Gretap interface creates unnecessary peer route

Installing and Using OpenWrt Network and Wireless Configuration
1

I have a gretap interface which connects to its peer via a Wireguard VPN interface. This is all technically working fine, but I'm running into an issue when the router reboots where the gretap interface seems to come up before the Wireguard interface which results in it creating a route to the gretap peer via the default WAN interface - which then prevents traffic going via the VPN.

The /etc/config/network for the two interfaces:

config interface 'wg5'
	option proto 'wireguard'
	option private_key '...'
	list addresses '192.168.20.2/30'

config interface 'gretap1'
	option proto 'gretap'
	option ipaddr '192.168.20.2'
	option peeraddr '192.168.20.1'
	option zone 'none'

route output after normal startup (note the route created to the peer address 192.168.20.1):

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.68.1    0.0.0.0         UG    10     0        0 eth0.2
192.168.8.0     *               255.255.255.0   U     0      0        0 br-lan
192.168.20.0    *               255.255.255.252 U     0      0        0 wg5
192.168.20.1    192.168.68.1    255.255.255.255 UGH   10     0        0 eth0.2
192.168.68.0    *               255.255.252.0   U     10     0        0 eth0.2

If I disable the gretap interface and manually start it after the system has booted then the route to the peer isn't created, the output of route looks like this and everything works as expected:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.68.1    0.0.0.0         UG    10     0        0 eth0.2
192.168.8.0     *               255.255.255.0   U     0      0        0 br-lan
192.168.20.0    *               255.255.255.252 U     0      0        0 wg5
192.168.68.0    *               255.255.252.0   U     10     0        0 eth0.2

Can anyone advise on the best way to handle this. Is there a config option to set the order that the interfaces come up, or to specifically tell it that the gretap should come up after the Wireguard interface? Or is there a gretap config option to tell it not to create a route to the peer?

Thanks

2

You can set the gretap to not start on boot and then use an interface hook script to bring up gretap after WG is up.

Edit. Sorry it's called hot plug. https://openwrt.org/docs/guide-user/base-system/hotplug

3

Please consider switching to ip route show or ip r for short.
But route and friends are obsolete since 2012. ip comes from iproute2 and the full package version on OpenWrt is called ip-full.

4

Hi @_bernd

Thanks for your reply and the tip on using ip route.

I've created a script to delete the peer route if it exists whenever an iface action fires on the gretap interface, and that seems to be working fine.

For the benefit of anyone who might run in to the same issue, this is the script:
/etc/hotplug.d/iface/99-remove-gretap-route:

if [ "$INTERFACE" == "gretap1" ]; then
    if [ -n "$(ip route show 192.168.20.1/32)" ]; then
        # A route to the gretap peer exists
        ip route del 192.168.20.1/32
        logger -t hotplug "$INTERFACE $ACTION: Deleted route to 192.168.20.1/32"
        if [ -n "$(ip route show 192.168.20.1/32)" ]; then
            logger -t hotplug "$INTERFACE $ACTION: The route to 192.168.20.1/32 still exists"
        fi
    fi
fi

I would still be interested if there is a way to handle this via configuration rather than having to script it, if anyone has any ideas.

Thanks

Edit:- here's an alternative version of the script which doesn't depend on hardcoding IP addresses and instead gets the peer address via uci:

IFACE_NAME="gretap1"

if [ "$INTERFACE" == "$IFACE_NAME" ]; then
    GRETAP_PEER=`uci -q get network.$IFACE_NAME.peeraddr`
    if [ -n "$GRETAP_PEER" ]; then
        GRETAP_PEER="$GRETAP_PEER/32"
        if [ -n "$(ip route show $GRETAP_PEER)" ]; then
            # A route to the gretap peer exists
            ip route del $GRETAP_PEER
            logger -t hotplug "$INTERFACE $ACTION: Deleted route to $GRETAP_PEER"
            if [ -n "$(ip route show $GRETAP_PEER)" ]; then
                logger -t hotplug "$INTERFACE $ACTION: The route to $GRETAP_PEER still exists"
            fi
        fi
    fi
fi
5

As far as I'm aware of we have no interface dependencies.