to netbird to fix whatever issue they are causing with pfsense.

https://docs.netgate.com/pfsense/en/latest/packages/index.html

If netbird wants to work with pfsense - they really should work with netgate to have it be an official package.

mcfly9

@johnpoz obviously, as they are not an official package, I am not expecting any support here, I understood the risks, and I understand your point of view.
I have reported this to netbird as well, just wanted to share back to the community in case someone else also bumps into the issue while experimenting with new tech.