Initiate wireguard after NTP success

[lleachii]

@pjp

I sent an email directly to Jason @ zx2c4 a while back with no bounce or reply.

I believe the email is: team [AT] wireguard [DOT] com

[jeff]

Given that Wireguard is an experimental protocol that is still under development, not a turn-key user application for non-technical users, I'd take some time to learn the basics of TCP/IP and NTP, as well as the basic workings of Unix-like operating systems, including shell scripting. Another valuable skill would be knowing how to gather log information and debug information. That knowledge and skill set would be assumed when interacting with a development community.

As lleachii pointed out, unless you've got a specific contribution to make to the Wireguard project, sending mail to the mailing list rather than the project lead will likely get a more positive response.

[dlakelan]

@pjp

I have no clue of how to use it

It's a command you can ssh into the router and cut and paste onto the command line. It looks like in the quote you lose a newline, so here it is again.

mkdir -p /etc/hotplug.d/ntp 

cat > /etc/hotplug.d/ntp/90-wireguard << EOT 
#!/bin/sh 
[ $ACTION = stratum ] && /etc/init.d/wireguard restart 
EOT

Or if you know how to edit files, you can just create the directory /etc/hotplug.d/ntp and edit the file 90-wireguard in that directory to have the contents:

#!/bin/sh 
[ $ACTION = stratum ] && /etc/init.d/wireguard restart 

[pjp]

Thanks dlakelan!
What does it do exactly? I mean, I have the firewall rules set up for all traffic through wireguard as per mullvad and azire config instructions. Will this NTP without wireguard?

[dlakelan]

It looks like it receives a message from the NTP system that the time has been set, and then it restarts wireguard. If you "disable" wireguard so it doesn't start on boot, then you have this hotplug script, once NTP gets the time, your wireguard will come up.

[lleachii]

@pjp

That is unless traffic “leaks” outside the tunnel, which is worse then the above.

@jow

If there’s a conceptual chicken/egg problem, how do you expect LEDE to solve it?

And I just want to be certain...are you sure the issue is NTP, and not something simple like - you misconfigured DNS?

I've only experienced this issue when the WAN port cannot resolve the hostname of the far wg endpoint, or I try to assign DNS servers the WAN connection does not permit. I resolve this limitation by:

• configuring LAN DHCP to hand out DNS servers accessible only thru the tunnel; and
• allowing WAN to use the DNS server assigned by DHCP

or

• I use the IP of the wg endpoint and assign LAN DHCP to assign DNS servers accessible only thru the tunnel

You can eliminate all DNS requests leaking to WAN by using the IP of the wg endpoint; but the UDP connection will obviously be seen by those who control the WAN.

[SOLVED] Wireguard "Interface does not have a public key"

On OpenWrt 18.06-SNAPSHOT r6996-b295e3a, I've installed wireguard. After configuration and reboot, I receive the following on the command prompt: root@OpenWrt:~# wg interface: test_wg on LuCI: Interface test_wg Configuration Interface does not have a public key! Config: config interface 'test_wg' option proto 'wireguard' option private_key 'xxxxxxxxxxx=' list addresses '192.xxx.xxx.xxx/32' config wireguard_test…

[pjp]

@lleachii

are you sure the issue is NTP, and not something simple

I think I can be certain. DNS servers, endpoint, NTP, etc are all configured as IP and not as hostnames.

@dlakelan

If you "disable" wireguard so it doesn't start on boot, then you have this hotplug script, once NTP gets the time, your wireguard will come up.

Thanks! I've configured this, will see if it holds over the next few days when the router boot date/time goes back.

EDIT: it does not work.
I set wireguard interface - advanced to "Bring up on boot" off
I ssh the code and checked the file afterwards
I reboot and wireguard does not come up, I have to manually sync time with browser and then manually start wireguard, so the code doesn't start wireguard after NTP, and NTP does not get set.

This seems logical to me, as per https://mullvad.net/media/uploads/2018/01/11/lede-zones.png all connections including NTP need to go through the WG tunnel, which does not come up without NTP.

How does one get this to work without manual intervetion?

[lleachii]

@pjp

I have to manually sync time with browser and then manually start wireguard

Have you tried using a script to set an arbitrary date and time yet?

@lleachii

If neither location has Internet, isn’t it still possible to sync time with the remote endpoint…it may not be accurate, but it would be synced?

@lleachii

Assuming the device has an ntpd installed, just set that NTP server as the endpoint address. Easy. Both will have the same time…therefore time never goes "backwards."

date(1): print/set system date/time - Linux man page

[pjp]

@lleachii

Have you tried using a script to set an arbitrary date and time yet?

I have no clue how to do this for date/time to get close enough to real date/time for the wireguard tunnel to be working when a travel router is not powered on for a while.

@lleachii

If neither location has Internet, isn’t it still possible to sync time with the remote endpoint…it may not be accurate, but it would be synced?
...
Assuming the device has an ntpd installed, just set that NTP server as the endpoint address. Easy. Both will have the same time…therefore time never goes "backwards."

I asked both Mullvad and Azire, both confirmed their wireguard endpoints/servers do not serve NTP. Also, the tunnel would not be up to serve NTP before date/time is within wireguard acceptable error margin.
That is of course as far as my little grey cells can manage to understand, I may be completely wrong or misunderstanding.

[lleachii]

@pjp

I may be completely wrong or misunderstanding.

I believe you do misunderstand. You are still creating a chicken-and-the-egg problem for yourself.

• Mullvad and Azire do not offer NTP ; and even if they offered NTP, you'd have to establish the tunnel FIRST then use the tunnel IP of thier NTP server in order for there to be no "leak"!
• You are attempting to sync time over the tunnel
• You must have time before the tunnel comes up, therefore, it is impossible to obtain time over the tunnel

Simply use the date program to set a time (e.g. January 1, 2019). The server will have time, and then proceed to connect.

