wireguard troubleshooting : no reply

novalis · May 17, 2020 at 5:05 PM

I have done the setup as described in the wiki, but I get no response.

Instead the following error:

KODI-TV4:~ # connmanctl services

*AO Wired ethernet_dca63226ebf3_cable

* WireGuard VPN Tunnel vpn_kodi4_tv

KODI-TV4:~ # connmanctl connect vpn_kodi4_tv

Error /net/connman/service/vpn_kodi4_tv: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

my conf file looks like this:

[provider_wireguard]

Type = WireGuard

Name = WireGuard VPN Tunnel

Host = myname.dyndns.org

Domain kodi4.tv

WireGuard.Address = 192.168.6.6/24

WireGuard.ListenPort =

WireGuard.PrivateKey = ghgghh

WireGuard.PublicKey = vhjjnbvv

WireGuard.PresharedKey =

WireGuard.DNS = 8.8.8.8

WireGuard.AllowedIPs = 0.0.0.0/0

WireGuard.EndpointPort = 45467

WireGuard.PersistentKeepalive = 25

Any ideas?

elgatito · May 17, 2020 at 6:33 PM

Hello,

Having same issue.

Having this configuration currently:

Code

[provider_wireguard]

Type = WireGuard

Name = Mullvad

Host = pl2-wireguard.mullvad.net

Domain = my.home.network

WireGuard.Address = 10.66.185.79/32

WireGuard.ListenPort = 51820

WireGuard.PrivateKey = Z0u/4vY15F23PJUrBljSHKK+AElMJ+2UYrgSf/k=

WireGuard.PublicKey = 9v9VK6f98rFS2iZvYxqTvNWeeT34EYn6TRRZqNC=

WireGuard.PresharedKey =

WireGuard.DNS = 8.8.8.8, 1.1.1.1

WireGuard.AllowedIPs = 0.0.0.0/0

WireGuard.EndpointPort = 51820

WireGuard.PersistentKeepalive = 25

Display More

When running connman I get this:

Code

$ connmanctl connect vpn_pl2_wireguard_mullvad_net_my_home_network

Error /net/connman/service/vpn_pl2_wireguard_mullvad_net_my_home_network: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.

I ran connman with debug:

Code

# /usr/sbin/connmand -nr --config=/etc/connman/main.conf -d



...



connmand[8613]: ../src/service.c:connect_service() service 0x1cfb180

connmand[8613]: ../src/service.c:__connman_service_connect() service 0x1cfb180 state failure connect reason user -> user

connmand[8613]: ../src/service.c:__connman_service_clear_error() service 0x1cfb180

connmand[8613]: ../src/service.c:__connman_service_ipconfig_indicate_state() service 0x1cfb180 (vpn_pl2_wireguard_mullvad_net_my_home_network) old state 7 (failure) new state 1 (idle) type 1 (IPv4)

connmand[8613]: ../src/ipconfig.c:__connman_ipconfig_disable() ipconfig 0x1cfb318

connmand[8613]: ../src/service.c:service_indicate_state() service 0x1cfb180 old failure - new idle/idle => idle

connmand[8613]: ../plugins/vpn.c:vpn_disconnect_check()

connmand[8613]: ../src/session.c:service_state_changed() service 0x1cfb180 state 1

connmand[8613]: ../src/service.c:__connman_service_disconnect() service 0x1cfb180

connmand[8613]: ../src/agent.c:connman_agent_cancel() context 0x1cfb180

connmand[8613]: ../src/provider.c:connman_provider_disconnect() provider 0x1cead48

connmand[8613]: ../plugins/vpn.c:provider_disconnect() provider 0x1cead48

connmand[8613]: ../src/provider.c:provider_indicate_state() state 6

connmand[8613]: ../src/service.c:__connman_service_ipconfig_indicate_state() service 0x1cfb180 (vpn_pl2_wireguard_mullvad_net_my_home_network) old state 1 (idle) new state 6 (disconnect) type 1 (IPv4)

connmand[8613]: ipconfig state 6 ipconfig method 1

connmand[8613]: ../src/provider.c:provider_indicate_state() state 1

connmand[8613]: ../src/6to4.c:__connman_6to4_remove() tunnel ip address (null)

connmand[8613]: ../src/inet.c:connman_inet_clear_address() index 0 address (null) prefix_len 0 peer (null) broadcast (null)

connmand[8613]: ../src/session.c:ipconfig_changed() service 0x1cfb180 ipconfig 0x1cfb318

connmand[8613]: ../src/session.c:ipconfig_changed() service 0x1cfb180 ipconfig 0x1cfb388

connmand[8613]: ../src/ipconfig.c:__connman_ipconfig_disable() ipconfig 0x1cfb318

connmand[8613]: ../src/ipconfig.c:__connman_ipconfig_disable() ipconfig 0x1cfb388

connmand[8613]: ../src/connection.c:__connman_connection_update_gateway() default 0x1cf6808

connmand[8613]: ../src/provider.c:__connman_provider_connect() provider 0x1cead48

connmand[8613]: ../plugins/vpn.c:connect_provider() data 0x1ceb8d8 user (nil) path /net/connman/vpn/connection/pl2_wireguard_mullvad_net_my_home_network sender :1.1286

connmand[8613]: ../plugins/vpn.c:connect_provider() transport ethernet_001e064234a8_cable

connmand[8613]: ../src/provider.c:provider_indicate_state() state 2

connmand[8613]: ../src/service.c:__connman_service_ipconfig_indicate_state() service 0x1cfb180 (vpn_pl2_wireguard_mullvad_net_my_home_network) old state 1 (idle) new state 2 (association) type 1 (IPv4)

connmand[8613]: ../src/service.c:service_indicate_state() service 0x1cfb180 old idle - new association/idle => association

connmand[8613]: ../plugins/vpn.c:vpn_disconnect_check()

connmand[8613]: ../src/session.c:service_state_changed() service 0x1cfb180 state 2

connmand[8613]: ../src/connection.c:__connman_connection_update_gateway() default 0x1cf6808

connmand[8613]: ipconfig state 2 ipconfig method 1

connmand[8613]: ../src/service.c:__connman_service_connect() service 0x1cfb180 err -115

connmand[8613]: ../plugins/vpn.c:connect_reply() user_data 0x1ceb8d8 path (null)

connmand[8613]: Connect reply: Invalid arguments (net.connman.Error.InvalidArguments)

connmand[8613]: ../plugins/vpn.c:connect_reply() data 0x1ceb8d8 cb_data (nil)

connmand[8613]: ../src/service.c:service_send_changed()

connmand[8613]: ../src/service.c:service_append_added_foreach() changed /net/connman/service/ethernet_001e064234a8_cable

connmand[8613]: ../src/service.c:service_append_added_foreach() changed /net/connman/service/vpn_pl2_wireguard_mullvad_net_my_home_network

connmand[8613]: ../src/service.c:connect_timeout() service 0x1cfb180

connmand[8613]: ../src/provider.c:connman_provider_disconnect() provider 0x1cead48

connmand[8613]: ../plugins/vpn.c:provider_disconnect() provider 0x1cead48

connmand[8613]: ../src/provider.c:provider_indicate_state() state 6

connmand[8613]: ../src/service.c:__connman_service_ipconfig_indicate_state() service 0x1cfb180 (vpn_pl2_wireguard_mullvad_net_my_home_network) old state 2 (association) new state 6 (disconnect) type 1 (IPv4)

connmand[8613]: ../src/service.c:service_rp_filter() disconnected vpn_pl2_wireguard_mullvad_net_my_home_network ipconfig 0x1cfb318 method 3 count 0 filter 0

connmand[8613]: ../src/service.c:service_indicate_state() service 0x1cfb180 old association - new disconnect/idle => disconnect

connmand[8613]: ../plugins/vpn.c:vpn_disconnect_check()

connmand[8613]: ../src/session.c:service_state_changed() service 0x1cfb180 state 6

connmand[8613]: ../src/provider.c:provider_service_changed() service 0x1cfb180 vpn_pl2_wireguard_mullvad_net_my_home_network state 6 index 0/-1

connmand[8613]: ../src/wispr.c:__connman_wispr_stop() service 0x1cfb180

connmand[8613]: ../src/wpad.c:__connman_wpad_stop() service 0x1cfb180

connmand[8613]: ../src/connection.c:__connman_connection_update_gateway() default 0x1cf6808

connmand[8613]: ipconfig state 6 ipconfig method 1

connmand[8613]: ../src/provider.c:provider_indicate_state() state 1

connmand[8613]: ../src/service.c:__connman_service_ipconfig_indicate_state() service 0x1cfb180 (vpn_pl2_wireguard_mullvad_net_my_home_network) old state 6 (disconnect) new state 1 (idle) type 1 (IPv4)

