Issue with Wireguard client and Dynamic DNS

riyas · 2022-06-15T19:32:15.402Z

I’ve contacted Gl.inet support. According to them, it’s a bug and they’ll contact the R&D team for a fix.

For information, I’ve tried with OpenVPN Client. Openvpn is able to notice the IP change and reconnect automatically after 2 or 3 minutes. So the issue is only with Wireguard.

wcs2228 · 2022-06-15T21:47:45.307Z

Until GL.iNet can provide a permanent fix, you can run the /usr/bin/wireguard_watchdog script every minute in cron:

**no reconnect wireguard client** Technical Support for Routers

Hi, it’s the same problem here. After the wireguard client got disconnected (because of server ip change), it should resolve the name again before trying to reconnect. i feel that this is a bug.

I do not work for and I do not have formal association with GL.iNet

riyas · 2022-06-16T07:52:24.407Z

Hi @wcs2228 I would love to try this solution. In order to run this script, I think I have to run it via SSH. Correct ?

From SSH, I don’t know which command I need to execute to run this script. Do you have any idea ? Thanks.

wcs2228 · 2022-06-16T15:32:47.062Z

You can set up cron to run the script in LuCI:

Go to LuCI → System → Startup and make sure that “cron” Initscript is Enabled. If not, then Enable and Start it.
Go to LuCI → System → Scheduled Tasks, then enter and save the line -
* * * * * /usr/bin/wireguard_watchdog
Go back to LuCI → System → Startup and Restart cron, or just reboot the router

Here is the header comments in the script:

# SPDX-License-Identifier: GPL-2.0
#
# Copyright (C) 2018 Aleksandr V. Piskunov <aleksandr.v.piskunov@gmail.com>.
# Copyright (C) 2015-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
#
# This watchdog script tries to re-resolve hostnames for inactive WireGuard peers.
# Use it for peers with a frequently changing dynamic IP.
# persistent_keepalive must be set, recommended value is 25 seconds.
#
# Run this script from cron every minute:
# echo '* * * * * /usr/bin/wireguard_watchdog' >> /etc/crontabs/root

riyas · 2022-06-16T23:07:36.858Z

@wcs2228 thank you very much. I just configured it. I’ll wait for next ip change to check whether it works or not. Thanks again

alzhao · 2022-06-17T04:11:29.336Z

In the current firmware 3.x, Wireguard does not work with ddns change.

The router can actually deal with ddns change, but unfortunately Wireguard itself does not.

This should be resolved in firmware 4.x because the way we manage Wireguard is changed. Now you can use some watchdog scripts to monitor and reconect.

riyas · 2022-06-17T07:38:08.500Z

Hopefully, this issue with be resolved quickly. For your information, watchdog script also is not really helpful for me. As I told before, sometimes (every 2nd or 3rd reconnections), my opal is stuck with Abort status. Even if I click on Abort and connect again, it won’t go further.

riyas:

I have to delete the profile and recopy the same Wireguard client profile.

So tried the watchdog method suggested by @wcs2228, unfortunately, it was stuck in Abort status. I had to remove and recopy the same profile again.

Do you have any ETA for Firmware 4.x beta ? Apart from this issue, I really like your product. I already bought 4 devices for my family

Thanks

wcs2228 · 2022-06-17T18:12:28.191Z

Since the DNS changes regularly at 23:30, another option is to shut down the router a few minutes before and to start up the router a few minutes afterwards. This can be done with an inexpensive smart plug (e.g., I have a few TP-Link HS103 for $10-$15 each).

WireGuard should reconnect automatically on reboot and hopefully pick up the new DDNS IP address.

riyas · 2022-06-20T10:45:51.484Z

Yes, you are correct. It can be a solution. But in India, they have a regular power failure during the day. They have a power backup system but the modem will lose the connection for 30 seconds. And after 30 seconds, the IP address is changed.

Unfortunately, the best solution for me would be the fix promised by the R&D team. They told me that the ETA is around 10 days. So I am waiting

Thanks again for your help.

