iPad not auto-reconncting to Wireguard after router reboot

I am running ROS v7.12beta3 on a CCR1009-7G-1C. The issue is probably an iOS issue, not an ROS issue, but I’ll try here first. The issue has existed for multiple ROS versions, ever since I started using WG.

I have two iOS devices (iPhone and iPad), both with WG clients connecting to the WG server on my router. Everything works perfectly until the router reboots and then only the iPhone automatically reconnects to WG. At that point the iPad VPN setting is Off instead of On. All I need to do is manually turn VPN back on and everything works perfectly again.

The iPad does not have cellular capabilities, whereas the iPhone obviously does. Typically, both are part of my LAN, and the iPad has internet access, regardless of the WG connection. My speculation is that the iPhone reverts to cellular when it loses connection to the LAN and once the router is back up it reconnects to the LAN and WG. In other words, it always has an internet connection. My Android phone also automatically reconnects to WG once the router is back up. The issue is not caused by a WAN IP address change, and even if the address changed, the WG clients use dDNS to get the address.

I am not very iOS knowledgeable but have looked for, and failed to find a setting that would resolve the issue. I have seen posts in other forums for similar issues and seen opinions saying it was caused by the router time and iOS time being out of sync until the router and WG are fully up. I doubt this is the cause since my router is the NTP server for the WG clients. The posts recommend a delay start for WG until the router is fully up, but I do not know how to delay WG initialization to test this theory.

Any suggestions?

Not sure what you are describing here, normally the wireguard connection is from the mobile device when away, back to the home router.
So this talk about ipad and wifi means nothing to me.

Do you actually mean you use a third party vpn service?

If not, then local access to the internet is done through your ISP not wireguard.??

No, I am not using a third-party VPN service although ExpressVPN is one of the VPN services set up on the iPad along with WG. WG is the default service when VPN is enabled on the iPad.

Normally VPN is used when away from the LAN, as you said, connected back to the home router for access to the LAN and implicitly internet access beyond the WG connection. In that situation, the iPhone and Android will use the cellular network to connect to my WG and any of their subsequent internet access will actually be through my router and ISP.

For simplicity, I just keep the mobile devices connected to WG on my router even if they are on my LAN connected to the router via wifi. I know I am sacrificing bandwidth and adding load to the router, but bandwidth and router capacity are adequate even when on the LAN connected to WG. My intent is that even if the devices move away from the LAN using cellular or some other wifi network, they will still be connected to my WG and LAN. The iPhone and Android work fine, always connected to my WG. I don’t really know what the iPad does if I physically move it away from my wifi network because it is my wife’s device. My guess is that it will turn VPN off when it loses connection to my wifi network, but I do not want it to do that. I want VPN always on and connected to my WG.

Do you have On-Demand enabled in the iPad Wireguard app?

It was off and I have turned it on for any wifi SSID. Hoping that is the solution, can you explain exactly what On-Demand does? Thanks.

You have got to be kidding? You are asking about IOS VPN functionality on an MT forum. Are yee that lazy?

anav, I have seen lots of your posts and expected something like this from you. That is not a compliment! I began this post by stating it is probably an iOS issue but would start with this forum. I have done extensive internet searches and did not find a solution so I thought I would try here. It does involve WG on MT after all.

On demand is NOT, I repeat, NOT an MT function and is not on the MT router.
It is a VPN function that will be available on VPN associated APs, such as an option on wireguard app for ios.

Therefore asking about a VPN function on a non-MT device and operating system and a functionality that doesnt exist on RoS, here is rather odd.
Look it up yourself…

Normis was kind enough to come in and point out that perhaps there were other avenues to explore other than the MT config.

And yet another typical anav post.

Is the wireguard now working properly or not?
Aka still having issues?

I just did a manual router reboot and the iPad reconnected to WG. The issue typically happened when the router automatically upgraded to a new ROS version, but I doubt that is significant. For now, it looks like the issue is resolved.

[quote=TomSF post_id=1024038 can you explain exactly what On-Demand does?
[/quote]

When your iPad is trying to connect to something that matches the destination address, WireGuard will enable the tunnel automatically.

When your iPad is trying to connect to something that matches the destination address, WireGuard will enable the tunnel automatically.

I heard, its a VPN application issue not a mikrotik issue. :"-) Thanks (google) Larsa!