Development discussion of WireGuard
 help / color / mirror / Atom feed
* lost connection on dynamic IP
@ 2021-05-18 11:22 Vicente Bergas
  2021-05-19 18:43 ` Roman Mamedov
  0 siblings, 1 reply; 7+ messages in thread
From: Vicente Bergas @ 2021-05-18 11:22 UTC (permalink / raw)
  To: wireguard

Hi, i've got the following setup:
A server connected to the Internet through an ISP that provides a
dynamic IP with NAT.
The server keeps the DNS updated with https://github.com/troglobit/inadyn
A client on a tiny embedded board connects to the server by means of
its domain name.
Wireguard configurations are:
# server/etc/wireguard/wg0.conf
[Interface]
ListenPort = port_number
PrivateKey = ...
[Peer]
PublicKey = ...
PresharedKey = ...
PersistentKeepalive = 25
AllowedIPs = 10.0.0.2

# client/etc/wireguard/wg0.conf
[Interface]
PrivateKey = ...
[Peer]
PublicKey = ...
PresharedKey = ...
Endpoint = domain.name.that.resolves.to.a.dynamic.ip:port_number
PersistentKeepalive = 25
AllowedIPs = 10.0.0.1

The server almost never initiates comunications towards the client.
The client sends one packet every minute towards the server.

I think the issue happens when the ISP on the server side shuts down
the Internet connection for more than 1 hour! Then, it is restored
with a new IP.
inadyn detects the new IP and updates the DNS.
At this point the Internet connection is operational again, but the
client remains disconnected until rebooted.

Is this scenario expected to work due to the "Built-in Roaming" ?

Regards,
  Vicenç.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: lost connection on dynamic IP
  2021-05-18 11:22 lost connection on dynamic IP Vicente Bergas
@ 2021-05-19 18:43 ` Roman Mamedov
  2021-05-19 22:28   ` Vicente Bergas
  0 siblings, 1 reply; 7+ messages in thread
From: Roman Mamedov @ 2021-05-19 18:43 UTC (permalink / raw)
  To: Vicente Bergas; +Cc: wireguard

On Tue, 18 May 2021 13:22:31 +0200
Vicente Bergas <vicencb@gmail.com> wrote:

> A server connected to the Internet through an ISP that provides a
> dynamic IP with NAT.

If it's NAT, then your server has no dedicated public IP? What do you update
to DNS, IP of the ISP's NAT pool (shared IP with many other customers)?

> I think the issue happens when the ISP on the server side shuts down
> the Internet connection for more than 1 hour! Then, it is restored
> with a new IP.
> inadyn detects the new IP and updates the DNS.
> At this point the Internet connection is operational again, but the
> client remains disconnected until rebooted.
>
> Is this scenario expected to work due to the "Built-in Roaming" ?

It might work, helped by PersistentKeepalive, and as long as the server and the
client don't change their IPs/ports *at the same time*. To protect against
that, or to improve resiliency in general (and assuming there's actually no NAT
at the server side after all), your client should resolve the DNS record for
the server periodically, and in case the IP changed, call "wg set [interface]
peer [key] endpoint [IP:port]".

-- 
With respect,
Roman

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: lost connection on dynamic IP
  2021-05-19 18:43 ` Roman Mamedov
@ 2021-05-19 22:28   ` Vicente Bergas
  2021-05-20  6:15     ` Roman Mamedov
  0 siblings, 1 reply; 7+ messages in thread
From: Vicente Bergas @ 2021-05-19 22:28 UTC (permalink / raw)
  To: Roman Mamedov; +Cc: wireguard

Hello Roman,

On Wed, May 19, 2021 at 8:43 PM Roman Mamedov <rm@romanrm.net> wrote:
>
> On Tue, 18 May 2021 13:22:31 +0200
> Vicente Bergas <vicencb@gmail.com> wrote:
>
> > A server connected to the Internet through an ISP that provides a
> > dynamic IP with NAT.
>
> If it's NAT, then your server has no dedicated public IP? What do you update
> to DNS, IP of the ISP's NAT pool (shared IP with many other customers)?

