I’ve noticed the following issue with Wireguard VPN. Have a fully working tunnel to an end point. If there is a power failure and the router restarts the tunnel doesn’t reestablish. You have to manually enter the admin interface and save/apply the working configuration.
Hello,
Use /usr/bin/wireguard_watchdog with cron to work around this issue.
Look at the content of the file for the howto.
Regards,
Thanks! I’ll check it out
Found the file wireguard_watchdog file but not too familiar with crontab. Checked the wiki but when running ‘crontab -l’ I get an empty response. I assumed it would at least contain the auto reboot entry. Would you please supply an example on how to enable cron for the wireguard_watchdog?
# crontab -l
* * * * * /usr/bin/wireguard_watchdog
Create a file containing the line above then execute:
crontab -e < your-cron-file
Thanks! ‘crontab -e < file’ didn’t work for me. Ran ‘crontab -e’ and entered the command manually in the editor. Works hopefully.
Oops the command should be crontab -e - < file
Sorry for the typo.
Greetings,
Thanks for reaching out and for sharing the details.
This issue was addressed in the 07.21 firmware update. I’ve also tested this behavior on 07.24.3, and after rebooting both ends of the WireGuard tunnel, the connection came back up successfully without any manual action being required.
Could you please let us know which device you’re using and what firmware version is currently installed?
We’d recommend updating to the latest available firmware and checking if the issue still occurs.
If you’re already running the latest firmware and are still experiencing this behavior, let us know and we’ll be happy to look into it further.
Best regards,
T.
The router is a RUTX11 and when I identified the issue the device ran on firmware version 07.24.1. I’ve since upgraded to the most recent version. After implemented the cron script all was well, using the older firmware version. I see no reason to remove it as it is.
Thank you for providing the additional information and for bringing this to our attention.
We will investigate this further on our side to better understand the behavior and determine whether any additional action is required.
We appreciate you taking the time to report your findings.
Best regards,
T.
Unfortunately I still have problems with this. Don’t know the cause but the connection went down and didn’t reappeared until I power cycled the router.
Next time this happens, coul you execute the command “wg” and post the results ? (hide the keys of course).
Do you force the DNS resolutions to go through the tunnel ?
Comment based on RutOS 07.25.1 running on a RUTX …
For several previous firmware versions, there has been no need to manually configure WireGuard Watchdog in cron, as it will automatically startup. The following conditions need to be met before everything starts up OK and the WatchDog functions as intended:
- the Peer ‘Endpoint address’ must be an FQDN, NOT an IP (this is my interpretation of the script, so may need a second pair of eyes)
- the ‘Persistant keep alive’ must be set e.g. 25 or whatever value you choose
- the ‘Watchdog interval’ should be set. I know it says that if left ‘blank’, the tunnel will be checked every minute, but there have been reports that it fails, if there is no value. For this reason, I always give it a value e.g. 1
When you start the tunnel, you will see in the file /etc/crontabs/wireguard an entry …
* * * * * /usr/bin/wireguard_watchdog
When the tunnel is stopped, the entry in /etc/crontabs/wireguard is removed.
When functioning correctly and the conditions above are met, the WatchDog will monitor the tunnel and try to re-resolve hostnames for inactive WireGuard peers. Should a peer seem to be inactive, then the script will continue to poll at 1-minute intervals. If after polling, a peer doesn’t respond after a set threshold (150 seconds), the tunnel interface is restarted using ‘ifup ’. If this is unsuccessful, then it will call the same command, at 1-minute intervals. Again, this is my interpretation of the script, so may need a second pair of eyes.
BUT …
I’ve just spun up a tunnel on a RUTX50 firmware 07.25.1, and I see in the System Logs …
1008 Mon Sep 14 17:05:00 2026 cron.err crond[5692]: USER wireguard pid 23076 cmd /usr/bin/wireguard_watchdog
1009 Mon Sep 14 17:05:00 2026 daemon.err ubusd: Failed getgrgid(): Permission denied
… and this repeats everytime the WatchDog runs (every minute in my example). So there seems to be a permissions problem in RutOS, introduced in a more recent firmware version.
The tunnel spins up OK but the system logs indicate a possible problem with running the WatchDog, due to permissions.
One for a Teltonika response maybe?