Gateway on OPNSense with MFA disconnects after random 2-10 minutes...

[teon]

@wojcik91 can you add your logs from client & gw - you had disconencetd sessions

[wojcik91]

In my case it seems the issue was incorrect configuration of our services. The client itself worked correctly.

Disconnecting peers is done based on interface stats collected from the gateway. In this situation relevant parameters looked as follows:

• stats period: 60s
• peer disconnect threshold: 180s
• peer disconnect task iteration: 60s Since wireguard handshake happens around every 2 minutes (and sometimes more) it seems feasible that a client could be prematurely disconnected. Before the next test I increased the disconnect threshold to 5 minutes and stats frequency to 30s.

[wojcik91]

• GW fix was implemented in https://github.com/DefGuard/wireguard-rs/pull/53
• settings were adjusted

What still needs to be done (probably as a separate task):

• debug & fix Windows client
• release new version of the gateway
• do another round of testing