Barfoo · 2022-09-03T15:11:48.665Z

Watchdog seems to not work with latest stable. An iOS peer with persistent keepalive config fails to connect. Running the code in CLI gives:
root@GL-AX1800:~# /usr/bin/wireguard_watchdog jsonfilter: unrecognized option: a

Not even a full
/etc/init.d/network restart
works.
I have to power off and on the router, then stop and start the Wireguard server from the glinet UI (not LUCI).
I am behind NAT with DDNS and no issues besides this one.

funfun · 2022-09-11T15:14:39.738Z

Find yourself a copy of reresolve-dns from wireguard-tools and run it every handful of minutes in the Opal. It should fix your problems. Do not wait any longer.

@Barfoo, I believe iOS and persistent keepalive aren’t relevant for @riyas

Barfoo · 2022-09-12T05:52:21.803Z

Hi, do you know where I can find a version of reresolve-dns that works on openwrt? I did found one for Linux
Here
which returns
shopt not found
And I did not find a way to install shopt on openwrt

funfun · 2022-09-12T07:06:54.341Z

The original reresolve-dns is a bash script. I’ve no idea if you can fit bash in the Opal. If you cannot, try to use this openwrt/wireguard_watchdog at master · openwrt/openwrt · GitHub . @alzhao said it doesn’t work and I do remember having to tweak it for it to work in my Beryl, but that was a while ago.

It is anyway pretty straightforward if you know a bit of scripting: check all endpoints that in the configuration are not an IP address and periodically re-resolve them if the last handshake was too long ago (e.g. a minute or two).

Barfoo · 2022-09-12T15:14:32.442Z

Maybe I am a bit naive in thinking Gl-inet could provide a working version since they advertise their products working with Wireguard and ddns at the same time
I cannot write it myself - but I confirm watchdog is not working on glinet, as I wrote in my first post on this thread - while it is reported working on other forums of openwrt.
So maybe the most elegant solution would be for glinet to build something that “makes it work” and ship it with the tools package - so we will be sure to survive upgrades, and work with “standard” Wireguard tools scripts, especially since the new functions of Wireguard that will ship with the next release…

funfun · 2022-09-12T15:20:14.049Z

Yeah, they already acknowledged it has some bugs in 3.x and 4.x will be much better. I was just trying to help you out

wireguard_watchdog should take relatively little to adapt (it is just because Gl-inet implemented Wireguard differently than OpenWRT), but unfortunately I do not have a 3.x version at the moment, so I cannot help you much more…

gb177 · 2022-10-01T03:29:00.708Z

My experience (with 3.215) on a mango router is that wireguard_watchdog doesn’t work. The ubus command in it doesn’t return anything.

The router at that point (when the wireguard connection is down) is unable to even resolve DNS names - presumably since the DNS server at 127.0.0.1 expects to use the tunnel.

Not even manually running wg set wg0 peer ... with the current IP address of the other side works.

Powercycling, or aborting and reconnecting through the web interface works - could anybody share how to find out quickly what commands I need to run in a cronjob to achieve the same effect of abort+reconnecting?

wcs2228 · 2022-10-06T23:16:15.823Z

I have not personally tested this, but you can try running the following in cron:

/etc/init.d/wireguard stop
sleep 5
/etc/init.d/wireguard start

riyas · 2022-11-27T18:29:19.490Z

Hi,

As I couldn’t wait firmware 4.x for Opal, I bought a new Slate AX with version 4.1. But unfortunately the issue is still there even with version 4.1. Do you have any update regarding this bug ?

alzhao · 2022-11-28T01:46:25.940Z

Do you mean when ddns changes IP address, wiregaurd does not reconnect?

riyas · 2022-11-28T08:37:08.558Z

Yes, the issue was there with Opal in version 3.x. You told me that the version 4 is not impacted. So bought a new Slate AXT1800 in version 4.1.0. But if the ip address change at remote server, wireguard doesn’t work anymore. It’s in Abort status.