There is a public IP assigned to the router. The IP is dynamic, so, it
can change from time to time, but, once assigned, it is exclusive to
the router.
There is no carrier-grade NAT.
I've configured the router to forward the wireguard port to the
server, so, it is like the server is directly connected to the
Internet.
I think the PersistentKeepalive on the server side is not required. Is it?

On the client side, instead, the router has no port forwarded and
also, i think, there is CGNAT. That is the reason PersistentKeepalive
is present.

> > I think the issue happens when the ISP on the server side shuts down
> > the Internet connection for more than 1 hour! Then, it is restored
> > with a new IP.
> > inadyn detects the new IP and updates the DNS.
> > At this point the Internet connection is operational again, but the
> > client remains disconnected until rebooted.
> >
> > Is this scenario expected to work due to the "Built-in Roaming" ?
>
> It might work, helped by PersistentKeepalive, and as long as the server and the
> client don't change their IPs/ports *at the same time*. To protect against
> that, or to improve resiliency in general (and assuming there's actually no NAT
> at the server side after all), your client should resolve the DNS record for
> the server periodically, and in case the IP changed, call "wg set [interface]
> peer [key] endpoint [IP:port]".

So, what do you mean is that wireguard does a single DNS resolution at
the beginning and further DNS resolutions need to be done elsewere. Is
that correct?

> With respect,
> Roman

Regards,
  Vicenç.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: lost connection on dynamic IP
  2021-05-19 22:28   ` Vicente Bergas
@ 2021-05-20  6:15     ` Roman Mamedov
  2021-05-20 16:20       ` Roman Mamedov
  0 siblings, 1 reply; 7+ messages in thread
From: Roman Mamedov @ 2021-05-20  6:15 UTC (permalink / raw)
  To: Vicente Bergas; +Cc: wireguard

On Thu, 20 May 2021 00:28:08 +0200
Vicente Bergas <vicencb@gmail.com> wrote:

> There is a public IP assigned to the router. The IP is dynamic, so, it
> can change from time to time, but, once assigned, it is exclusive to
> the router.
> There is no carrier-grade NAT.
> I've configured the router to forward the wireguard port to the
> server, so, it is like the server is directly connected to the
> Internet.
> I think the PersistentKeepalive on the server side is not required. Is it?

I believe it is. Consider the server public IP has changed. The server sends
no Keepalives. The client sends them to the server's old IP. The whole thing
broke.

> So, what do you mean is that wireguard does a single DNS resolution at
> the beginning and further DNS resolutions need to be done elsewere. Is
> that correct?

Yes.

-- 
With respect,
Roman

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: lost connection on dynamic IP
  2021-05-20  6:15     ` Roman Mamedov
@ 2021-05-20 16:20       ` Roman Mamedov
  2021-05-20 19:23         ` Max Schulze
  0 siblings, 1 reply; 7+ messages in thread
From: Roman Mamedov @ 2021-05-20 16:20 UTC (permalink / raw)
  To: Vicente Bergas; +Cc: wireguard

On Thu, 20 May 2021 11:15:30 +0500
Roman Mamedov <rm@romanrm.net> wrote:

> > So, what do you mean is that wireguard does a single DNS resolution at
> > the beginning and further DNS resolutions need to be done elsewere. Is
> > that correct?
> 
> Yes.

I also remembered a case where just PersistentKeepalive won't save you, and
periodic DNS resolution on clients becomes mandatory. It is when the server's
physical location gets a power cut. On new boot-up (and router power-on) it
gets a new IP from the ISP, and has no idea where all the clients are. The
communication is broken until clients recheck the DNS record and update the
server's endpoint from that. WG does not do this on its own.

-- 
With respect,
Roman

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: lost connection on dynamic IP
  2021-05-20 16:20       ` Roman Mamedov
@ 2021-05-20 19:23         ` Max Schulze
  2021-05-23 11:44           ` Vicente Bergas
  0 siblings, 1 reply; 7+ messages in thread
From: Max Schulze @ 2021-05-20 19:23 UTC (permalink / raw)
  To: Roman Mamedov, Vicente Bergas; +Cc: wireguard


On 20.05.21 18:20, Roman Mamedov wrote:
> On Thu, 20 May 2021 11:15:30 +0500
> Roman Mamedov <rm@romanrm.net> wrote:
>
>>> So, what do you mean is that wireguard does a single DNS resolution at
>>> the beginning and further DNS resolutions need to be done elsewere. Is
>>> that correct?
>> Yes.
> I also remembered a case where just PersistentKeepalive won't save you, and
> periodic DNS resolution on clients becomes mandatory. It is when the server's
> physical location gets a power cut. On new boot-up (and router power-on) it
> gets a new IP from the ISP, and has no idea where all the clients are. The
> communication is broken until clients recheck the DNS record and update the
> server's endpoint from that. WG does not do this on its own.
>

Just to point out what 'others are doing' - openwrt has a watchdog 
script [1] that might be run with cron every 15 mins


*/15 * * * * /usr/bin/wireguard_watchdog


which will update the new endpoint if the last handshake is too old:

wg set ${iface} peer ${public_key} endpoint 
"${endpoint_host}:${endpoint_port}"


It needs PersistenKeepalive also, if i understand correctly.

[1] 
https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/network/utils/wireguard-tools/files/wireguard_watchdog;hb=HEAD


--

Max


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: lost connection on dynamic IP
  2021-05-20 19:23         ` Max Schulze
@ 2021-05-23 11:44           ` Vicente Bergas
  0 siblings, 0 replies; 7+ messages in thread
From: Vicente Bergas @ 2021-05-23 11:44 UTC (permalink / raw)
  To: Max Schulze; +Cc: Roman Mamedov, wireguard

On Thu, May 20, 2021 at 9:23 PM Max Schulze <max.schulze@online.de> wrote:
> On 20.05.21 18:20, Roman Mamedov wrote:
> > On Thu, 20 May 2021 11:15:30 +0500
> > Roman Mamedov <rm@romanrm.net> wrote:
> >
> >>> So, what do you mean is that wireguard does a single DNS resolution at
> >>> the beginning and further DNS resolutions need to be done elsewere. Is
> >>> that correct?
> >> Yes.
> Just to point out what 'others are doing' - openwrt has a watchdog
> script [1] that might be run with cron every 15 mins
>
> */15 * * * * /usr/bin/wireguard_watchdog
>
> which will update the new endpoint if the last handshake is too old:
>
> wg set ${iface} peer ${public_key} endpoint
> "${endpoint_host}:${endpoint_port}"
>
> It needs PersistenKeepalive also, if i understand correctly.
>
> [1]
> https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/network/utils/wireguard-tools/files/wireguard_watchdog;hb=HEAD
>
> --
>
> Max

Hello, i've been running this script on a setup with a wg interface
with a single peer:
while true ; do
  sleep 300
  curr=$(date +%s)
  prev=$(wg show wg0 latest-handshakes | cut -f2)
  elapsed=$(( ${curr} - ${prev} ))
  [ ${elapsed} -ge 300 ] && wg syncconf wg0 /etc/wireguard/wg0.conf
done
on the client side for 3 days and the issue occurred once again.
This time the connection was restablished automatically and no manual
intervention was required.
Thank you Max and Roman.

Regards,
  Vicenç.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-05-23 11:45 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-18 11:22 lost connection on dynamic IP Vicente Bergas
2021-05-19 18:43 ` Roman Mamedov
2021-05-19 22:28   ` Vicente Bergas
2021-05-20  6:15     ` Roman Mamedov
2021-05-20 16:20       ` Roman Mamedov
2021-05-20 19:23         ` Max Schulze
2021-05-23 11:44           ` Vicente Bergas

Development discussion of WireGuard

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.vuxu.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ http://inbox.vuxu.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git