wireguard client re-resolve endpoint

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page 1, 2  Next
Author Message
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Sat Oct 03, 2020 17:07    Post subject: wireguard client re-resolve endpoint Reply with quote
Hello all,

I have setup wireguard to work as a client in DD wet and it is working great. The only problem I have with it is that every once in a while the endpoint which is a domain I own will change its public IP. This means that the wireguard connection on DD wet will be left hanging since the endpoint is resolved only at the beginning.

Is there a way for me to force a reresolve? I thought of a script that checks if the current IP of the endpoint matches the one wireguard is connected and if it is not then restart the WG process. But I don't know how to do that last part from a script. And I cannot find anything related to this for ddwrt.

I know that there is a.script to do just that for pc but sadly it doesn't work on DD wrt.

Has anyone stumbled across this problems with wireguard as a client on ddwrt?
Sponsor
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 475
Location: Earth

PostPosted: Tue Oct 06, 2020 12:47    Post subject: Reply with quote
Normally if you don't have a fixed IP for your domain to resolve to you would use a service like https://account.dyn.com/ rather than buying a domain. you configure the router that the server is behind with your dyn or other credentials so it always keeps it pointing to the correct ip (if its behind a DD-WRT router its configured here https://wiki.dd-wrt.com/wiki/index.php/Dynamic_DNS
there are lots of services offering this service some free some paid, myself i have never come across a service or any scripts that does the same for a domain but interested to see if anyone else posts
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8652
Location: Netherlands

PostPosted: Tue Oct 06, 2020 14:54    Post subject: Reply with quote
@drimago, I just stumbled upon this thread.

You are posting in the wrong forum and do not give required information that way you will not get much attention.

To get the best out of DDWRT and the forum, read and follow the forum guidelines:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

You maybe referring to the fact that WG only resolves an URL at startup.
However WG has built-in roaming for client and server, so actually a change of address should not be a problem, on handshake the new address should be handed over and updated.

From the WG manual:
Code:
Built-in Roaming

The client configuration contains an initial endpoint of its single peer (the server), so that it knows where to send encrypted data before it has received encrypted data. The server configuration doesn't have any initial endpoints of its peers (the clients). This is because the server discovers the endpoint of its peers by examining from where correctly authenticated data originates. If the server itself changes its own endpoint, and sends data to the clients, the clients will discover the new server endpoint and update the configuration just the same. Both client and server send encrypted data to the most recent IP endpoint for which they authentically decrypted data. Thus, there is full IP roaming on both ends.


One caveat the tunnel must be kept open, so you must enable Keep alive (from both ends)

On DDWRT you can set a watchdog and if the router looses internet connection it will reboot
(one of these days I might write a script to only restart the WG client on connection loss, but currently busy with OpenVPN 2.5)

For WG manuals see the links in my signature at the bottom of this post

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Tue Oct 06, 2020 21:05    Post subject: Reply with quote
foz111 wrote:
Normally if you don't have a fixed IP for your domain to resolve to you would use a service like https://account.dyn.com/ rather than buying a domain. you configure the router that the server is behind with your dyn or other credentials so it always keeps it pointing to the correct ip (if its behind a DD-WRT router its configured here https://wiki.dd-wrt.com/wiki/index.php/Dynamic_DNS
there are lots of services offering this service some free some paid, myself i have never come across a service or any scripts that does the same for a domain but interested to see if anyone else posts


I am using freedns as ddns on my "server", the only problem was related to the rare occasions when the server public IP changes and the client connection drops and appears to not reconnect until I restart the client. I was hopping for a way to restart only the WG interface.
foz111
DD-WRT User


Joined: 01 Oct 2017
Posts: 475
Location: Earth

PostPosted: Wed Oct 07, 2020 8:17    Post subject: Reply with quote
Sorry i was unsure what your were asking so i tried to help
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Wed Oct 07, 2020 9:41    Post subject: Reply with quote
foz111 wrote:
Sorry i was unsure what your were asking so i tried to help


No worries! I appreciate your help!
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Wed Oct 07, 2020 9:45    Post subject: Reply with quote
egc wrote:
@drimago, I just stumbled upon this thread.

You are posting in the wrong forum and do not give required information that way you will not get much attention.

To get the best out of DDWRT and the forum, read and follow the forum guidelines:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

You maybe referring to the fact that WG only resolves an URL at startup.
However WG has built-in roaming for client and server, so actually a change of address should not be a problem, on handshake the new address should be handed over and updated.



Thank you for this info! I didn't know this part about wireguard. I thorught that the keepalive setting is placed on the client conf file only. But now I have put that setting in the server conf file too.

I will perform some tests to see if it works!

Thank you for your help!

P.S.: is a script that restarts the WG interface a better option for this problem? or is this solution preferable? I am asking because I know that on a PC, there is a script that can be setup to verify if the endpoint has changed its ip and re-resolve the endoint at regular intervals. So if the keepalive setting works, why isn't it sufficient on the PC too?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8652
Location: Netherlands

PostPosted: Wed Oct 07, 2020 9:54    Post subject: Reply with quote
drimago wrote:
egc wrote:
@drimago, I just stumbled upon this thread.

You are posting in the wrong forum and do not give required information that way you will not get much attention.

To get the best out of DDWRT and the forum, read and follow the forum guidelines:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087

You maybe referring to the fact that WG only resolves an URL at startup.
However WG has built-in roaming for client and server, so actually a change of address should not be a problem, on handshake the new address should be handed over and updated.



Thank you for this info! I didn't know this part about wireguard. I thorught that the keepalive setting is placed on the client conf file only. But now I have put that setting in the server conf file too.

