A question re. #wireguard
from alvaro@social.graves.cl to selfhosted@lemmy.world on 06 Oct 18:36
https://social.graves.cl/notes/9z1hntawxnak0010

A question re. #wireguard

When I’m away from home I usually connect to my home (US) and my server (Europe). However sometimes (not always) the connection to my home is blocked, I don’t know if it is caused by my phone company or my ISP. I blame the latter, because the connection to my european server never fails.

I wonder if there is something I can do in those cases?
I guess I could try to redirect the traffic to use the european server as a proxy, but that would make things slower the 90% of the time this isn’t a problem. Also, this would require me to switch wireguard connections manually, which is not ideal, especially if I’m driving.

Another alternative would be tailscale (maybe with headscale), but I’d rather keep my infrstructure as wireguard only.

Any ideas? cc @selfhosted@lemmy.world @selfhost@lemmy.ml

#selfhosted #wireguard

threaded - newest

just_another_person@lemmy.world on 06 Oct 18:56 next collapse

If Wireguard loses its connection, it doesn’t automatically requery the host and reconnect AFAIK. So if name resolution fails, or you’re on dynamic DNS and the IP changes, it’s not going to fix itself.

alvaro@social.graves.cl on 06 Oct 19:13 next collapse

@just_another_person@lemmy.world the name resolution is not the issue, the ip hasn't changed

just_another_person@lemmy.world on 06 Oct 19:46 next collapse

Then try setting PersistentKeepalive on the client

alvaro@social.graves.cl on 06 Oct 20:37 collapse

@just_another_person@lemmy.world no, the issue is not keepalive, since it cannot connect in the first place... moving to another wifi (instead of celullar) works fine, so it is not a problem with my configuration.

just_another_person@lemmy.world on 06 Oct 20:44 collapse

You might want to put these pertinent details in your post.

If you’re on a cellular network that has CGNAT, Wireguard may not be able to work. Same deal if it’s an IPv6 network.

alvaro@social.graves.cl on 06 Oct 21:02 collapse

@just_another_person@lemmy.world Thanks, but I did

However sometimes (not always) the connection to my home is blocked,
I guess tailscale will have to do

just_another_person@lemmy.world on 06 Oct 21:24 collapse

Tailscale is Wireguard. If it works, then something is wrong with your Wireguard configs.

alvaro@social.graves.cl on 06 Oct 21:53 collapse

@just_another_person@lemmy.world Tailscale is way more than WireGuard but ok

just_another_person@lemmy.world on 06 Oct 22:14 collapse

Friend…Tailscale uses the same Wireguard protocol as everything else. If Tailscale is working, but your solo configs aren’t, it’s not a Wireguard problem, it’s a config problem. Guaranteed.

alvaro@social.graves.cl on 06 Oct 22:47 collapse

@just_another_person@lemmy.world

I never said my config is not working, I said sometimes (some cellular connections, but not all) it is not working, that is a huge difference.


I highly recommend you educate yourself a bit https://tailscale.com/compare/wireguard
https://tailscale.com/blog/how-tailscale-works#DERP

TLDR

Tailscale is built on TOP of Wireguard, but has a few goodies that Wireguard doesn't provide.

just_another_person@lemmy.world on 06 Oct 22:56 collapse

Lol. You just don’t get it.

lorentz@feddit.it on 07 Oct 05:08 collapse

Could it be that the domain name has both IPv4 and IPv6 and depending on the network you try to reach one or another? Wireguard can work on both protocols, but from my experience it doesn’t try both to see which one works (like browsers do). So if at the first try the dns resolves the “wrong” IP version, wireguard cannot connect and doesn’t fallback trying the alternative.

sugar_in_your_tea@sh.itjust.works on 06 Oct 19:46 next collapse

And by default, WireGuard doesn’t keep the connection alive when there’s no traffic. You can tune this in settings, which I’ve done because I’m behind CGNAT and need a persistent connection.

MangoPenguin@lemmy.blahaj.zone on 06 Oct 21:57 collapse

Yeah this is why OpenVPN is better for roaming clients in most cases.

vividspecter@lemm.ee on 06 Oct 23:15 collapse

Or just use tailscale/headscale/netbird and keep the underlying wireguard performance.

MangoPenguin@lemmy.blahaj.zone on 07 Oct 12:29 collapse

Tailscale in my experience does not run as kernel mode wireguard so performance is not great, but maybe that’s changed.

Not sure about Netbird, but the Android app reviews are poor and it does not sound reliable.

schizo@forum.uncomfortable.business on 06 Oct 19:26 next collapse

You can run some scripts that will update DNS resolution and reconnect if the connection goes inactive, but those aren’t going to be something you likely can do on your phone. (Though, IDK, you might could if we’re talking rooted android, but eh, I wouldn’t want to rely on it).

Do you know WHY your connection fails? Is it JUST wireguard, is it your whole connection, does the IP change, etc? You might want to setup proper monitoring to see what exactly stops working when Wireguard does to see if it’s specific to the service, or if your whole link goes down, or if your router is crashing and rebooting or any number of other problems you could be having.

undefined@links.hackliberty.org on 07 Oct 05:04 collapse

If you’re just looking for WireGuard with some good support for hostile networks (and easier configuration) I’d probably just recommend Tailscale.