Community discussions

MikroTik App
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

WireGuard Peer not functioning after a router restart

Tue Jan 25, 2022 8:12 pm

WireGuard Peer does nothing after a reboot until I disable and reenable it.
Is it a bug, or do I need to enable/configure something?

"Does nothing" means the "Last Handshake" counter is not running, hosts routed via the WireGuard connection are not reachable.
After disabling-enabling counter starts running, and hosts become reachable.

My WireGuard side is "client."

I'm using RouterOS 7.1.1 on RB5009.
 
User avatar
own3r1138
Long time Member
Long time Member
Posts: 681
Joined: Sun Feb 14, 2021 12:33 am
Location: Pleiades
Contact:

Re: WireGuard Peer not functioning after a router restart

Tue Jan 25, 2022 8:31 pm

maybe setting the persistent keepalive value would help you if you have not already tried that.
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 8:13 am

maybe setting the persistent keepalive value would help you if you have not already tried that.
The value for keepalive is 20 seconds now. Unfortunately, this doesn't help.
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 8:47 am

If for your endpoint you have a DNS instead of an IP addr and the DNS subsystem is not yet able to resolve that host by the time wireguard wants to connect, it will fail, wireguard doesn't retry resolving that DNS, you can script it though.
It's mentioned around the forum in a few places.
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 10:29 am

If for your endpoint you have a DNS instead of an IP addr and the DNS subsystem is not yet able to resolve that host by the time wireguard wants to connect, it will fail, wireguard doesn't retry resolving that DNS, you can script it though.
It's mentioned around the forum in a few places.
Yes, I'm using DNS for the WireGuard endpoint.

That is rather unfortunate, but it seems, that I have no choice but to script peer reinitialization.

Thanks for the answer.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 1:12 pm

It's indeed a problem since the integration of WG into ROS7 when using DDNS and DNS resolving is not yet active when WG interface starts.

Netwatch - remote IP on other end.

On Down, something like this:
/interface wireguard peer disable 0
:delay 5
/interface wireguard peer enable 0
log info "WG Peer toggled"

Very basic but does what needs to be done.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 2:53 pm

Hi Hoelvetn,
Can you describe a bit more on whats going on here.
I dont quite get the issue. Are we saying that the client MT router trying to resolve the new Server Client mynetname takes longer than the peristent keep alive so that fails and the link is broken??
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 3:37 pm

A bit earlier.
When the router starts, if dns resolution is not yet possible and wireguard interface starts, it fails and does not retry later on. So the interface never comes up.
A simple disable of the peer and re enable, retriggers the resolution of the endpoint dns.
If you use ip, you will not have this problem.
Only with dns endpoint names.

It is a known issue since wireguard has been integrated into ROS7 but easy to solve.
IMHO the solution would be to prevent wireguard interface to start IF dns name is used as endpoint AND DNS resolution is not functional yet.
Or retry the starting of the WG interface when DNS resolution is operational again if previous attempt to start failed because of this.
Multiple ways to skin that cat.
Last edited by holvoetn on Wed Jan 26, 2022 3:59 pm, edited 1 time in total.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 3:59 pm

So your script is for the client Device, to delay the initial wireguard connection?
Lets say I am a user on the client I open my browser and want to go out.
I will get no result during this delay correct.

It seems the five seconds is rather arbitrary.
OKay I see what you are doing, as simple as possible but effective.

I was looking as something overly complex like.............

If DNS mynetname is NOT resolved, delay Peer 5secs,
If DNYSmynetname is resolved, carry on.

Not sure how to state it but would use the firewall address list entry for mynetname??
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 4:03 pm

Added some additional info in my post but yes, the 5s is very arbitrary. It's what worked for me so far.
I'm not the inventor of this procedure (credit where credit is due but I am sorry for not remembering who the originator was), I saw it being suggested by someone else as manuel intervention to solve this annoyance.

And I simply put it into a very crude yet effective netwatch procedure.
Default thing I add now when using Wireguard on a "client" peer device.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 4:15 pm

Sounds like an addition to the wireguard article needs to be worked in.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 4:30 pm

So your script is for the client Device, to delay the initial wireguard connection?
Lets say I am a user on the client I open my browser and want to go out.
I will get no result during this delay correct.
No, this procedure is for that tiny period in time at power-on where starting of the wireguard interface with a named endpoint would be right in the same timeframe where possibly DNS resolution is not yet functional. This does not apply, to my knowledge, when you use IP addresses as endpoint.
When that WG start procedure is done in such an event, ROS does NOT retry to start the interface. It simply will not come up anymore.
Again, toggling the peer status retriggers that start procedure, at that time DNS should work (so we hope :lol: ) and the starting of the WG interface will also become successful (again, so we hope).

