DietPi-Software | WireGuard: wg-quick[....]: RTNETLINK answers: File exists #2491
Comments
|
@curiosity-seeker The config looks as desired. To sort it out, can you check/verify the I stumble over: Try: Perhaps also But also: Out of topic: |
|
@MichaIng : I executed as you suggested and got the message: And executing |
Did you try to comment the I will also do some test install later this night. |
MichaIng
changed the title
Yes, I did! But I got the same messages as in my post above. |
|
Same issue here! Same setup, same errors:
|
|
@curiosity-seeker @XRay437 In your cases additionally it attempts and fails to: Related If I could follow everything correctly, the following is responsible: Check on my system with With
Manually applying interface steps:
So it seems, that somehow the
|
|
@curiosity-seeker @XRay437 |
Hello, here we are: Please, notice that I'm using the subnet 10.9.0.0/24 instead of 10.8.0.0/24 because on that subnet I've already set the tun0 if of PiVPN (in use with pi-Hole). |
|
@XRay437
So indeed the required route is set up as desired and the service should not try to add it again. Indeed I guess it simply needs to wait a tiny bit longer. Note that the above steps are for debugging, no solution that would enable you to start the service. The problem it you completely need to remove the link to be able to start the service, so no chance to do any pre-configuration as solution, AFAIK. But we could simply add a |
|
@MichaIng : I can report the same result as @XRay437 . Unfortunately your latest suggestion didn't fix the problem: And repeating the commands suggested further above got: |
|
@curiosity-seeker Checking again the code:
|
|
@curiosity-seeker @XRay437 Btw good hint about the double use of |
|
Success !!!! Great!!! |
|
@curiosity-seeker And why ever the route check goes wrong, we should forward this to WireGuard devs. |
MichaIng
added
Solution available 🥂
So I should modify this in /etc/wireguard/wg0.conf and /etc/wireguard/wg0-client.conf as I've been using OpenVPN, too, shouldn't I? |
I will certainly try to do this ASAP but it might take some time as I'm busy with other things right now. |
|
@curiosity-seeker |
And wireguard is using 10.8.0.2 so there shouldn't be a conflict, |
|
@curiosity-seeker Since XRay437 faced the same issue with already different subnets, it might not be the only thing, but when you find time, just to sort it out, you could try the following:
If it fails with the same error, readd/uncomment
Jep no worries, you guys already helped a lot with testing and reporting back 😃. |
|
|
@MichaIng : I said I'm busy with other things but I simply couldn't wait ;-) I added the public key and 10.8.0.2/24 to the Wireguard app on my iphone - and everything seems to work as it should! I first tried it using my Wifi, and then disabled Wifi on the iPhone - all is well! |
|
@XRay437 And as suggested within the error output, check the last lines of: @curiosity-seeker |
Ok, I'm using wg0.conf with "#Tables = OFF". ip route get 10.9.0.0/24:
|
|
@curiosity-seeker Generally to check which interfaces are active: Okay so I think we can close this issue?
Fell free to add/use or reopen the issue, if required. |
|
I hate to say that what I wrote a couple of hours ago is no longer true. While my iPad still appears as 10.9.0.3 in the Pi-hole query log, the iPhone does not anymore. Although I haven't changed anything. It seems to me that Wireguard is not stable enough right now. EDIT: I can still ping both devices, even the iPhone under 10.9.0.2. |
|
Btw, |
|
What also puzzles me: Why is the endpoint port different from 51820? |
If I get this correct, 56021 is the WireGuard port of the client. It is expected that this does not necessarily match the one from the server and is does not need to. E.g. in my case (damn too a while, QR code not readable and manually mixing My wg interface looks the same: What I recognized is that the WireGuard module client shows a successful connection, even if it was not successful, at least in my case when I entered a wrong key. That is quite a bad behaviour. It should clearly tell you that authentication failed! About you having inconsistent stable connection:
|
|
I just realized that the Simple solution to only translate non-comment lines:
|
Thanks - understood!
Indeed - it seems that Wireguard still needs some polishing. There is a reason why Linus hasn't added it to the kernel yet ....
This is actually what I had done! However, it hasn't improved the situation.
