wireguard won't connect [solved]

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

I have three remote machines connecting to my server via wireguard. After an update (not sure what caused this issue) they all quit talking to wireguard. Two of them after a reboot resumed their happy participation in wireguard, but the third one did not.

So this means: My server keys are OK, my server connection is OK, firewall, ports, everything OK, it's ready to accept connections.

The misconfig must be on the client side. But where?

I turned on debug info with

pietinger · Posted: Sun Dec 03, 2023 9:37 pm Post subject:

With what you have written, my first question would be: WHICH machines have been updated ? Server or the three machines (or all 4) ?

And my second question: WHAT was updated ? Kernel or world (or both) ?

IF "world" which applications ?

IF kernel: Have you checked the .config of the three clients against each other ?
_________________
https://wiki.gentoo.org/wiki/User:Pietinger

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

Interesting that of the two machines where wg is still working, one doesn't have kde installed (it is headless) and the other didn't undergo the latest update of kde-frameworks from a few days ago. We'll see if that changes anything. Why would that make a difference? who knows.

[update] kde-frameworks (and everything) updated on the *working* client. Still works.
[update2] everything else on that machine works, just not wg. So I went back (for the moment) to mounting samba over an ssh reverse tunnel, this works perfectly, as it did before. I'll bet that if I make a reverse tunnel for nfs, that will work too.

So I'm not impressed for the moment with my ability to debug wireguard. Or wireguard's amenability to being debugged. Samba is a nightmare to get working at all times, it has misleading and infuriating error messages (such as my favorite: "Unknown Error"). Ssh is way too much like a swiss army knife, it should not be acting like a router or a jump host. It should be telnet plus encryption, but thank heaven for it is all I can say. It *works*!

Of course I'm experiencing this issue while I'm in the countdown to a major deadline plus travel. I won't be able to debug it any more until possibly January. -j

pietinger · Posted: Tue Dec 05, 2023 1:41 pm Post subject:

jesnow,

I dont think that kde has an influence to your wg problem. So, if server and two clients are working, only this 3rd client has a problem. If there was no kernel change (config+version) - because it was "only" a world update - then it would be very interesting what was updated on this client ... glibc ?

Do you have some error log entries in dmesg on this client ?

Usually a world update does not change any configuration ... so maybe you have a problem with an executable binary ... maybe think about rebuilding everything with

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

Thanks! It's going to turn out to be something stupid. I just know it. I'm back in business now using an ssh tunnel temporarily.

Here's the formerly working setup on the broken client (vanaert):

pietinger · Posted: Tue Dec 05, 2023 2:42 pm Post subject:

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

I checked: that ain't it. (Pardon the pun). They do have policies for weird internet behavior, but they will shut down a MAC address completely, not turn off a port.

Both clients have in /usr/src/linux/.config:

pietinger · Posted: Tue Dec 05, 2023 11:29 pm Post subject:

For wireguard you need much more in the kernel. Please see my post in:
https://forums.gentoo.org/viewtopic-t-1166229-highlight-.html
_________________
https://wiki.gentoo.org/wiki/User:Pietinger

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

I had a month of professional travel, and over Christmas they took the power down for a week, rebooting the entire network. It was a mess. And when everything came back up, none of the machines reconnected -- a separate issue.

So once I got in and restarted networking and wireguard on all three machines, everything worked perfectly as before all this craziness. I had not changed the wg keys, or changed any kernel settings. It all just worked for no good reason. Very dissatisfying, but nothing I can do about that now.

So that's that.

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

I finally solved this problem. net-vpn/wireguard-tools is installed for only the current kernel. It must be reinstalled for any new kernels. Unloading and reloading the modules doesn't seem to be enough, it requires a reboot.

Cheers,
Jon.

pietinger · Posted: Wed Feb 07, 2024 10:17 pm Post subject:

I can't believe that the cause was the wireguard-tools (because they only contain user space programs and the current version 1.0.20210424 has not been updated for a long time). But I have seen the new thread and will follow it with interest.

Cheers,
Peter
_________________
https://wiki.gentoo.org/wiki/User:Pietinger

jesnow · l33t Joined: 26 Apr 2006 Posts: 856

I'll comment on the newer thread. Short answer, I think it's a component of the install that does the needed thing, which could also be done by hand. The standard solution is to regenerate all the keys, which works, but is also not the problem.