In ideal circumstances that netwatch script will NEVER run.
Most cases it will run once during a period where power is applied, shortly after boot. And possibly again once when power is lost and up again.
But ideally never.

Feel free to add it. It's something I also see being mentioned from time to time.
Until they provide a real fix embedded in ROS, this is the easy workaround.
 
User avatar
mozerd
Forum Veteran
Forum Veteran
Posts: 872
Joined: Thu Oct 05, 2017 3:39 pm
Location: Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 4:38 pm

Sounds like an addition to the wireguard article needs to be worked in.
When WireGuard is configured properly the issue described is not an issue .... Wireguard recommends that each Peer interface be assigned an IP Address --- THAT is the correct way and if that is done no issue .... so your WireGuard article should reflect that correct procedure otherwise a kludge has to be applied and there is no need for a kludge. :) OK its not a kludge but a add-in routine that is simply not necessary when WireGuard is properly configured.

Another very important POINT that many miss about WireGuard:
WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation .
https://encomhat.com/2021/07/obfuscate-wireguard/
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 4:56 pm

@mozerd,
I respectfully disagree.
The problem here is not the WG peer IP address itself.
The problem is the ENDPOINT address, when specified as dns name (which is perfectly possible and is the ONLY way to use when having a dynamic IP on "server" side).

ONE end of the Wireguard interface needs to be publicly available.
Being it static IP, static DNS or dynamic DNS.
The peer will connect, if it can resolve the dns. The "server" will then figure out the address of the "client" once the interface comes up.
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 5:18 pm

When WireGuard is configured properly the issue described is not an issue ....
Oh mighty @mozerd aka `the one that can't read labels`, please test the mentioned scenario in the first post of this topic and in other places on the forum:
Set up two peers, each on different routers ofc.
Let's say Peer A sits behind a dynamic public wan IP, so you have to use a DDNS to reach it, let's say that peer-A-public.wg-ddns.ru points to this peers current IP and gets updated properly.
And we have one Peer B that sits behind a CGNAT IP / NAT whatever that you have no control over, and this peers wants to connect to our Peer A.
So you set under Peer Bs config, the endpoint for our Peer A, which is peer-A-public.wg-ddns.ru:whateverport.
Now, reboot your Peer Bs router but with your wan cable unplugged, let it boot, and plug the wan cable 10 seconds after it finished booting.
Wireguard will not come up, wireguard attempts to resolve peer-A-public.wg-ddns.ru and fails because we have no internet by the time it tries to do so, AND THAT'S IT, it doesn't try again, nothing, nada, just like your ordered switch without PoE doesn't magically have PoE.
Oh, and by all means, please configure your peers properly before the test.
Cheers.
Also, this is not something MikroTik specific, it's just how WireGuard works, for other platforms there are scripts provided:
https://github.com/WireGuard/wireguard- ... esolve-dns
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 6:26 pm

Out of curiosity. Can someone point out to me other topics with the same problem discussed?
I've searched for them before creating this topic but had no success.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 6:33 pm

Someone needs to upgrade some searching skills ... :lol:

1- viewtopic.php?t=178930
2- viewtopic.php?t=166214
3- viewtopic.php?t=178341 (post 135)
4- viewtopic.php?t=178704&p=881220 (post 13 indicating it was solved but the issue slipped back in)
I'll stop here ...
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 6:41 pm

Someone needs to upgrade some searching skills ... :lol:

1- viewtopic.php?t=178930
2- viewtopic.php?t=166214
3- viewtopic.php?t=178341 (post 135)
4- viewtopic.php?t=178704&p=881220 (post 13 indicating it was solved but the issue slipped back in)
I'll stop here ...
Thanks for answering the question,
Yes, that may be the case with my search skills )

Search query "wireguard peer not connected after reboot" gave me nothing, and for "wireguard peer" about the first five topics was irrelevant.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 6:42 pm

@Znevna
Nice sequence to reproduce the behavior ! That's exactly what will trigger it.

