# Restart WireGuard via cli

**URL:** <https://forum.openwrt.org/t/restart-wireguard-via-cli/51935>\
**Category:** Network and Wireless Configuration\
**Created:** [January 7, 2020, 10:44am UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935 "2020-01-07T10:44:27Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![trentmu](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trentmu/32/16411_2.png) [@trentmu](https://forum.openwrt.org/u/trentmu)\
**Post date:** [January 7, 2020, 10:44am UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/1 "2020-01-07T10:44:27Z")

</div>

I have a "working" wireguard site-to-site config (thank you to the users/community for the tips in [this post](https://forum.openwrt.org/t/site2site-vpn-with-wireguard/43790)).  
Every now and then, the connections bounce/drop etc, which causes WG to misbehave.  
I can check this via CLI using  
`wg | grep latest`  
and then check if the latest handshake is \> say _X(~=2) mins_. If that is the case, I normally just restart **just** the **WireGuard** interface via LUCI - and everything comes up again.  
I would like to do this via CLI only though - but I can't find the right command. I am assuming 😬 that if there's a clickable, then there's a command (CLI) equivalent? or do I need to restart the LAN interface (I guess it's possible that the GUI click does this, but it's not 100% clear to me)?  
Any pointers appreciated.  
Thanks

---

<div class="post-metadata">

**Author:** ![erdoukki](https://forum.openwrt.org/user_avatar/forum.openwrt.org/erdoukki/32/52960_2.png) [@erdoukki](https://forum.openwrt.org/u/erdoukki)\
**Post date:** [January 7, 2020, 10:48am UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/2 "2020-01-07T10:48:37Z")

</div>

simply restart you wireguard network interface...  
sometimes, it need to be stopped then started again...

---

<div class="post-metadata">

**Author:** ![trentmu](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trentmu/32/16411_2.png) [@trentmu](https://forum.openwrt.org/u/trentmu)\
**Post date:** [January 7, 2020, 10:51am UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/3 "2020-01-07T10:51:27Z")

</div>

uhmm... that's what I'm trying to find the CLI command for.

I know I can use a broader network restart with  
`/etc/init.d/network restart`  
but I would prefer to ONLY restart WG, and not everything (if this is possible)

---

<div class="post-metadata">

**Author:** ![erdoukki](https://forum.openwrt.org/user_avatar/forum.openwrt.org/erdoukki/32/52960_2.png) [@erdoukki](https://forum.openwrt.org/u/erdoukki)\
**Post date:** [January 7, 2020, 11:01am UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/4 "2020-01-07T11:01:17Z")

</div>

```
ifconfig wg0 down
ifconfig wg0 up

```

may be it will do the trick... in one linked line ?

or with ip;  
`ip link set wg0 down && ip link set wg0 up`

---

<div class="post-metadata">

**Author:** ![trentmu](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trentmu/32/16411_2.png) [@trentmu](https://forum.openwrt.org/u/trentmu)\
**Post date:** [January 7, 2020, 11:15am UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/5 "2020-01-07T11:15:22Z")

</div>

Thanks for that - not sure why I didn't think to try it 😊

Alas, it does take the wg0 down  
`wgvpn0: ..... state DOWN mode DEFAULT group default qlen 1`  
but after the **up** (tried both command sets), it sets the state to  
`wgvpn0: ..... state UNKNOWN mode DEFAULT group default qlen 1`  
and the links don't re-establish.

If I click the restart in the GUI, they come up immediately

---

<div class="post-metadata">

**Author:** ![yousong](https://forum.openwrt.org/user_avatar/forum.openwrt.org/yousong/32/2111_2.png) [@yousong](https://forum.openwrt.org/u/yousong)\
**Post date:** [January 7, 2020, 1:54pm UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/6 "2020-01-07T13:54:19Z")

</div>

> [@trentmu](#):
>
> but I would prefer to ONLY restart WG, and not everything (if this is possible)

Find out name of the netifd interface and just do `ifup <iface>` as in `ifup wan`.

---

<div class="post-metadata">

**Author:** ![trentmu](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trentmu/32/16411_2.png) [@trentmu](https://forum.openwrt.org/u/trentmu)\
**Post date:** [January 7, 2020, 2:02pm UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/7 "2020-01-07T14:02:32Z")

</div>

YES! Thank you.  
I don't quite understand why this is OK while the `ip link/ifconfig up/down` fails, but it works

---

<div class="post-metadata">

**Author:** ![yousong](https://forum.openwrt.org/user_avatar/forum.openwrt.org/yousong/32/2111_2.png) [@yousong](https://forum.openwrt.org/u/yousong)\
**Post date:** [January 7, 2020, 2:21pm UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/8 "2020-01-07T14:21:41Z")

</div>

It boils down to

```
ubus call network.interface $mode "{ \"interface\" : \"$interface\" }"

```

where `$mode` as ubus method will be `down` then `up`

---

<div class="post-metadata">

**Author:** ![yousong](https://forum.openwrt.org/user_avatar/forum.openwrt.org/yousong/32/2111_2.png) [@yousong](https://forum.openwrt.org/u/yousong)\
**Post date:** [January 7, 2020, 2:39pm UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/9 "2020-01-07T14:39:24Z")

</div>

I assume ip link down

> [@trentmu](#):
>
> Alas, it does take the wg0 down  
> `wgvpn0: ..... state DOWN mode DEFAULT group default qlen 1`  
> but after the **up** (tried both command sets), it sets the state to  
> `wgvpn0: ..... state UNKNOWN mode DEFAULT group default qlen 1`  
> and the links don't re-establish.

That `UNKNOWN` is just expected.

I guess the difference is that when you do teardown/setup with netifd, the local listen port of wireguard interface change. From observers' point of view, it's new udp session. With ip link set down/up, the session is the same.

---

<div class="post-metadata">

**Author:** ![satheras](https://forum.openwrt.org/user_avatar/forum.openwrt.org/satheras/32/17017_2.png) [@satheras](https://forum.openwrt.org/u/satheras)\
**Post date:** [January 10, 2020, 6:31pm UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/10 "2020-01-10T18:31:51Z")

</div>

I am also just simply restarting the interface per cron script. The script runs every 20 minutes...

```
#!/bin/sh
#modified from https://openwrt.org/docs/guide-user/base-system/cron
#modified to use logger for global logging instead of scriptlogfile & added infinite reboot protection for reboot
# Prepare vars
DATE=$(date +%Y-%m-%d" "%H:%M:%S)
#logFile="/persistlogs/syslog"

# Ping and reboot if needed

#YOUR WIREGUARD PEER
CHECKHOSTNAME="192.168.X.X"

notification_email="YOUR@EMAIL.ADRESS"
VPNINTERFACE="wgvpn0"

ping -c3 $CHECKHOSTNAME

if [$? -eq 0]; then
    echo "ok"
    logger $(echo "${DATE} - $0: OK - $VPNINTERFACE UP AND RUNNING")

else
    echo "RESTART wgvpn0 Interface"
    logger $(echo "${DATE} - $0: NO VPN CONNECTION RESTART $VPNINTERFACE INTERFACE...")
    # Note: To avoid infinite reboot loop, wait 70 seconds and touch a file in /etc
    ifdown $VPNINTERFACE
    ifup $VPNINTERFACE
        echo Subject: $0: VPN $VPNINTERFACE has been restarted | sendmail -v "$notification_email"
fi

```

---

<div class="post-metadata">

**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\
**Post date:** [January 20, 2020, 6:31pm UTC](https://forum.openwrt.org/t/restart-wireguard-via-cli/51935/11 "2020-01-20T18:31:54Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.