* OpenWRT dynamic IP watchdog
@ 2018-06-16 9:27 Aleksandr V. Piskunov
2018-06-16 13:00 ` Jason A. Donenfeld
0 siblings, 1 reply; 3+ messages in thread
From: Aleksandr V. Piskunov @ 2018-06-16 9:27 UTC (permalink / raw)
To: wireguard
I'm using OpenWRT routers to connect several networks (most behind
NAT) to the main one, with a public but dynamic IP. In order to keep
WireGuard connections alive in case of sudden endpoint IP change, some
kind of monitoring is required, so I adapted
https://github.com/WireGuard/WireGuard/blob/master/contrib/examples/reresolve-dns/reresolve-dns.sh
script to the specifics of OpenWRT networking system.
Tested it for a few weeks with a several IP changes, server downtimes,
etc.. seems to be working just fine.
If any OpenWRT wireguard package maintainers are reading this, please
review and consider for pushing to the wireguard-tools(?) package.
#!/bin/sh
# to be called from cron every 1..2 minutes
. /lib/functions.sh
check_peer_activity() {
local cfg=$1
local iface=$2
local public_key
local endpoint_host
local endpoint_port
local persistent_keepalive
local last_handshake
local idle_seconds
config_get public_key "${cfg}" "public_key"
config_get endpoint_host "${cfg}" "endpoint_host"
config_get endpoint_port "${cfg}" "endpoint_port"
config_get persistent_keepalive "${cfg}" "persistent_keepalive"
# only process peers with endpoints and keepalive set
[ -z ${endpoint_host} ] && return 0;
[ -z ${persistent_keepalive} ] && return 0;
# resolve endpoint and reconnect if not responding for too long
last_handshake=`wg show ${iface} latest-handshakes | grep
${public_key} | awk '{print $2}'`
[ -z ${last_handshake} ] && return 0;
idle_seconds=$((`date +%s`-${last_handshake}))
[ ${idle_seconds} -lt 150 ] && return 0;
logger -t "wireguard_monitor" "${iface} endpoint
${endpoint_host}:${endpoint_port} is not responding for
${idle_seconds} seconds, trying to reconnect"
wg set ${iface} peer ${public_key} endpoint
"${endpoint_host}:${endpoint_port}"
}
# query ubus for all active wireguard interfaces
wg_ifaces=`ubus -S call network.interface dump | jsonfilter -e
'@.interface[@.up=true]' | jsonfilter -a -e
'@[@.proto="wireguard"].interface' | tr "\n" " "`
# check every peer in every active wireguard interface
config_load network
for iface in $wg_ifaces; do
config_foreach check_peer_activity "wireguard_${iface}" "${iface}"
done
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: OpenWRT dynamic IP watchdog
2018-06-16 9:27 OpenWRT dynamic IP watchdog Aleksandr V. Piskunov
@ 2018-06-16 13:00 ` Jason A. Donenfeld
2018-06-16 14:50 ` Aleksandr V. Piskunov
0 siblings, 1 reply; 3+ messages in thread
From: Jason A. Donenfeld @ 2018-06-16 13:00 UTC (permalink / raw)
To: aleksandr.v.piskunov; +Cc: WireGuard mailing list
Hi Aleksandr,
Nice script. One question:
> [ ${idle_seconds} -lt 150 ] && return 0;
Is there a reason why you went with 150? My original reresolve-dns.sh
went with 135 (REKEY_AFTER_TIME + KEEPALIVE_TIMEOUT + REKEY_TIMEOUT).
Did you find 150 matched network conditions better?
Regards,
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: OpenWRT dynamic IP watchdog
2018-06-16 13:00 ` Jason A. Donenfeld
@ 2018-06-16 14:50 ` Aleksandr V. Piskunov
0 siblings, 0 replies; 3+ messages in thread
From: Aleksandr V. Piskunov @ 2018-06-16 14:50 UTC (permalink / raw)
To: WireGuard mailing list
Yes, I've tried 135 first, but during the real usage there were quite
a few false alarm situations with watchdog reconnecting at
136..~140 seconds. So.. changed it to 150 secs, which seems to work OK
for my conditions.
I can try to send a git patch to contrib/examples/reresolve-dns,
if rest is OK.
Regards,
Aleksandr
On Sat, Jun 16, 2018 at 03:00:45PM +0200, Jason A. Donenfeld wrote:
> Hi Aleksandr,
>
> Nice script. One question:
>
> > [ ${idle_seconds} -lt 150 ] && return 0;
>
> Is there a reason why you went with 150? My original reresolve-dns.sh
> went with 135 (REKEY_AFTER_TIME + KEEPALIVE_TIMEOUT + REKEY_TIMEOUT).
> Did you find 150 matched network conditions better?
>
> Regards,
> Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-06-16 14:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-16 9:27 OpenWRT dynamic IP watchdog Aleksandr V. Piskunov
2018-06-16 13:00 ` Jason A. Donenfeld
2018-06-16 14:50 ` Aleksandr V. Piskunov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).