Whereas you say it might be "default behavior" for the protocol, I see it as a bug on the integration in ROS.
The OS should take care to solve this issue for the user.

But there are more stringent problems to fix then this little annoyance which can be circumvented quite easily.
E.g. some devices becomes inaccessible through winbox or ssh on 7.2rc1 (been there, done that)
Or significant increase in CPU load, also 7.2rc1 (I've seen it happen too)
Routing protocols not working properly, ... etc etc.

But then again, ROS 7.1.1 might be called stable, to me the complete ROS7-stream it's still testing-quality.
But it works for what I need :D
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 6:43 pm

Thanks for answering the question,
Yes, that may be the case with my search skills )

Search query "wireguard peer not connected after reboot" gave me nothing, and for "wireguard peer" about the first five topics was irrelevant.
In all fairness: I more or less knew which terms would give me the needed hits :lol:
wireguard toggle peer site:forum.mikrotik.com
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 6:45 pm

Thanks for answering the question,
Yes, that may be the case with my search skills )

Search query "wireguard peer not connected after reboot" gave me nothing, and for "wireguard peer" about the first five topics was irrelevant.
In all fairness: I more or less knew which terms would give me the needed hits :lol:
wireguard toggle peer site:forum.mikrotik.com
Ah, so you've googled it. I've used the forum's search.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 7:36 pm



In all fairness: I more or less knew which terms would give me the needed hits :lol:
wireguard toggle peer site:forum.mikrotik.com
Ah, so you've googled it. I've used the forum's search.
Of course, dont you? Didnt you get the memo from Google
"If you dont use Google as your search engine, we will release the incriminating photos, emails and text messages we have on your file, pfft and she/he isnt even that good looking "
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 7:38 pm

As long as I cannot be sure what IPs are available on the other side of the WireGuard connection (it's a VPN provider's network) and one cannot specify an interface to use for the Netwatch, I've come up with this script for the Scheduler:
:local pingStatus [( [/ping address=8.8.8.8 count=1 interface="WireGuard Interface" as-value]->"status"=null)]
:if ($pingStatus = false) do={
    /interface/wireguard/peers/disable 0
    /interface/wireguard/peers/enable 0
    /log/info message="WireGuard Interface Peer has been restarted."
}
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 7:45 pm

Time delay ??
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 7:55 pm

Time delay ??
It will retry on the next scheduler iteration in case one disable-enable cycle was not enough.
 
gdanov
Member Candidate
Member Candidate
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: WireGuard Peer not functioning after a router restart

Wed Jan 26, 2022 11:46 pm

Time delay ??
I use 60 secs between disable/enable peer. Also below is my script. Such script is mandatory on at least one of the tunnel sides because WG does DNS resolution only once at start. While advertised to support "roaming" — IP change — I've found the tunnel goes stale every now & then with no attempt to re-connect whatsoever. This may be separate issue, IDK, but with dynamic IP + DNS some sort of script is absolute must.
#:log info "wg check-ip $wgcheckip "

:if ([/ping $wgcheckip interval=1 count=5] =0) do={
  :log info "WG down $wgcheckip"
  /interface/wireguard/peers/disable [find endpoint-address=$endpointip];
  :delay 60
  /interface/wireguard/peers/enable [find endpoint-address=$endpointip];
  :log info "WG up again $wgcheckip"
}
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 1:02 am

Time delay ??
I use 60 secs between disable/enable peer. Also below is my script. Such script is mandatory on at least one of the tunnel sides because WG does DNS resolution only once at start. While advertised to support "roaming" — IP change — I've found the tunnel goes stale every now & then with no attempt to re-connect whatsoever. This may be separate issue, IDK, but with dynamic IP + DNS some sort of script is absolute must.

#:log info "wg check-ip $wgcheckip "

:if ([/ping $wgcheckip interval=1 count=5] =0) do={
:log info "WG down $wgcheckip"
/interface/wireguard/peers/disable [find endpoint-address=$endpointip];
:delay 60
/interface/wireguard/peers/enable [find endpoint-address=$endpointip];
:log info "WG up again $wgcheckip"
}
I am a horrible script reader,
It appears to say, Ping some variable called $wgcheckip five times and if the return of (one or all five times?) is zero
inform the admin that the endpoint is not available
and carry out a process to disable wg peer for 60 seconds and then re-nable peer
Then tell admin wg is back up.