connmand[8613]: ../src/ipconfig.c:__connman_ipconfig_disable() ipconfig 0x1cfb318

connmand[8613]: ../src/service.c:service_indicate_state() service 0x1cfb180 old disconnect - new idle/idle => idle

connmand[8613]: ../plugins/vpn.c:vpn_disconnect_check()

connmand[8613]: ../src/session.c:service_state_changed() service 0x1cfb180 state 1

connmand[8613]: ../src/connection.c:__connman_connection_update_gateway() default 0x1cf6808

connmand[8613]: ../src/service.c:__connman_service_ipconfig_indicate_state() service 0x1cfb180 (vpn_pl2_wireguard_mullvad_net_my_home_network) old state 1 (idle) new state 7 (failure) type 1 (IPv4)

connmand[8613]: ../src/ipconfig.c:__connman_ipconfig_disable() ipconfig 0x1cfb318

connmand[8613]: ../src/service.c:service_indicate_state() service 0x1cfb180 old idle - new failure/idle => failure

connmand[8613]: ../plugins/vpn.c:vpn_disconnect_check()

connmand[8613]: ../src/session.c:service_state_changed() service 0x1cfb180 state 7

connmand[8613]: ../src/provider.c:provider_service_changed() service 0x1cfb180 vpn_pl2_wireguard_mullvad_net_my_home_network state 7 index 0/-1

connmand[8613]: ../src/agent.c:connman_agent_report_error_full() agent 0x1cf4358 sender (null) context 0x1cfb180 path //agent_wifi

connmand[8613]: ../src/service.c:service_save() service 0x1cfb180 new 1

connmand[8613]: ../src/connection.c:__connman_connection_update_gateway() default 0x1cf6808

connmand[8613]: ipconfig state 7 ipconfig method 1

connmand[8613]: ../src/service.c:run_vpn_auto_connect() stopping, no autoconnectable VPNs found

connmand[8613]: ../src/service.c:service_send_changed()

connmand[8613]: ../src/service.c:service_append_added_foreach() changed /net/connman/service/ethernet_001e064234a8_cable

connmand[8613]: ../src/service.c:service_append_added_foreach() changed /net/connman/service/vpn_pl2_wireguard_mullvad_net_my_home_network

Display More

This one is strange to me:

Code

connmand[8613]: Connect reply: Invalid arguments (net.connman.Error.InvalidArguments)

I can add that I've tried with setting server IP instead of hostname, and removed IPv6 for local address as well, and tried few modification, always got same errors.

**mglae** · May 17, 2020 at 7:01 PM

This is a known issue. See Add Wireguard support.

Additional it is reported that the default route is always set to the wireguard device.

Just a thought for a workaround: use wireguard without connman.

Do cp /etc/connman/main.conf /storage/.config/connman_main.conf and add ,wg to the NetworkInterfaceBlacklist line. Reboot.

Then configure wireguard using the wg command.

novalis · May 17, 2020 at 7:15 PM

how?

novalis · May 17, 2020 at 8:35 PM

try to remove the line:

WireGuard.PresharedKey =

it helped for me, obviously it must not be empty.

... silly if true...

elgatito · May 17, 2020 at 8:44 PM

Quote from novalis

it helped for me, obviously it must not be empty.

Omg... Helped me as well.

Thanks

novalis · May 18, 2020 at 12:27 AM

Despite getting a connection now, the routing still doesn't work.

PING ct.de (193.99.144.80): 56 data bytes

ping: sendto: Required key not available

access to network shares: no route to host

similar to Enabling Wireguard for a 10.x.x.x network only breaks all internet access

giving up

**chewitt** · May 18, 2020 at 4:38 AM Official Post

I've reported the PresharedKey issue so that bad config handling can be improved. The routing issue remains unresolved. It's been reported but the main connman developer working on WireGuard has been offline for a while. He's resurfaced in the last week so hopefully we might see some progress.

elgatito · May 18, 2020 at 7:17 AM

Quote from chewitt

I've reported the PresharedKey issue so that bad config handling can be improved. The routing issue remains unresolved. It's been reported but the main connman developer working on WireGuard has been offline for a while. He's resurfaced in the last week so hopefully we might see some progress.

Maybe we can do something manually? Maybe manage routes after setting up the interface.

