Posts by chemical1979

chemical1979

Thanks, I managed to work around with that issue by just sleeping for 5 seconds before starting with wireguard stuff upon boot. This works for me. I also tried with some other dependencies (connman.service, bluetooth.service), but that did not help. I guess I could restore the defaults there ...

Code

[Unit]
Description=WireGuard VPN Service
After=network-online.target nss-lookup.target connman.service connman-vpn.service bluetooth.service
Wants=network-online.target nss-lookup.target connman.service connman-vpn.service bluetooth.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sleep 5
ExecStart=/usr/bin/connmanctl connect vpn_X_klaus
ExecStart=/usr/bin/connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable
ExecStart=/usr/bin/connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable
ExecStart=/usr/sbin/route add -net 192.168.2.0 netmask 255.255.255.0 gw 10.0.0.2
ExecStop=/usr/bin/connmanctl disconnect vpn_X_klaus

[Install]
WantedBy=multi-user.target

Display More

I am still wondering why this move-after has to be executed twice (for me). On the other side of the LibreElec this also not helps in every case, he sometimes need to stop / start wireguard.service several times until it works.

chemical1979

Thanks for getting back. The move-after has to be executed twice to work for me:

Code

openelec-roland:~ # route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     0      0        0 wg0
10.0.0.0        *               255.255.255.0   U     0      0        0 wg0
192.168.110.0   *               255.255.255.0   U     0      0        0 eth0
192.168.110.100 *               255.255.255.255 UH    0      0        0 eth0
255.255.255.255 fritzbox.privat 255.255.255.255 UGH   0      0        0 eth0
openelec-roland:~ # connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable
Moved vpn_X_klaus after ethernet_b827eb10c45a_cable
openelec-roland:~ # route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     0      0        0 wg0
10.0.0.0        *               255.255.255.0   U     0      0        0 wg0
192.168.110.0   *               255.255.255.0   U     0      0        0 eth0
192.168.110.100 *               255.255.255.255 UH    0      0        0 eth0
255.255.255.255 fritzbox.privat 255.255.255.255 UGH   0      0        0 eth0
openelec-roland:~ # route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     0      0        0 wg0
10.0.0.0        *               255.255.255.0   U     0      0        0 wg0
192.168.110.0   *               255.255.255.0   U     0      0        0 eth0
192.168.110.100 *               255.255.255.255 UH    0      0        0 eth0
255.255.255.255 fritzbox.privat 255.255.255.255 UGH   0      0        0 eth0
openelec-roland:~ # connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable
Moved vpn_X_klaus after ethernet_b827eb10c45a_cable
openelec-roland:~ # route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         fritzbox.privat 0.0.0.0         UG    0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 wg0
192.168.110.0   *               255.255.255.0   U     0      0        0 eth0
192.168.110.100 *               255.255.255.255 UH    0      0        0 eth0
255.255.255.255 fritzbox.privat 255.255.255.255 UGH   0      0        0 eth0

Display More

As you can see, the second move-after actually changed the Interface of the default route. So I adopted the service-file:

Code

openelec-roland:~ # cat .config/system.d/wireguard.service
[Unit]
Description=WireGuard VPN Service
After=network-online.target nss-lookup.target connman-vpn.service
Wants=network-online.target nss-lookup.target connman-vpn.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/connmanctl connect vpn_X_klaus
ExecStart=/usr/bin/connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable
ExecStart=/usr/bin/connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable
ExecStop=/usr/bin/connmanctl disconnect vpn_X_klaus

[Install]
WantedBy=multi-user.target

Display More

This way, it works. But I'm not sure why.

Anyway, the service does not come up during boot. How can I troubleshoot this? systemctl status wireguard shows some weird errors (the wrong timestamps seem to be the case as this service gets started before the time was fixed - maybe this is also the problem here, it gets started too early?):

Code

â wireguard.service - WireGuard VPN Service
   Loaded: loaded (/storage/.config/system.d/wireguard.service; enabled; vendor preset: disabled)
   Active: active (exited) since Thu 2019-04-11 16:28:40 UTC; 1 years 1 months ago
  Process: 360 ExecStart=/usr/bin/connmanctl connect vpn_X_klaus (code=exited, status=0/SUCCESS)
  Process: 388 ExecStart=/usr/bin/connmanctl move-after vpn_X_klaus ethernet_b827eb10c45a_cable (code=exited, status=0/SUCCESS)
  Process: 392 ExecStart=/usr/bin/connmanctl move-after vpn_Xt_klaus ethernet_b827eb10c45a_cable (code=exited, status=0/SUCCESS)
 Main PID: 392 (code=exited, status=0/SUCCESS)