Clearly I dont understand the bolded line very well, and on top of that how does the router know what $wgcheckip is ??
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 6:38 am

Most likely somewhere else in the script (or global variable) $wgcheckip will be defined as the IP address to check on the other side.
 
gdanov
Member Candidate
Member Candidate
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 3:59 pm

@anav well, you've understood it well. the two ip variables are the internal and the endpoint addresses. when I can't ping the internal one, I disable/enable the peer record finding it by the external IP.
the script is executed via a schedule, as a function, like that:
:global myFunc [:parse [/system script get watch-WG-pp source]]
$myFunc wgcheckip=10.1.1.51 endpointip=xxxyyy.sn.mynetname.net
you need to do it in a schedule because (since some release) netwatch does not have the proper rights.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 4:20 pm

gdanov, I think netwatch will work without a schedule IF you check off the box that says "Dont Require Permissions" ??

Just to be clear, 10.1.1.51 being pinged from the remote client router is
you trying to ping a subnet address on the Server router through the tunnel ???

So the complete script would be
...
:global myFunc [:parse [/system script get watch-WG-pp source]]
$myFunc wgcheckip=10.1.1.51 endpointip=xxxyyy.sn.mynetname.net

#:log info "wg check-ip $wgcheckip "

:if ([/ping $wgcheckip interval=1 count=5] =0) do={
  :log info "WG down $wgcheckip"
  /interface/wireguard/peers/disable [find endpoint-address=$endpointip];
  :delay 60
  /interface/wireguard/peers/enable [find endpoint-address=$endpointip];
  :log info "WG up again $wgcheckip"
}
 
User avatar
mozerd
Forum Veteran
Forum Veteran
Posts: 872
Joined: Thu Oct 05, 2017 3:39 pm
Location: Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 4:32 pm

@Znevna
Whereas you say it might be "default behavior" for the protocol, I see it as a bug on the integration in ROS.
The OS should take care to solve this issue for the user.
@holvoetn I also see it as a bug on the integration within ROS ....
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 7:49 pm

@Znevna
Whereas you say it might be "default behavior" for the protocol, I see it as a bug on the integration in ROS.
The OS should take care to solve this issue for the user.
@holvoetn I also see it as a bug on the integration within ROS ....
Confused...
Didn't you claim some posts ago this issue was non existing when everything was properly configured ?
:lol:
 
User avatar
mozerd
Forum Veteran
Forum Veteran
Posts: 872
Joined: Thu Oct 05, 2017 3:39 pm
Location: Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 8:09 pm

Confused...
Didn't you claim some posts ago this issue was non existing when everything was properly configured ?
:lol:
I and many of my clients have been using WireGuard for a number of years primarily with EdgeMax Routers and have not experienced this phenomenon… I recently [7.1.1] started to use WireGuard under ROS and have a few Tik clients utilizing that VPN with no issues reported. I have observed that a number of folks here are flagging this issue which is why I also believe that it’s an issue specific to Mikrotik.

fYI, I have rebooted my MikroTik a number of times and have not experienced the issue … I happen to believe that WireGuard works well when it’s rules are followed … in following the recommendation set out by WireGuard where each Peer virtual interfaces is assigned an IP address IP Roaming works as advertised … it has for me and my limited set of Tik clients.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 8:33 pm

@mozerd: I don't know if you're ignoring @Znevna, but this post had quite clear explanation what happens. In short, if WG attempts to resolve peer's hostname and fails, e.g. when WAN is not ready yet, it doesn't try again (supposedly, I didn't test it myself yet).
 
User avatar
mozerd
Forum Veteran
Forum Veteran
Posts: 872
Joined: Thu Oct 05, 2017 3:39 pm
Location: Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 8:56 pm

@mozerd: I don't know if you're ignoring @Znevna
Yes I am ignoring Znevna … if that person want to have a discourse with me Znevna can act with civility otherwise I have no interest.

I am aware of the processes expressed … I am only relaying my experiences utilizing WireGuard … and I continue to believe that many are not following WireGuard procedures …. Obviously some have a problem and I believe it’s got more to do with how MikroTik have incorporated WireGuard into RoS ….

