search

MichaIng / DietPi

Lightweight justice for your single-board computer!
https://dietpi.com/
GNU General Public License v2.0
4.76k stars 494 forks source link

WireGuard not work on NanoPi R5S #5677

Closed 3735943886 closed 1 year ago

3735943886 commented 2 years ago

Creating a bug report/issue

Required Information

Additional Information (if applicable)

Steps to reproduce

  1. sudo apt install wireguard
  2. sudo reboot
  3. create wg0.conf file
  4. sudo wg-quick up wg0

Expected behaviour

Actual behaviour

Joulinar commented 2 years ago

Why not using dietpi-software to install Wireguard? This will setup everything needed.

MichaIng commented 2 years ago

I'll check whether the module is actually shipped with the kernel. Would be bad if not, given that it's a router device. Otherwise we need to host the kernel headers package, which isn't a big issue.

3735943886 commented 2 years ago

Why not using dietpi-software to install Wireguard? This will setup everything needed.

I'm afraid but I couldn't find wireguard from dietpi-software. Shall I use PiVPN? screenshot

I'll check whether the module is actually shipped with the kernel. Would be bad if not, given that it's a router device. Otherwise we need to host the kernel headers package, which isn't a big issue.

Thank you for prompt answer.

Joulinar commented 2 years ago

Ah probably it's disabled. Can you check

dietpi-software list | grep wire

3735943886 commented 2 years ago

Ah probably it's disabled. Can you check

dietpi-software list | grep wire

dietpi@DietPi:~$ sudo dietpi-software list | grep wire
ID 117 | =0 | PiVPN: openvpn/wireguard server install & management tool | +Git | https://dietpi.com/docs/software/vpn/#pivpn
ID 172 | =0 | WireGuard: an extremely simple yet fast and modern VPN | DISABLED for NanoPi R5S (aarch64) | https://dietpi.com/docs/software/vpn/#wireguard

It was disabled, as expected.

Joulinar commented 2 years ago

ok can you check if the kernel module is shipped with actual kernel version?

dpkg-query -S '/lib/modules/*/wireguard.ko*'
modinfo wireguard
3735943886 commented 2 years ago

ok can you check if the kernel module is shipped with actual kernel version?

dpkg-query -S '/lib/modules/*/wireguard.ko*'
modinfo wireguard
dietpi@DietPi:~$ dpkg-query -S '/lib/modules/*/wireguard.ko*'
dpkg-query: no path found matching pattern /lib/modules/*/wireguard.ko*
dietpi@DietPi:~$ sudo modinfo wireguard
modinfo: ERROR: Module wireguard not found.
dietpi@DietPi:~$

I noticed that wireguard tried to install linux-image during dependency check. And I guess it's an unusual behavior.

dietpi@DietPi:~$ sudo apt install wireguard
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
cpio initramfs-tools initramfs-tools-core klibc-utils libklibc linux-base
linux-image-5.10.0-16-rt-arm64 linux-image-rt-arm64 wireguard-tools
Suggested packages:
libarchive1 linux-doc-5.10 debian-kernel-handbook openresolv | resolvconf
Recommended packages:
busybox | busybox-static pigz apparmor
The following NEW packages will be installed:
cpio initramfs-tools initramfs-tools-core klibc-utils libklibc linux-base
linux-image-5.10.0-16-rt-arm64 linux-image-rt-arm64 wireguard
wireguard-tools
0 upgraded, 10 newly installed, 0 to remove and 0 not upgraded.
Need to get 45.4 MB of archives.
After this operation, 255 MB of additional disk space will be used.
Do you want to continue? [Y/n] n
Abort.
dietpi@DietPi:~$

I tried compile wireguard source codes but failed because linux-headers not found.

dietpi@DietPi:~$ sudo apt install linux-headers-$(uname -r)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package linux-headers-5.10.110
E: Couldn't find any package by glob 'linux-headers-5.10.110'
dietpi@DietPi:~$
Joulinar commented 2 years ago

Ok something we would need to check if and how the kernel header package is available.

Joulinar commented 2 years ago

@MichaIng did you already find time to check for the headers package? There is another user on the forum looking for this package https://dietpi.com/forum/t/unable-to-install-linux-headers/13971

MichaIng commented 2 years ago

Please try this:

cd /tmp
curl -O 'https://dietpi.com/downloads/binaries/linux-headers-nanopi5.deb'
dpkg -i linux-headers-nanopi5.deb
rm linux-headers-nanopi5.deb
sed -i 's/13]=0/76]=1/' /boot/dietpi/dietpi-software
dietpi-software install 172

.... okay no idea, it fails here with two strange errors:

------------------------------
Deleting module version: 1.0.20210219
completely from the DKMS tree.
------------------------------
Done.
Loading new wireguard-1.0.20210219 DKMS files...
It is likely that 5.10.110 belongs to a chroot's host
Building for 5.10.110
Building initial module for 5.10.110
Error!  The /var/lib/dkms/wireguard/1.0.20210219/5.10.110/aarch64/dkms.conf for module wireguard includes a BUILD_EXCLUSIVE directive which
does not match this kernel/arch.  This indicates that it should not be built.
Skipped.

I hope the new image does not have these strange issue, being seen as chroot by DKMS and thinking the kernel/arch does not match...