This is how it looks now: Thanks again for your help! And let's hope that new Wireguard versions will bring the necessary improvements. |
|
@curiosity-seeker We can help to fix issues by giving some feedback 😎. I will report the missing error prompt when authentication fails. Thanks to your testing with tun0/OpenVPN disabled, sorting out incompatibility with OpenVPN, perhaps we can also have the WireGuard server devs have a look at this. Of course I cannot assure that it is not as well a config issue our side, due to lack of deeper knowledge. I as well simply followed various guides and own testing + compare with our OpenVPN setup, to estimate required configs 😉. While reading I understand better and better how this routing and iptables actually work:
|
|
@MichaIng : Just out of curiosity : Does it run well on your systems? |
|
@curiosity-seeker Also I did not test with multiple clients, actually. It is also possible to add each client as a separate peer to the server config, with own key pair. Should not be required actually, but at least could be worth to test. I have to work now but will give you the required instructions later. My ToDo:
|
Yes, this is what I've done. My wg0.conf looks like this: And my wg0-client.conf is this one: Is this correct? I just wonder if AllowedIPs in wg0-client.conf should also be 10.9.0.0/24 ... Btw.: I still have to read your updated post above in order to (hopefully!) understand all intricacies ;-) |
|
@curiosity-seeker To add two peers, you need two [Peer] entries followed by key and IP each. For simplicity you should be able to use the same key pair for both clients then. About the client side allowed IPs, it depends if you want to forward all network traffic through the VPN or only access to the VPN server or local network. |
|
@MichaIng : You saved my day, my friend!!! I changed wg0.conf according to your instructions - and now I can see my iPhone as 10.9.0.2 in the Pi-hole query log again. Hurrah! I really should have thought about adding a new [Peer] section after adding a new device. So I really hope that this is the final solution! Thank you very much once more !!! EDIT: And now finally wg reports: |
|
@curiosity-seeker As long as this now works reliable for you, we might need to change the online docs in how to add multiple clients. Also it looks somehow cleaner if every client has it's own peer 😉. |
Quite frankly I did not try that. I just had not added a second [Peer] section - that was the problem. Now with 2 key pairs it works well. Yesterday it happened that after some time the iPad didn't appear as 10.9.0.3 anymore (although the VPN symbol was still there and the device was allegedly still connected to the VPN), so I had to deactivate and re-activate it to make it work again. Since then the Wireguard tunnel is stable for both devices. That problem could be caused by the Wireguard app - but it could also be a general problem with VPN support in iOS: I have been using AdGuard Pro on both devices which creates a local VPN in order to filter ads (before you ask: that local VPN is automatically disabled when switching to OpenVPN or Wireguard). And with that local VPN enabled I sometimes had problems connecting to my Wifi. |
|
@curiosity-seeker I will also run some tests here and in case change the online docs about how to add multiple clients for best stability: https://github.com/Fourdee/DietPi/issues/2540 |
|
@MichaIng : One late additional remark FYI. I have been using Wireguard with Pi-hole successfully for the most time. However, every one or two days I noticed that in the Pi-hole log my two iOS devices didn't appear as 10.9.0.2 and 10.9.0.3, resp. - which meant that the Wireguard tunnel was no longer active so I had to re-enable it manually in the iOS app. I enabled Persistent Keepalive and set it to 10 secs - but to no avail. But then I tripped over this Reddit thread which sounded familiar. I tried the solution presented in the last post - and since then all is well. I don't know after all those changes above if that is really the default in Dietpi and if you already changed it in 6.22. But I wanted to mention it as it might explain possible problems other users might have. |
|
@curiosity-seeker However the question is if this depends on the server only or on the local network as well. Did you disable IPv6 via dietpi-config? Hmm, as long is the IPv6 kernel module is enabled, actually forwarding IPv6 should work fine 🤔. Possibly the issue can be solved already by force enabling IPv6 (via sysctl) only for the wg0 interface. The problem is:
Based on how you disabled IPv6, I hope simply setting |
Unfortunately I have to say that I found that a couple of hours ago the Wireguard tunnel for my iPad wasn't active anymore after working flawlessly for several days before. Sigh. So that change isn't a real solution although the situation has improved. |
|
Just noticed that after today's update to 6.22.3 Wiregurad is broken: |
That is strange. The update does not touch WireGuard installs at all, only fixes the Debian Sid repo implementation: https://github.com/MichaIng/DietPi/blob/master/dietpi/patch_file#L1544-L1557 But there was a WireGuard APT package update, if I remember right. Could you please paste the update log: About IPv6:
|
|
@MichaIng So wireguard-tools were removed, and its reverse dependencies are: I guess that explains it. And here is the output of So wg0 is missing probably because wireguard was removed. |
|
@curiosity-seeker should resolve it. Your VPN settings should be still in place. |
|
@MichaIng So I removed wireguard-dkms and installed wireguard anew. After starting wg-quick@wg0 ip a shows wg0 again. |
Hmm, possible that priority 99 does not allow auto updates/installs besides when selecting the package or repo manually, e.g. Okay can't test since the old packages are not available anymore. Downloaded the current ones and need to wait for next WireGuard update. Reading some more about pinning: https://wiki.debian.org/AptPreferences
|
ADMIN EDIT
Solution
/etc/wireguard/wg0.confand replace all10.8.0.Xwith10.9.0.Xas by default OpenVPN (tun0interface) uses the same address range. Ifsystemctl restart wg-quick@wg0succeeds then, do the same with the client configs:/etc/wireguard/wg0-client.confRTNETLINK answers: File existserror, do the following:For the devs: Enhancement
10.9.0.0for WireGuard?Creating a bug report/issue
Required Information
Steps to reproduce
Expected behaviour
Wireguard should be running.
Actual behaviour
systemctl status wg-quick@wg0says:Extra details
/etc/wireguard/wg0looks like this:/lib/systemd/system/[email protected]looks like this:The text was updated successfully, but these errors were encountered: