Wireguard - changes the default route although not configured

Quote from chewitt

Having done a bit more reading I have a suspicion we need to start using systemd to handle NTP as this adds a new systemd .target for when the initial NTP sync has completed, which would be useful in this scenario.

Or conman start to support /run/systemd/timesync/synchonized for reliability ...

On RPIs (or any other devices without RTC) time-sync.target already may work today. Start enabling the needed service:

systemctl enable systemd-time-wait-sync

Reboot a few times and check:

systemctl status systemd-time-wait-sync
systemctl status time-sync.target

If time-sync.target is always reached the dependency can be added to the wireguard unit.

chewitt systemd-time-wait-sync does hang randomly on Generic because ntp slew adjusts are not detected. There has to be a jump adjust in the beginning (only be used if the time error is >0.5sec).

Assuming the initial RTC value is always "good enough" we can disable systemd-time-wait-sync on this platform with a drop-in file:

[Unit]
ConditionArchitecture=!x86-64

As far as I understand, the suggested solution needs a specific service (such as ethernet) that can be used as "move-after" target. But what happens if the ethernet cable is unplugged and the device is using wifi to access the internet? Is there a solution that works for both wifi and cable?

I tried to make it a bit more resilient to changes and different scenarios.

I found it to be not reliable when started through systemd. therefore i used autoexec.py in /storage/.kodi/userdata/autoexec.py with the following content:

from subprocess import call
call("/storage/connect_vpn.sh")

And for the actual connection if have this in /storage/connect_vpn.sh:

#!/bin/bash
VPN=`connmanctl vpnconnections | awk '{print $NF}'`
if route -n | grep wg0 >/dev/null; then 
        connmanctl disconnect $VPN
        sleep 2s
fi
if [[ ! -z $1 ]] && [[ $1 == "stop" ]]; then
        exit 0;
fi
LIF=`route -n | grep ^0.0.0.0 | awk '{print $NF}'`
OR=`route -n | grep ^0.0.0.0 | awk '{print $2}'`
if [[ ! -z "$OR" ]]; then
        LIFT="wifi";
        if [[ "$LIF" == "eth0" ]]; then
                LIFT="cable";
        fi
        LOC=`connmanctl services | grep '^\*' | grep $LIFT | awk '{print $NF}'`
        connmanctl connect $VPN
        sleep 2s
        connmanctl move-after $VPN $LOC
        #sometimes it just reset VPN.. we keep trying... and trying...
        while true; do
                GIF=`route -n | grep ^0.0.0.0 | awk '{print $NF}'`
                if [[ $GIF == "wg0" ]]; then
                        connmanctl move-after $VPN $LOC
                else
                        sleep 5s
                fi
        done
fi

Hth. A fix in connman would certainly be nicer!

This is quite hard to use reliably. Even with nativemad's script when I'm trying to connect to my rpi from an external network using the external ip (not through wireguard), I have multiple "connmanctl move-after" commands every five seconds. This makes the connection really unstable.

On a different but related note, I've also tried using a docker container as a wireguard client (since it works very well for a wireguard server), but apparently LibreElec doesn't include the iptables_raw kernel module so it's not possible to set AllowedIps as 0.0.0.0/0.

I'm not really good with networking, but is there any way to actually load this module, or to force the metric of the vpn as really high so the route will have a low priority? I'm kind of stuck here.

Edit: In the end I just configured wireguard manually with wg. Not ideal but it works...

After a few days I managed to solve default route issue. Below there are my scripts with descriptions.

WG configuration:

/storage/.config/wireguard/wg0.conf

[Interface]
ListenPort = <port>
PrivateKey = <privkey>

[Peer]
PublicKey = <publkey>
AllowedIPs = 0.0.0.0/0
Endpoint = <endpoint hostname>:<port>

Wireguard startup script:

/storage/.config/wgconnect.sh

#!/bin/bash

ip link add dev wg0 type wireguard
ip address add dev wg0 10.0.0.2/24
wg setconf wg0 /storage/.config/wireguard/wg0.conf
ip link set up dev wg0

sleep 5

ip route flush 0.0.0.0/1
ip route flush 128.0.0.0/1
ip route add <first ip which should be routed> via 10.0.0.1
ip route add <second ip which should be routed> via 10.0.0.1
ip route add <third ip which should be routed> via 10.0.0.1

Stop Wireguard connection:

/storage/.config/wgdisconnect.sh

#!/bin/bash
ip link set down dev wg0

Systemd service:

/storage/.config/system.d/wireguard.service

[Unit]
Description=WireGuard VPN Service
After=network-online.target nss-lookup.target connman-vpn.service time-sync.target
Wants=network-online.target nss-lookup.target connman-vpn.service time-sync.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sleep 5

ExecStart=/storage/.config/wgconnect.sh
ExecStop=/storage/.config/wgdisconnect.sh

[Install]
WantedBy=multi-user.target

Then all traffic routes via default eth0 interface and several ip's via wg0. Routes look as follows:

$ ip route

default via 192.168.1.1 dev eth0 
10.0.0.0/24 dev wg0 scope link  src 10.0.0.2 
62.179.1.62 via 192.168.1.1 dev eth0 
62.179.1.63 via 192.168.1.1 dev eth0 
<first routed ip> via 10.0.0.1 dev wg0 
192.168.1.0/24 dev eth0 scope link  src 192.168.1.19 
192.168.1.1 dev eth0 scope link 
<second routed ip> via 10.0.0.1 dev wg0 
<third routed ip> via 10.0.0.1 dev wg0

At least, it works for me.