Joulinar commented 2 years ago

it fails here with two strange errors:

Yup fails on my device as well. Let's hope you are able to create a new image. 👍

HeyMeco commented 1 year ago

@MichaIng did you already find time to check for the headers package? There is another user on the forum looking for this package https://dietpi.com/forum/t/unable-to-install-linux-headers/13971

@MichaIng if you by any chance haven't seen it: The "Debian 10(buster) Desktop" image from friendlyelec's google drive should have the right headers.deb in /opt/

else this https://github.com/friendlyarm/sd-fuse_rk3568/blob/master/test/test-build-kernel-header-deb.sh looks like it could be easily modified with the dietpi image

HeyMeco commented 1 year ago 
cd /tmp
curl -O 'https://dietpi.com/downloads/binaries/linux-headers-nanopi5.deb'
dpkg -i linux-headers-nanopi5.deb
rm linux-headers-nanopi5.deb
sed -i 's/13]=0/76]=1/' /boot/dietpi/dietpi-software
dietpi-software install 172

Nvm I just saw that you guys were already that far.

HeyMeco commented 1 year ago

Okay I think I found the reason why it's not included: https://github.com/ariaboard-com/rockchip_rk3568_buildroot/blob/rk356x-novotech/configs/rockchip_rk3568_defconfig

doesn't have the: "BR2_PACKAGE_WIREGUARD_LINUX_COMPAT=y BR2_PACKAGE_WIREGUARD_TOOLS=y" set.

I couldn't find "friendlyelec_rk3568_defconfig" but since FriendlyElec's Buildroot is based on Rockchips that error probably made it through to the kernel we use.

MichaIng commented 1 year ago

I generated a new image: https://dietpi.com/downloads/images/DietPi_NanoPiR5S-ARMv8-Bullseye.7z This is still based on FriendlyELEC image, but the FriendlyWRT one, which contains the WireGuard module. However, I completely recreated the root filesystem via debootstrap and copied only the kernel modules from FriendlyWRT over.

Boots and works fine so far. What somehow does not work anymore is the Ethernet LEDs. This is probably related to the fact that I didn't add any custom firmware from here: https://github.com/friendlyarm/sd-fuse_rk3568/tree/master/prebuilt/firmware Testing now whether I can fix this with some particular firmware files.

MichaIng commented 1 year ago

Found it:

modprobe ledtrig-netdev
Joulinar commented 1 year ago

ahh I'm away from home but with remote access to my R5S. I guess I'm not able to flash it until I'm back 🤣

MichaIng commented 1 year ago

Good to know: All the firmware on FriendlyELEC's image match the ones from the Debian firmware- packages 100% in size, as far as I checked. So it's really only the kernel modules which we need to place into the rootfs, aside of plain Debian.

HeyMeco commented 1 year ago

Is https://dietpi.com/downloads/images/DietPi_NanoPiR5S-ARMv8-Bullseye.7z the newest iteration of what needs testing? I can check it on mine

MichaIng commented 1 year ago

Yes, it would be great if you could give it a try.

HeyMeco commented 1 year ago

Running dpkg-query -S '/lib/modules/*/wireguard.ko*' modinfo wireguard results in:

firmware-nanopi5: /lib/modules/5.10.110/wireguard.ko filename: /lib/modules/5.10.110/wireguard.ko alias: net-pf-16-proto-16-family-wireguard alias: rtnl-link-wireguard version: 1.0.0 author: Jason A. Donenfeld <Jason@zx2c4 .com> //space added manually by me description: WireGuard secure network tunnel license: GPL v2 srcversion: 4198DFE47D68B6762A7E633 depends: libcurve25519-generic,libblake2s,udp_tunnel,libchacha20poly1305,ip6_udp_tunnel intree: Y name: wireguard vermagic: 5.10.110 SMP mod_unload modversions aarch64

and doing a systemctl start wg-quick@... worked. Confirmed it with speedtest-cli during which htop reported around 45% CPU Usage

MichaIng commented 1 year ago

Great. So I can move this to stable downloads.

Btw, one issue I still have with the Ethernet LEDs:

Based on this issue btw: https://github.com/MichaIng/DietPi/issues/5679

This issue however seems to be the same on official FriendlyELEC images, at least they do exactly the same we do.

HeyMeco commented 1 year ago

Not sure if it was a one time thing but I installed wireguard with the initial install dialogue. When that whole process was completed for some reason my R5S couldn't resolve DNS until I rebooted it.

MichaIng commented 1 year ago

Hmm, not sure. The WireGuard server (start) shouldn't have any effect on the host systems DNS, which is defined only by /etc/resolv.conf. I'll try to replicate.

3735943886 commented 1 year ago

Great. So I can move this to stable downloads.

Thank you for great work.

Btw, one issue I still have with the Ethernet LEDs:

  • They all are lit on boot even if no cable is connected.

  • Once I attach and detach a cable, they correctly turn off, and on again once cable is re-connected.

Based on this issue btw: https://github.com/MichaIng/DietPi/issues/5679

  • The /sys/class/leds/*_led/link can be used to turn on/off each light, but when turning it off, it doesn't automatically turn on again when attaching a cable, only the other way round.

  • Also on boot it needs to be turned on manually once to react to attaching/detaching Ethernet cables.

  • What is missing is to have them listening on cable connection without forcing them lit on boot, or otherwise a way to turn off the LEDs again if no cable is connected, without breaking them to lit again once a cable is connected.

This issue however seems to be the same on official FriendlyELEC images, at least they do exactly the same we do.

ifplugd might be helpful?

MichaIng commented 1 year ago

ifplugd can be configured to run commands if cables are connected or disconnected. We can also check for cable connectivity via ethtool. However, the problem really is that I'm not aware of any command which could do what we need, using the ledtrig-netdev kernel driver. Skipping the kernel driver (and doing everything manually with ifplugd) isn't possible either, because the driver needs to be loaded for the ability to toggle the LEDs.

It really is only needed to somehow turn off the LED once at boot, if no cable is connected, without disabling the kernel drivers autodetection, or, turning on autodetection without forcefully turning on the LED 🤔.

Joulinar commented 1 year ago

Not a solution, but I disabled all LED completely 🤣