Apr 11 16:28:40 openelec-roland systemd[1]: Starting WireGuard VPN Service...
Apr 11 16:28:40 openelec-roland connmanctl[360]: Error /net/connman/service/vpn_X_klaus: Method "Connect" with signature "" on interface "net.connman.Service" doesn't exist
Apr 11 16:28:40 openelec-roland connmanctl[388]: Error /net/connman/service/vpn_X_klaus: Invalid service
Apr 11 16:28:40 openelec-roland connmanctl[392]: Error /net/connman/service/vpn_X_klaus: Invalid service
Apr 11 16:28:40 openelec-roland systemd[1]: Started WireGuard VPN Service.

Display More

If I login with root and "systemctl stop wireguard" and "systemctl start wireguard" it seems to work.

Any ideas?

chemical1979

Hello Team,

Thanks for implementing wireguard in the latest release of LibreElec!

I followed the example from here and here

I tried to replace my site-to-site VPN from the addon tinc to wg, but somehow it keeps replacing the default route from eth0 to wg0 even though the AllowedIPs is limited to the remote subnet. If I connmanctl disconnect <vpnname> it properly restores the former default route.

I'm not sure where to look. This is the config file ~/.config/wireguard/wireguard.config:

Code

[provider_wireguard]
Type = WireGuard
Name = WireGuard VPN Tunnel
Host = xy.myfritz.net
Domain = myname
WireGuard.Address = 10.0.0.1/24
WireGuard.ListenPort = 61820
WireGuard.PrivateKey = kNf1...wk0Q=
WireGuard.PublicKey = 1yj3Tam...QWbeHo=
WireGuard.AllowedIPs = 192.168.2.0/24
WireGuard.EndpointPort = 61820
WireGuard.PersistentKeepalive = 25

Display More

I understood from the docs, that wg would only set the default route to the tunnel, if AllowedIPs would be 0.0.0.0/0 - but it isn't.

After connmanctl connect, the route table looks like this (the other side of the wg-end is not yet configured, so don't mind the missing route for the target subnet):

Code

~/.config/wireguard # ip route
default dev wg0 scope link
10.0.0.0/24 dev wg0 scope link  src 10.0.0.1
192.168.110.0/24 dev eth0 scope link  src 192.168.110.15
192.168.110.100 dev eth0 scope link
255.255.255.255 via 192.168.110.100 dev eth0

~/.config/wireguard # wg
interface: wg0
  public key: mIrfDDWUv....mzKH0A=
  private key: (hidden)
  listening port: 61820

peer: 1yj3Tamu....1yQWbeHo=
  endpoint: 84.x.y.z:61820
  allowed ips: 192.168.2.0/24
  transfer: 0 B received, 148 B sent
  persistent keepalive: every 25 seconds

Display More

The output of wg correctly limits to the configured target subnet.

After "connmanctl disconnect <vpnname>" the ip route looks like this:

Code

~/.config/wireguard # ip route
default via 192.168.110.100 dev eth0
192.168.110.0/24 dev eth0 scope link  src 192.168.110.15
192.168.110.100 dev eth0 scope link
255.255.255.255 via 192.168.110.100 dev eth0

I do not understand why it replaced the default route to wg0, the config file does not tell it to do so. Is this maybe a temporary state until the tunnel is established? Because that is not the case at this moment.

Can someone give me a hint where to look?

EDIT: I found there is a file ~/.cache/connman/<vpnname>/settings, which contains this line:

SplitRouting=false

This probably has something to do with it. I can not set it to "true", because it gets overwritten automatically by some other mechanism as soon as I "connmanctl connect <vpnname>". This mechanism probably is hardcoded to forcetunnel (route 0.0.0.0/0) into wireguard, isn't it?

Posts by chemical1979

Wireguard - changes the default route although not configured

Wireguard - changes the default route although not configured

Wireguard - changes the default route although not configured