From: Kalin KOZHUHAROV <me.kalin@gmail.com>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: [WireGuard] What is a good way to ingrate (as of now) wireguard into openrc in Gentoo?
Date: Mon, 21 Nov 2016 14:15:17 +0900 [thread overview]
Message-ID: <CAKXLc7fQmf=LVrkJ3C5XAYRdimjxNT=xGey9W+qivqLpV+XO7A@mail.gmail.com> (raw)
In-Reply-To: <CAHmME9rfB709DCnqiXG2L7kMwCx0bgiSXi2C2LwYR=bX-trNzw@mail.gmail.com>
Hello Jason,
Thanks for the answer!
On Sat, Nov 19, 2016 at 10:14 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> Funny enough, I can't remember the exact interworkings of that script,
> because I didn't write it. A guy named zhasha in #wireguard did. I'll
> ask him to document it; that could be useful. I know another gentoo
> dev was working on a WireGuard gentoo page for the wiki.
>
I tested a few things, it is almost working.
So, I needed to save a running config (`wg showconf wg0
>/etc/wireguard/wg0.conf`), then put this in `/etc/conf.d/net`:
config_wg0="192.168.13.12/24"
wireguard_wg0="/etc/wireguard/wg0.conf"
Finally, symlink to net.lo:
ln -nfs net.lo /etc/init.d/net.wg0
Then `/etc/init.d/net.wg0 start` and `/etc/init.d/net.wg0 stop` work
as expected.
EDIT: Add this to /etc/rc.conf to make things run smoothly:
rc_hotplug="!net.wg?"
However `/etc/init.d/net.wg0 restart` sometimes fails silently...
I am trying to reproduce it, but cannot get the pattern of failures.
It outputs all fine to the console, but there is no actual interface created...
$ /etc/init.d/net.wg0 restart
* /etc/init.d/net.wg0 uses runscript, please convert to openrc-run.
* Bringing down interface wg0
* Removing WireGuard interface wg0 ...
[ ok ]
* Bringing up interface wg0
* Creating WireGuard interface wg0 ...
[ ok ]
* Configuring WireGuard interface wg0 ...
[ ok ]
* 192.168.13.12/24 ...
[ ok ]
$ ip l show dev wg0
Device "wg0" does not exist.
# NOT WORKING!
$ /etc/init.d/net.wg0 start
* /etc/init.d/net.wg0 uses runscript, please convert to openrc-run.
* WARNING: net.wg0 has already started, but is inactive
$ /etc/init.d/net.wg0 zap
* /etc/init.d/net.wg0 uses runscript, please convert to openrc-run.
* Manually resetting net.wg0 to stopped state
$ /etc/init.d/net.wg0 start
* /etc/init.d/net.wg0 uses runscript, please convert to openrc-run.
* Bringing up interface wg0
* Creating WireGuard interface wg0 ...
[ ok ]
* Configuring WireGuard interface wg0 ...
[ ok ]
* 192.168.13.12/24 ...
[ ok ]
$ ip l show dev wg0
34: wg0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1423 qdisc
noqueue state UNKNOWN mode DEFAULT group default qlen 1
link/void
# WORKING
$ /etc/init.d/net.wg0 restart
* /etc/init.d/net.wg0 uses runscript, please convert to openrc-run.
* Bringing down interface wg0
* Removing WireGuard interface wg0 ...
* Bringing up interface wg0
* Creating WireGuard interface wg0 ...
[ ok ]
* Configuring WireGuard interface wg0 ...
[ ok ]
* 192.168.13.12/24 ...
[ ok ]
$ ip l show dev wg0
36: wg0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1423 qdisc
noqueue state UNKNOWN mode DEFAULT group default qlen 1
link/void
I tried to debug a few things and my observation is that "sometimes",
interface is reappearing after `ip link delete dev wg0`...
Any ideas? I thought am not running any automagic daemons (systemd,
networkmanager, etc.).
But... there is some systemd code lurking may be.
Anyway, I added it to be NOT hotplugged:
$ grep wg /etc/rc.conf
rc_hotplug="pcscd !net.wg?"
And it seems to work! Otherwise the interface gets marked as
hotpluggable and is being recreated/killed (see the first number on
`ip link show dev wg0` constantly growing)
> In other words, if the argument is a file path, it is passed to
> setconf, and otherwise they're passed to set. You can then use the
> other ordinary netifrc values for setting the IP addresses.
>
yep, apparently!
> A somewhat reasonable place to store config files would be in
> /etc/wireguard, and make sure that directory is chmod'd to 700, since
> it contains private keys.
>
Yes, I am glad I guessed this settings, before your mail!
Cheers,
Kalin.
next prev parent reply other threads:[~2016-11-21 5:12 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-18 11:42 Kalin KOZHUHAROV
2016-11-19 1:14 ` Jason A. Donenfeld
2016-11-21 5:15 ` Kalin KOZHUHAROV [this message]
2016-11-21 14:06 ` Joakim Sindholt
2016-11-21 13:55 ` Joakim Sindholt
2016-11-21 17:00 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKXLc7fQmf=LVrkJ3C5XAYRdimjxNT=xGey9W+qivqLpV+XO7A@mail.gmail.com' \
--to=me.kalin@gmail.com \
--cc=Jason@zx2c4.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).