WireGuard / wireguard-vyatta-ubnt

WireGuard for Ubiquiti Devices
https://www.wireguard.com/
GNU General Public License v3.0
1.46k stars 68 forks source link

Config validation fails if a peer endpoint is a hostname and DNS fails #95

Open poisonsnak opened 2 years ago

poisonsnak commented 2 years ago

If a peer endpoint address is a hostname, and the router doesn't have working DNS, the config won't validate. So in this example:

interfaces wireguard wgX peer [peer-pubkey] endpoint [peer-address]:[peer-port]

if [peer-address] is mydomain.com and you don't have working DNS, the config will fail to validate. If the router is booting and has no DNS, then the endpoint is removed from the running config. So long as you catch it, you can fix it by entering config mode, loading the config, and committing it.

If the router is running with no DNS, and you try to add the endpoint to the config, it won't let you, you get an error:

Try again: '[peer-address]:[peer-port]'. Trying again in 1.00 seconds...

It retries with increasing intervals (1.20, 1.44 ... 12.84) and then gives up with Commit failed.

If [peer-address] is an IP address in these situations, the config validates.

This probably isn't a common issue, but I ran into it because a router of mine died. So I grabbed a spare and loaded a backup for the dead one. When I do this I'm connected to a LAN port on the spare and there's no WAN connection, so it has no internet or DNS.

Ran into this on an ER-X SFP, on 2.0.9-hotfix.2, using e50-v2-v1.0.20210606-v1.0.20210424.deb. It isn't a huge issue, but I thought I would mention it in case anyone else ran into it. Thanks.

vchrizz commented 1 year ago

Agree, this is not a huge issue, but (in my opinion) clearly wrong. I had this exact issue also in https://github.com/WireGuard/wireguard-vyatta-ubnt/issues/124 . Today, preparing a new router for another location, I had this same issue again, because the router was not yet connected to the internet and I could not commit/save the configuration. Workaround was to omit the endpoint setting then set and commit/save the endpoint as soon as the router was online.

damadmai commented 1 year ago

In my opinion the settings should not be changed in config tree automatically if DNS is not working. It should be kept simple so no edge cases which were not thaugt of in advance like this can happen.