I will perform some tests to see if it works!

Thank you for your help!

P.S.: is a script that restarts the WG interface a better option for this problem? or is this solution preferable? I am asking because I know that on a PC, there is a script that can be setup to verify if the endpoint has changed its ip and re-resolve the endoint at regular intervals. So if the keepalive setting works, why isn't it sufficient on the PC too?


Good question, I can imagine a PC goes to sleep or the connection is disturbed for a longer period otherwise, in that case you have to resolve the URL again and thus restart WG. But as long as the connection is kept alive roaming should not be a problem (according to the WG documentation Smile )

This question has not come up until now, like I said you can set the watchdog on the router so that it reboots.

When I have time I can make a small script to restart WG when the connection is lost but at the moment busy with OpenVPN 2.5 and weeding out some unnecessary firewall settings on OpenVPN

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Wed Oct 07, 2020 10:52    Post subject: Reply with quote
egc wrote:


This question has not come up until now, like I said you can set the watchdog on the router so that it reboots.

When I have time I can make a small script to restart WG when the connection is lost but at the moment busy with OpenVPN 2.5 and weeding out some unnecessary firewall settings on OpenVPN


Good stuff! I will try it this way and let you know how it works! I will be able to do it in about two days as I am swamped myself!

Good luck with OpenVPN 2.5! It would be great if you found some time to write the script for WG.

All the best!
Zyxx
DD-WRT User


Joined: 28 Dec 2018
Posts: 445

PostPosted: Wed Oct 07, 2020 11:29    Post subject: Reply with quote
My few cents:

r40559 (maybe you were misguided by the out of date Router Database) had its very own problems.
I needed to manual up and down WG to reconnect after every disconnect.
Only alternative: keep alive reboot.

A few releases after this, the problem is gone. Reconnecting does work.

BUT my router connects to a static IPv4, nothing dynamic...

Which release X on Device Y are you using in setup Z? Wink
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Wed Oct 07, 2020 11:36    Post subject: Reply with quote
Zyxx wrote:
My few cents:

r40559 (maybe you were misguided by the out of date Router Database) had its very own problems.
I needed to manual up and down WG to reconnect after every disconnect.
Only alternative: keep alive reboot.

A few releases after this, the problem is gone. Reconnecting does work.

BUT my router connects to a static IPv4, nothing dynamic...

Which release X on Device Y are you using in setup Z? Wink


My router is TP-Link Archer C7v5, using the latest version I found to download: DD-WRT v3.0-r44483.

I will try what was mentioned above with the KeepAlive setting and if it doesn't work I will activate the watchdog too. I am not concerned with too many reboots because the ISP where my server is connected only changes the public ip when the router is restarted. Other than that I can go months without an IP change. So I should be fine!

Thank you for your help!
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Fri Nov 13, 2020 11:29    Post subject: Reply with quote
drimago wrote:

I will try what was mentioned above with the KeepAlive setting and if it doesn't work I will activate the watchdog too. I am not concerned with too many reboots because the ISP where my server is connected only changes the public ip when the router is restarted. Other than that I can go months without an IP change. So I should be fine!

Thank you for your help!


So I have implemented the solution with KeepAlive setting in both config files (server and the client) and I can report that this does not solve the issue.

It happened that the server went down for an extended period of time (the ISP made some improvements and they had to cut the connection) and when I got line back, the client (dd wrt) did not reconnect.

So I believe that the ability to stop and start again the wg interface using a script is very important for this kind of scenario.

Rebooting the client router is a solution for the moment but it is not the most elegant.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8652
Location: Netherlands

PostPosted: Fri Nov 13, 2020 13:17    Post subject: Reply with quote
Well it so happened that OpenVPN 2.5 seems implemented succesfully

So I have some time to work on WireGuard.
Attached a WireGuard watchdog script

But I have not tested it so chances are it is not working as intended (yet)

So your task to try it and report, debug is set on, the script reports in syslog.
Use this command:
Code:
grep -i wireguard /var/log/messages
to see what is going on

Just start the script from the CLI do not add it to Startup unless you are sure it works.

Test with just pulling your network cable.

Script available at: https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1202631#1202631

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087


Last edited by egc on Tue Nov 17, 2020 11:01; edited 1 time in total
drimago
DD-WRT Novice


Joined: 18 Jul 2019
Posts: 10

PostPosted: Fri Nov 13, 2020 16:37    Post subject: Reply with quote
egc wrote:
Well it so happened that OpenVPN 2.5 seems implemented succesfully

So I have some time to work on WireGuard.
Attached a WireGuard watchdog script

But I have not tested it so chances are it is not working as intended (yet)

So your task to try it and report, debug is set on, the script reports in syslog.
Use this command:
Code:
grep -i wireguard /var/log/messages
to see what is going on

Just start the script from the CLI do not add it to Startup unless you are sure it works.

Test with just pulling your network cable.

Let me know what is (not) working


Great! Thank you! I will get right on it with the testing and will report back this week maybe! Regarding pulling the network cable is going to be difficult because the dd wrt router (the client) is in a remote location. What I can do and I believe it is more relevant is to reboot my router at home which acts as the wireguard server. This will lead to a public ip change which normally breaks the wireguard remote client.

Hopefully with your script this will not happen any longer!

Cheers
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8652
Location: Netherlands

PostPosted: Fri Nov 13, 2020 16:43    Post subject: Reply with quote
Excellent.

There are more ways to test like deleting the route to the server etc.
Use what you want/can Smile

No hurry

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum