From: "Aleksandr V. Piskunov" <aleksandr.v.piskunov@gmail.com>
To: wireguard@lists.zx2c4.com
Subject: OpenWRT dynamic IP watchdog
Date: Sat, 16 Jun 2018 12:27:12 +0300 [thread overview]
Message-ID: <CACsX8BiJJyTc8kS-_u4eMrDLgyOoNxKvhFL8YF1M2mnkKBOxTg@mail.gmail.com> (raw)
I'm using OpenWRT routers to connect several networks (most behind
NAT) to the main one, with a public but dynamic IP. In order to keep
WireGuard connections alive in case of sudden endpoint IP change, some
kind of monitoring is required, so I adapted
https://github.com/WireGuard/WireGuard/blob/master/contrib/examples/reresolve-dns/reresolve-dns.sh
script to the specifics of OpenWRT networking system.
Tested it for a few weeks with a several IP changes, server downtimes,
etc.. seems to be working just fine.
If any OpenWRT wireguard package maintainers are reading this, please
review and consider for pushing to the wireguard-tools(?) package.
#!/bin/sh
# to be called from cron every 1..2 minutes
. /lib/functions.sh
check_peer_activity() {
local cfg=$1
local iface=$2
local public_key
local endpoint_host
local endpoint_port
local persistent_keepalive
local last_handshake
local idle_seconds
config_get public_key "${cfg}" "public_key"
config_get endpoint_host "${cfg}" "endpoint_host"
config_get endpoint_port "${cfg}" "endpoint_port"
config_get persistent_keepalive "${cfg}" "persistent_keepalive"
# only process peers with endpoints and keepalive set
[ -z ${endpoint_host} ] && return 0;
[ -z ${persistent_keepalive} ] && return 0;
# resolve endpoint and reconnect if not responding for too long
last_handshake=`wg show ${iface} latest-handshakes | grep
${public_key} | awk '{print $2}'`
[ -z ${last_handshake} ] && return 0;
idle_seconds=$((`date +%s`-${last_handshake}))
[ ${idle_seconds} -lt 150 ] && return 0;
logger -t "wireguard_monitor" "${iface} endpoint
${endpoint_host}:${endpoint_port} is not responding for
${idle_seconds} seconds, trying to reconnect"
wg set ${iface} peer ${public_key} endpoint
"${endpoint_host}:${endpoint_port}"
}
# query ubus for all active wireguard interfaces
wg_ifaces=`ubus -S call network.interface dump | jsonfilter -e
'@.interface[@.up=true]' | jsonfilter -a -e
'@[@.proto="wireguard"].interface' | tr "\n" " "`
# check every peer in every active wireguard interface
config_load network
for iface in $wg_ifaces; do
config_foreach check_peer_activity "wireguard_${iface}" "${iface}"
done
next reply other threads:[~2018-06-16 9:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-16 9:27 Aleksandr V. Piskunov [this message]
2018-06-16 13:00 ` Jason A. Donenfeld
2018-06-16 14:50 ` Aleksandr V. Piskunov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CACsX8BiJJyTc8kS-_u4eMrDLgyOoNxKvhFL8YF1M2mnkKBOxTg@mail.gmail.com \
--to=aleksandr.v.piskunov@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).