@pjp

traffic “leaks” outside the tunnel

Only your NTP request(s) should "leak." You can configure the LAN to hand out DNS servers that are only accessible within the tunnel. If a "leak" is your only remaining concern, you may need to go over some Basic Networking.

[pjp]

@lleachii

• You must have time before the tunnel comes up, therefore, it is impossible to obtain time over the tunnel

This I understand. I also understand the firewall rules are set up so everything needs to go over the tunnel.

@lleachii

Simply use the date program to set a time (e.g. January 1, 2019). The server will have time, and then proceed to connect.

This I do not know how to do. Wouldn't it be cleaner (date/time wise) to let NTP (and only NTP) bypass the firewall and the tunnel until success? If so, how could I do this?

[jeff]

1. All forwarded traffic blocked; output traffic permitted (at least DHCP, DNS, and NTP)
2. DHCP assigns address to your outside interface
3. NTP starts at boot, makes DNS calls to get servers, synchronizes time
4. Start Wireguard
5. Allow forwarded traffic through the tunnel
6. Route all traffic except DHCP and to the remote tunnel endpoint through the tunnel

[lleachii]

@pjp

I also understand the firewall rules are set up so everything needs to go over the tunnel.

Then, this is what you need to fix.

@pjp

This I do not know how to do.

Twice, I suggested you set an arbitrary time; and the third time, I sent you a link to the manual. You continue to say you don't know how:

@lleachii

https://linux.die.net/man/1/date

@pjp

bypass the firewall and the tunnel until success? If so, how could I do this?

You fix your firewall:

@pjp

the firewall rules are set up so everything needs to go over the tunnel

@jeff

• All forwarded traffic blocked; output traffic permitted (at least DHCP, DNS, and NTP)
• DHCP assigns address to your outside interface
• NTP starts at boot, makes DNS calls to get servers, synchronizes time
• Start Wireguard
• Allow forwarded traffic through the tunnel
• Route all traffic except DHCP and to the remote tunnel endpoint through the tunnel

[dlakelan]

@lleachii

Twice, I suggested you set an arbitrary time

I really think this is a bad idea. If you set an arbitrary time in the future once your router does get real time, it will fail to work until that future date passes... Time never goes backwards for wireguard.

What is needed is to allow ntp over the regular WAN, it's no good to try to prevent a "leak" here. There is no way to avoid using wan to do NTP

[dlakelan]

@jeff

Route all traffic except DHCP and to the remote tunnel

This should read DHCP and NTP

[lleachii]

@dlakelan

If you set an arbitrary time in the future once your router does get real time

@dlakelan, I agree. Considering what the OP said at first:

@pjp

That is very interesting, I’d love to understand how syncing time with the remote endpoint without internet works, and how to set it up to happen at boot.

At first, the OP described a situation where the 2 endpoints did not have Internet; but that's not truly the case. When actually, it's improper firewalling of WAN [NTP] traffic. The OP has a misconception about how a router obtains time:

@lleachii

You must have time before the tunnel comes up, therefore, it is impossible to obtain time over the tunnel

@pjp

This I understand. I also understand the firewall rules are set up so everything needs to go over the tunnel.

As you stated:

@dlakelan

What is needed is to allow ntp over the regular WAN

This will solve the OP's chicken-and-the-egg issue, an issue contrived in their imagination.

[pjp]

How does one allow ntp over the regular WAN and all else only through wireguard ? Thanks.

[lleachii]

@pjp

How does one allow ntp over the regular WAN and all else only through wireguard ? Thanks.

@pjp, you're making your setup extremely difficult. It seems you have fears based in a misunderstanding of basic networking; and a fear that you will "leak" traffic. I think what you define as "all else" is not technically possible.

Simply:

• Use a router with defaults
• install wireguard and configure it (do not enable "Automatically Create Routes")
• Setup static routes for the IPs of the NTP servers to use WAN using a /32 CIDR prefix
• Setup /32 static routes for DNS server IPs (required if your WAN has to resolve a hostname)
• Route all other traffic (0.0.0.0/0) via tunnel
• Configure LAN to use DNS servers that are routed on the tunnel using DHCP Option 6
• Make /32 static routes for those LAN DNS servers to use the tunnel
• (Wireguard will automatically make a route to the /32 of the endpoint peer, so no chicken-and-the-egg issue there)
• Reboot
• Done!

[pjp]

No fear here, just a non technical end consumer (LUCI) trying to get wireguard to work on a lede router regularly powerred off for hours/days and without RTC. I use the guides on Mullvad and Azire on how to set up wireguard and firewall.

@lleachii

do not enable "Automatically Create Routes"

Do you mean leave disabled in the wireguard network interface:
Route Allowed IPs - Create routes for Allowed IPs for this peer.

@lleachii

Setup static routes for the IPs of the NTP servers to use WAN using a /32 CIDR prefix

I'm lost as to how one does that?

[lleachii]

@pjp

I'm lost as to how one does that?

@pjp ...at some point, don't you think you should be responsible for searching for a manual (or browsing the menu on the Heads-up-Display)?

@pjp

just a non technical end consumer (LUCI)

This would be on the exact same LuCI menu: Network > Static Routes

You make the routes, it's menu-driven...not hard.

@pjp

Do you mean leave disabled in the wireguard network interface:
Route Allowed IPs - Create routes for Allowed IPs for this peer.

I do indeed mean that; because I instructed you to make your own routes, so you can make a route for: WAN DNS, WAN NTP, LAN DNSes and the default route (0.0.0.0/0).