A key point in all my dynamic tik implementations is …. Upon reboot my DDNS script fires soon after the IP is captured or if IP is lost due to whatever cause and is re-initialized the DDNS script fires again so my endpoints never are left hanging. I do not use Tik’S DDNS service cause it’s erratic. :D
 
olegandreych
just joined
Topic Author
Posts: 11
Joined: Thu Dec 06, 2012 5:54 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 9:14 pm

@mozerd: I don't know if you're ignoring @Znevna
Yes I am ignoring Znevna … if that person want to have a discourse with me Znevna can act with civility otherwise I have no interest.

I am aware of the processes expressed … I am only relaying my experiences utilizing WireGuard … and I continue to believe that many are not following WireGuard procedures …. Obviously some have a problem and I believe it’s got more to do with how MikroTik have incorporated WireGuard into RoS ….

A key point in all my dynamic tik implementations is …. Upon reboot my DDNS script fires soon after the IP is captured or if IP is lost due to whatever cause and is re-initialized the DDNS script fires again so my endpoints never are left hanging. I do not use Tik’S DDNS service cause it’s erratic. :D
One doesn't have to use DDNS for this issue to occur. It takes only DNS address as the Peer Endpoint value for the aforementioned issue to take place.
 
User avatar
mozerd
Forum Veteran
Forum Veteran
Posts: 872
Joined: Thu Oct 05, 2017 3:39 pm
Location: Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 10:08 pm

One doesn't have to use DDNS for this issue to occur. It takes only DNS address as the Peer Endpoint value for the aforementioned issue to take place.
Assuming 2 MikroTik Hosts: [2 Tik Routers] Peer 1 on Router 1 and Peer 2 on Router 2
If there is no Internet on Router 2 Peer 2 Endpoint cannot communicate --- that is obvious --- and when the Internet becomes available again WireGuard should come up based on the the keepalive packet assuming that has been turned on appropriately .... if WireGuard will not come up under that circumstance THEN its a MikroTik issue based on how it was integrated into RoS -- so Yes I belive it to be a bug.

IMO @holvoetn nailed it by stating
It's indeed a problem since the integration of WG into ROS7 when using DDNS and DNS resolving is not yet active when WG interface starts.
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 10:31 pm

keepalives are sent to the current endpoint addr:port, if endpoint fails to resolve there is no current endpoint, there is no destination for that keepalive.
Current endpoint can also be populated if our peer somehow receives a valid packet from the other side (but if we are behind a natted IP this is less likely to happen).
Read the docs, spend some time on the wireguard official IRC channel, read the mail lists.
"works for me" means nothing otherwise.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 10:42 pm

Well, it looks like sort of bug or missing feature. If WG has hostname for peer's endpoint and it fails to resolve, WG doesn't try again (at least not quickly enough before I lost my patience waiting whether it will or not). And remote peer won't help if they are in client-server relationship (this side is client), where server doesn't know client's endpoint beforehand.

It's enough to re-set hostnames to make it try again (ugly code, I'm almost sure there's better way how to achieve the same):
/interface/wireguard/peers set [find comment="mypeer"] endpoint-address=[get [find comment="mypeer"] endpoint-address]
But this should be built-in. System knows that hostname didn't resolve, so it could try again automatically (after some reasonable delay).
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 10:44 pm

This "feature" is not built in any WireGuard implementations, wireguard itself doesn't handle that, alone. There is the re-resolv-dns script provided mentioned above and that's it.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5403
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 11:02 pm

This "feature" is not built in any WireGuard implementations, wireguard itself doesn't handle that, alone. There is the re-resolv-dns script provided mentioned above and that's it.
I can fully agree that it's not up to the PROTOCOL to make sure DNS resolution is functional.
This should already have been handled upfront before the protocol was initiated to start.
Just like NTP service does not test it either, neither will it make sure DNS will work. It has to work before.
(but NTP will retry later on ...that's the difference)

So ... to put it indeed in a positive way it's effectively a "feature" of Wireguard which needs to be dealt with by the operating system it runs under.
And currently ROS does NOT retry anything. You can wait till your beard grows onto the ground.
Someone manually needs to retrigger the start of that WG interface to re-initiate that resolution of the endpoint. Or have a script deal with it (ROS, Linux, whatever, ...). Or ... the operating system needs to deal with it. Last option is ideally the best.

Just for fun, I pulled to cable on my Windows-laptop and made sure no Wifi is connecting. So no network at all.
When trying to initiate WG, it gives me an error "no such host is known or present". And THAT's how it should be. The error should be caught and the "caller" needs to be notified about it.
But this has NOTHING to do with flaky setup of the interface as indicated several posts above. It's because of a condition prior to starting said interface.
 
User avatar
Znevna
Forum Guru
Forum Guru
Posts: 1347
Joined: Mon Sep 23, 2019 1:04 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 11:12 pm

On Windows, the client has something coded that takes care of this.
https://git.zx2c4.com/wireguard-windows ... windows.go
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: WireGuard Peer not functioning after a router restart

Thu Jan 27, 2022 11:16 pm

It's an opportunity for RouterOS to do it better. It's friendly OS where things are nicely integrated together, so it makes sense to handle this automatically. This one, if it's as startup error, is pretty obvious. There's hostname for peer, it's not available, trying again later is the one right choice and should happen automatically.

It's slightly more complicated if you'd want to handle changes for already established connections. E.g. server goes away for a while and comes back with different address. But client doesn't know that and will be sending packets to old address. Server won't be able to notify client about the change. Client would need to resolve server's hostname (which now points to new address) again, but it probably doesn't do it either. This should probably not happen automatically. But an option to try it after user-defined time, when there's no contact with peer, could be nice.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 12:02 am

I avoid this by creating static DNS entries in the router creating so a pool of IP addresses that apply to that specific VPN connection.

When you are depending on external server to return the dynamic IP address of the peer then you could store that in static DNS entry every so many minutes. Use the static entry then as endpoint address.

When the internet connection is restored and in the meantime the IP address on the other side has changed, then after updating the static DNS entry that you can script a restart of the WG peer.....swatting so two flies in one hit.
 
Sob
Forum Guru
Forum Guru
Posts: 9119
Joined: Mon Apr 20, 2009 9:11 pm

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 12:41 am

Yes, it's doable. But think about average users, they shouldn't need to do this, it should work automatically. If I set endpoint for peer, that's clear indication that I want system use it to initiate new connection. If it's hostname and system tries to resolve it once and immediatelly gives up when it fails, it's not good.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 1:18 am

On first start, a resolve is made but no IP is returned then try again later. If an other reply, as nxdomain, servfail or refused then no retry, as it is now.
Add DNS blockers like Pi-hole: 0.0.0.0 or ::0 is also no retry
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 4:59 am

@gdanov, question for you back at post #30. A bit of noise occurred in between. ;-)
 
gdanov
Member Candidate
Member Candidate
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 10:41 am

gdanov, I think netwatch will work without a schedule IF you check off the box that says "Dont Require Permissions" ??
I'm not scripting expert. Originally tried with netwatch, nothing happened then reading the forum I saw other people do it with schedule because "netwatch has not enough rights".
I'll experiment with that checkbox.
Just to be clear, 10.1.1.51 being pinged from the remote client router is
you trying to ping a subnet address on the Server router through the tunnel ???
yes, but your wording is bit confusing, so let me repeat: the local peer (one running the script) pings the remote peer's tunnel IP. 10.x.x.x is my wireguard sub-net.
So the complete script would be
...
:global myFunc [:parse [/system script get watch-WG-pp source]]
$myFunc wgcheckip=10.1.1.51 endpointip=xxxyyy.sn.mynetname.net

#:log info "wg check-ip $wgcheckip "

:if ([/ping $wgcheckip interval=1 count=5] =0) do={
  :log info "WG down $wgcheckip"
  /interface/wireguard/peers/disable [find endpoint-address=$endpointip];
  :delay 60
  /interface/wireguard/peers/enable [find endpoint-address=$endpointip];
  :log info "WG up again $wgcheckip"
}
I don't think that would work if you use it as one script. If you want one script (instead of script entry + second script that invokes it as function) it needs to look something like this:
:local wgcheckip 10.1.1.51
:local endpointip xxxyyy.sn.mynetname.net

#:log info "wg check-ip $wgcheckip "

:if ([/ping $wgcheckip interval=1 count=5] =0) do={
  :log info "WG down $wgcheckip"
  /interface/wireguard/peers/disable [find endpoint-address=$endpointip];
  :delay 60
  /interface/wireguard/peers/enable [find endpoint-address=$endpointip];
  :log info "WG up again $wgcheckip"
 
gdanov
Member Candidate
Member Candidate
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 11:58 am

regarding the "noise" — WireGuard is not a finished service, it's a low-level tool, unfortunately. The complaints are valid, but people miss the fact that WG is intentionally limited in functionality by it's creators because they wanted small and auditable code base. That's fair, problem is we don't have high quality add-ons for it. For example linux wg-quick is of questionable value. Unfortunately the mobile clients also aren't very smart too and lack proper connection health sensing + retry.

