OpenWRT dynamic IP watchdog

OpenWRT dynamic IP watchdog

[Aleksandr V. Piskunov]

I'm using OpenWRT routers to connect several networks (most behind
NAT) to the main one, with a public but dynamic IP. In order to keep
WireGuard connections alive in case of sudden endpoint IP change, some
kind of monitoring is required, so I adapted
https://github.com/WireGuard/WireGuard/blob/master/contrib/examples/reresolve-dns/reresolve-dns.sh
script to the specifics of OpenWRT networking system.
Tested it for a few weeks with a several IP changes, server downtimes,
etc.. seems to be working just fine.

If any OpenWRT wireguard package maintainers are reading this, please
review and consider for pushing to the wireguard-tools(?) package.


#!/bin/sh
# to be called from cron every 1..2 minutes
. /lib/functions.sh

check_peer_activity() {
  local cfg=$1
  local iface=$2
  local public_key
  local endpoint_host
  local endpoint_port
  local persistent_keepalive
  local last_handshake
  local idle_seconds

  config_get public_key "${cfg}" "public_key"
  config_get endpoint_host "${cfg}" "endpoint_host"
  config_get endpoint_port "${cfg}" "endpoint_port"
  config_get persistent_keepalive "${cfg}" "persistent_keepalive"

  # only process peers with endpoints and keepalive set
  [ -z ${endpoint_host} ] && return 0;
  [ -z ${persistent_keepalive} ] && return 0;

  # resolve endpoint and reconnect if not responding for too long
  last_handshake=`wg show ${iface} latest-handshakes | grep
${public_key} | awk '{print $2}'`
  [ -z ${last_handshake} ] && return 0;
  idle_seconds=$((`date +%s`-${last_handshake}))
  [ ${idle_seconds} -lt 150 ] && return 0;
  logger -t "wireguard_monitor" "${iface} endpoint
${endpoint_host}:${endpoint_port} is not responding for
${idle_seconds} seconds, trying to reconnect"
  wg set ${iface} peer ${public_key} endpoint
"${endpoint_host}:${endpoint_port}"
}

# query ubus for all active wireguard interfaces
wg_ifaces=`ubus -S call network.interface dump | jsonfilter -e
'@.interface[@.up=true]' | jsonfilter -a -e
'@[@.proto="wireguard"].interface' | tr "\n" " "`

# check every peer in every active wireguard interface
config_load network
for iface in $wg_ifaces; do
  config_foreach check_peer_activity "wireguard_${iface}" "${iface}"
done

Re: OpenWRT dynamic IP watchdog

[Jason A. Donenfeld]

Hi Aleksandr,

Nice script. One question:

>   [ ${idle_seconds} -lt 150 ] && return 0;

Is there a reason why you went with 150? My original reresolve-dns.sh
went with 135 (REKEY_AFTER_TIME + KEEPALIVE_TIMEOUT + REKEY_TIMEOUT).
Did you find 150 matched network conditions better?

Regards,
Jason

Re: OpenWRT dynamic IP watchdog

[Aleksandr V. Piskunov]

Yes, I've tried 135 first, but during the real usage there were quite
a few false alarm situations with watchdog reconnecting at
136..~140 seconds. So.. changed it to 150 secs, which seems to work OK
for my conditions.

I can try to send a git patch to contrib/examples/reresolve-dns,
if rest is OK.

Regards,
Aleksandr

On Sat, Jun 16, 2018 at 03:00:45PM +0200, Jason A. Donenfeld wrote:
> Hi Aleksandr,
> 
> Nice script. One question:
> 
> >   [ ${idle_seconds} -lt 150 ] && return 0;
> 
> Is there a reason why you went with 150? My original reresolve-dns.sh
> went with 135 (REKEY_AFTER_TIME + KEEPALIVE_TIMEOUT + REKEY_TIMEOUT).
> Did you find 150 matched network conditions better?
> 
> Regards,
> Jason