**chewitt** · May 18, 2020 at 8:29 AM Official Post

The challenge with routing is that connman manages the WireGuard interface, so you can make changes, and connman can simply overwrite them again. Connman support for WireGuard is still rather new and initial testing was limited to specific use-cases. Now that a wider audience started to use it other ways, we're sure to find some things that need code changes. I'm sure it will be resolved, but don't ask when.

novalis · May 18, 2020 at 9:30 AM

Please leave us a note here if anything happens so that we get informed.

elgatito · May 18, 2020 at 1:57 PM

chewitt, is it possible to install bash on LE? Then we could use wg-quick. Manually managing is so ... manual.

novalis · May 18, 2020 at 3:16 PM

Well I think bash is already installed.

The busybox version though.

Here is my .profile

SHELL=/bin/bash

PATH=/storage/bin:$PATH

TERM=xterm-color

exec bash & source /storage/.bashrc

**chewitt** · May 18, 2020 at 10:09 PM Official Post

If you look at one of the early attempts at PR'ing support project: add wireguard package by chewitt · Pull Request #3498 · LibreELEC/LibreELEC.tv · GitHub I was using a homegrown wg-quick script that works (in a basic sense). bash isn't the only challenge with the upstream script, iproute2 is missing capabilitties too.

JimmySmith · July 1, 2020 at 5:27 AM

Quote from mglae

This is a known issue. See Add Wireguard support.

Additional it is reported that the default route is always set to the wireguard device.

Just a thought for a workaround: use wireguard without connman.

Do cp /etc/connman/main.conf /storage/.config/connman_main.conf and add ,wg to the NetworkInterfaceBlacklist line. Reboot.

Then configure wireguard using the wg command.

Display More

Thank you very much for this. Connman also didnt work for me with

Connect reply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. (org.freedesktop.DBus.Error.NoReply)

Your idea saves a day. Not sure, why connman doesnt work for me and some others, and for some yes. I dont use pre-shared key nor config line.

ninze · September 9, 2021 at 10:40 PM

Quote from mglae

This is a known issue. See Add Wireguard support.
Additional it is reported that the default route is always set to the wireguard device.

Just a thought for a workaround: use wireguard without connman.
Do cp /etc/connman/main.conf /storage/.config/connman_main.conf and add ,wg to the NetworkInterfaceBlacklist line. Reboot.
Then configure wireguard using the wg command.

Display More

I was almost considering to replace libreelec with osmc to get proper wireguard support, but this post saved my day. I didn't need to add wg0 to NetworkInterfaceBlacklist, everything just worked out of the box using `````wg command. I got a warning saying "AllowedIP has nonzero host part", but the routes were added perfectly, everything seems to work as expected. Thank you.

ninze · September 10, 2021 at 8:41 AM

Here is the script I am using for manual bring up / tear down of wireguard interface.

/storage/.config/system.d/wg0.service

Code

[Unit]
Description=start wireguard interface
Requires=network-online.service
After=time-sync.target
Before=kodi.service

[Service]
Type=oneshot
RemainAfterExit=true
StandardOutput=journal

ExecStart=ip link add dev wg0 type wireguard
ExecStart=ip address add dev wg0 10.1.1.3/24
ExecStart=wg setconf wg0 /storage/.config/wireguard/wg0.conf
ExecStart=ip link set up dev wg0

ExecStop=ip link set down dev wg0
ExecStop=ip address del dev wg0 10.1.1.3/24
ExecStop=ip link del dev wg0

[Install]
WantedBy=multi-user.target

Display More

/storage/.config/wireguard/wg0.conf

Code

[Interface]
ListenPort = 51820
PrivateKey = XXXXXXXXXXXXXXX

[Peer]
PublicKey = XXXXXXXXXXXXXXX
AllowedIPs = 10.1.1.0/24
Endpoint = endpoint.hostname:31194
PersistentKeepalive = 25

Advantages over official connman method:

Doesn't hijack default route
Uses default wireguard config file format (except for the Address line)
It is OK to use a hostname instead of IP address for peer endpoint. Useful for dynamic IP endpoints.
Multiple wg interfaces can be configured.

Disadvantages:

The IP address for wg interface is configured in a separate file
The route is added automatically by ip link set up dev wg0 command as long as both wg0.conf and wg0.service use /24 netmask (this is what I needed anyway). For some reason, when I use /32 or /0 netmask, the route is not added, but it should be relatively simple to add it manually.

joulester · November 23, 2021 at 10:08 AM

I'm testing this method but i cant get my dns working. If I set it in wg0.conf i get an "Line unrecognized: DNS=". I have added my routes to the service file and they work.

but how do I add the dns?