With WG you are on your own and need to build scripts to monitor and re-establish the connections. That's my experience running several WG meshes on Ubuntu, OSX, Android and Windows. It's not MT problem.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19101
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 2:00 pm

Sorry for the confusion but right back at ya! I didnt understand the below........

so let me repeat: the local peer (one running the script) pings the remote peer's tunnel IP.
10.xc.x.x is my wireguard sub-net.


Can I assume you mean the script on the client device that originates the initial connection (your MT router) , pings an IP address within the subnet you have assigned to the tunnel at the remote site - and thus the linux device has assigned an IP address of something like 10.1.1.1/24 network 10.1.1.0 to the tunnel??

Close?

What if on the Wireguard Setup at the linux end, has NO IP address was assigned to WG Interface ( I rarely do!).
Wouldnt it be good enough to simply ping any local address at the remote site, THRU the tunnel (assuming of course that all requiste wireguard settings and firewall rules allowed the traffic)
 
gdanov
Member Candidate
Member Candidate
Posts: 150
Joined: Thu Jan 17, 2019 1:10 pm

Re: WireGuard Peer not functioning after a router restart

Fri Jan 28, 2022 3:01 pm

Sorry for the confusion but right back at ya! I didnt understand the below........

so let me repeat: the local peer (one running the script) pings the remote peer's tunnel IP.
10.xc.x.x is my wireguard sub-net.


Can I assume you mean the script on the client device that originates the initial connection (your MT router) , pings an IP address within the subnet you have assigned to the tunnel at the remote site - and thus the linux device has assigned an IP address of something like 10.1.1.1/24 network 10.1.1.0 to the tunnel??

Close?

What if on the Wireguard Setup at the linux end, has NO IP address was assigned to WG Interface ( I rarely do!).
Wouldnt it be good enough to simply ping any local address at the remote site, THRU the tunnel (assuming of course that all requiste wireguard settings and firewall rules allowed the traffic)
finally it all makes sense :) I always give IPs to my WG peers. Had abs. never thought about going without an IP (well, duh, yes, obvious now).
Yes, you could ping anything on the remote end that would go via the tunnel.
 
anserk
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Wed Mar 02, 2022 5:08 pm

Re: WireGuard Peer not functioning after a router restart

Thu Mar 10, 2022 1:05 am

Thank you everyone for posting about this issue and also for multiple ways around it. I just thoroughly tested this issue and would like to emphasize that three conditions must be in place for the issue to happen:
  • DNS is used as the endpoint peer.
  • Client router reboots.
  • WAN link is disconnected when the router is up, and later it gets reconnected.
All three have been mentioned in the discussion above. In my many tests simply rebooting the router did not cause this issue. I do have keepalive configured, so shortly after the reboot I could see the DNS name appearing in the DNS cache window, and the packets on the WireGuard interface started to flow without any intervention on my part.

This might explain why some people have been using WireGuard for a long time and didn't observe this issue.

Dynamic IP changes without involving reboots would still cause the same issue, so the workaround is still needed.
 
anserk
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Wed Mar 02, 2022 5:08 pm

Re: WireGuard Peer not functioning after a router restart

Tue Mar 15, 2022 4:30 am

Just wanted to share another finding. The Netwatch script actually works perfectly without any permission tweaking. However, Netwatch is only triggered when status changes from up to down or down to up. This is actually a very nice feature, especially for some email alerts as you wouldn't want to get emails every minute when your target is down for a prolonged period of time.

So the Netwatch script fired once, but if there is still a connection issue (in my tests I disabled the remote interface), it will not try again because the status is still down as with the last check. Use a scheduler script instead that will keep trying forever based on the schedule you define.

Who is online

Users browsing this forum: adrianmartin16, infabo, Semrush [Bot], seriosha, thomassocz and 74 guests