In some cases, when the router is used as a gateway router for Wireguard and the upstream Wireguard server went down for a while, it can’t connect back even after the upstream Wireguard server went back live even with Persistent Keepalive set, and there’s no way for restarting the Wireguard interface.
When the upstream Wireguard server went down, the interface status becomes inactive and there’s no way for bringing it back active unless the router is restarted.
I’m currently running a self-built VyOS image
Version: VyOS 1.4-rolling-202104240328
Release Train: sagitta
Built by: vyos-buildhub-drone@raphielgang.org
Built on: Sat 24 Apr 2021 03:28 UTC
Build UUID: b21929ce-3e35-4b2a-acd2-7f45fe126109
Build Commit ID: 9e58ff67b5f330
Architecture: x86_64
Boot via: installed image
System type: bare metal
Hardware vendor: Default string
Hardware model: Default string
Hardware S/N: Default string
Hardware UUID: 03000200-0400-0500-0006-000700080009
Copyright: VyOS maintainers and contributors
And here’s my configuration
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
options {
interface wg1 {
adjust-mss 1280
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
wireguard wg1 {
address 172.15.0.3/24
description DO
mtu 1280
peer TO-DO {
address XX.XX.XX.124
allowed-ips 0.0.0.0/0
persistent-keepalive 25
port 51820
pubkey ****************
}
private-key ****************
}
load-balancing {
wan {
flush-connections
interface-health eth2.99 {
failure-count 1
nexthop XX.XX.XX.1
success-count 1
}
interface-health wg1 {
failure-count 1
nexthop XX.XX.XX.1
success-count 1
}
rule 1 {
failover
inbound-interface eth2.20
interface eth2.99 {
weight 1
}
interface wg1 {
weight 2
}
protocol all
}
rule 2 {
failover
inbound-interface eth2.15
interface eth2.99 {
weight 1
}
interface wg1 {
weight 2
}
protocol all
}
}
}
nat {
source {
rule 1 {
outbound-interface eth2.99
translation {
address masquerade
}
}
rule 2 {
description WG-DO
outbound-interface wg1
translation {
address masquerade
}
}
}
}
protocols {
static {
route 0.0.0.0/0 {
next-hop XX.XX.XX.1 {
interface eth2.99
}
}
route XX.XX.XX.7/32 {
next-hop XX.XX.XX.1 {
interface eth2.99
}
}
route XX.XX.XX.124/32 {
next-hop XX.XX.XX.1 {
interface eth2.99
}
}
}
}
service {
dhcp-server {
shared-network-name INT {
subnet 192.168.2.0/24 {
default-router 192.168.2.1
range 0 {
start 192.168.2.10
stop 192.168.2.254
}
}
}
shared-network-name LAN {
subnet 192.168.1.0/24 {
default-router 192.168.1.1
dns-server 192.168.1.1
range 0 {
start 192.168.1.2
stop 192.168.1.254
}
}
}
shared-network-name WLAN {
subnet 10.0.0.0/24 {
default-router 10.0.0.1
dns-server 10.0.0.1
range 0 {
start 10.0.0.5
stop 10.0.0.254
}
}
}
}
lldp {
interface eth2.5 {
}
management-address 192.168.2.1
}
mdns {
repeater {
interface eth2.20
interface eth2.15
}
}
ssh {
port 22
}
}
system {
config-management {
commit-revisions 100
}
console {
device ttyS0 {
speed 115200
}
}
host-name core
login {
user vyos {
authentication {
encrypted-password ****************
plaintext-password ****************
}
}
}
name-server 1.1.1.1
name-server 1.0.0.1
ntp {
server 0.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 2.pool.ntp.org {
}
}
option {
reboot-on-panic
startup-beep
}
sysctl {
custom net.ipv4.tcp_congestion_control {
value bbr
}
custom net.ipv4.tcp_slow_start_after_idle {
value 0
}
}
syslog {
global {
facility all {
level info
}
facility protocols {
level debug
}
}
}
}