In case anyone else is looking for a solution. I got this working to add a network "lock" with iptables to ensure all non-LAN internet traffic goes over wireguard by adding the following in /storage/.config/iptables/rules.v4

*filter
:INPUT DROP [12:909]
:FORWARD ACCEPT [0:0]
:OUTPUT DROP [0:0]
-A INPUT -s 192.168.0.0/16 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i wg0 -j ACCEPT
-A INPUT -s WG_CONFIG_IP/32 -j ACCEPT
-A INPUT -p udp -m udp --dport PORT_FROM_WG_CONFIG -j ACCEPT
-A OUTPUT -s 192.168.0.0/16 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o wg0 -p icmp -j ACCEPT
-A OUTPUT -o wg0 -j ACCEPT
-A OUTPUT -d WG_CONFIG_IP/32 -j ACCEPT
-A OUTPUT -p udp -m udp --dport PORT_FROM_WG_CONFIG -j ACCEPT
-A OUTPUT -o wg0 -j ACCEPT
COMMIT

I believe you need to also first allow custom firewall rules in Kodi with:

1) Set kodi's network/firewall config to custom
2) Reboot

hello,

I need help with my wireguard configuration..

I have subscribed to a paid subscription at protonvpn and I have the possibility of creating wireguard configs..

I will try to describe my problem.

I created a file with nano in storage/.config/wireguard/wireguard.config

I have replaced the necessary information with that of my supplier.

[provider_wireguard]

Type=WireGuard

Name = WireGuard VPN Tunnel

Host = 188.241.xx.xxx

WireGuard.Address = 10.2.0.2/32

WireGuard.ListenPort = 51820

WireGuard.PrivateKey = MGWKhrENy0r3soBHkJf0UGqYaxxxxxxxxxxxxxxxx=

WireGuard.PublicKey=LVsKLsUOqzeYK3ATkN8xxxxxxxxxxxxxx=

#WireGuard.PresharedKey = DfEYeVs04HS9XhKGM4/ZXHG3Qc4MFKxxxxxxxxx=

WireGuard.DNS=10.2.0.1

WireGuard.AllowedIPs = 0.0.0.0/0

WireGuard.EndpointPort = 51820

WireGuard.PersistentKeepalive = 25

the connection is made and my public ip changes but when I do a test with the dnsleak plugin I find the dns of my internet provider..

I have circumvented the problem temporarily with pihole or an alternative dns but I would like to solve the problem.

someone to help me?

laurent734 LE probably needs to use ConnMan with the built-in DNS proxy to avoid DNS leaks at source; but we deliberately don't use the DNS proxy because it means Kodi GUI (correctly) shows 127.0.0.1 as the system DNS server and then we drown in annoyiing user support posts that point fingers at "networking is broken, it shows 127.0.0.1 not my real DNS server" posts from users. The workaround is to force traffic using iptables (read a few posts above).

Quote from chewitt

laurent734 LE probably needs to use ConnMan with the built-in DNS proxy to avoid DNS leaks at source; but we deliberately don't use the DNS proxy because it means Kodi GUI (correctly) shows 127.0.0.1 as the system DNS server and then we drown in annoyiing user support posts that point fingers at "networking is broken, it shows 127.0.0.1 not my real DNS server" posts from users. The workaround is to force traffic using iptables (read a few posts above).

hello,

Thank you for your reply ..

I followed your advice and I managed to remove the dns leaks..

1: I edited the rules.v4 file with the command:

nano /storage/.config/iptables/rules.v4

I used the loopy123 file and I replaced

2:PORT_FROM_WG_CONFIG with my provider's port and

3:WG_CONFIG_IP with address 10.2.0.2

4: I recorded with nano

5:I ran:

iptables-save >/storage/.config/iptables/rules.v4 to make it permanent

6: I then activated the personalized firewall in the graphical interface and restarted

after these steps I still had dns leaks.

I therefore configure a fixed ip with the 1st dns 10.2.0.1 and the second pihole.

miracle after test with the nslookup command I get:

nslookup google.fr

Server: 10.2.0.1

Address 1: 10.2.0.1

Name: google.fr

Address 1: 142.251.39.99 ams15s48-in-f3.1e100.net

I also did a test with the dnsleak pluggin which confirms the only use of a single dns that of proton.

to conclude I do not know if iptables help me or if I simply had to force the dns 10.2.0.1 but the essential and that it works.

I specify that I useful coreelec in nexus beta1 version wireguard donations works very well on nexus

thanks to loopy123 for his file and to you for your advice