I am building a Wireguard VPN network, in which I want to add and remove peers on the server without restarting the service or losing connections with existing peers. Tried searching for the results, but I found nothing that can suit my needs (all the solutions will cause a few second freeze or will require clients to redo handshake with server). Is it possible to implement this with Wireguard and if yes, how?
2 Answers
You can use wg
conjointly with wg-quick
. wg
is a lower-level command, actually the one used by wg-quick
to really do WireGuard-specific configuration on the interface (along various ip xxx
commands for the base networking parts).
Its subcommand wg syncconf
used conjointly with wg-quick strip
is intended to update settings without disruption for current peer communication with changed settings in the configuration file as documented in wg-quick
and wg
's manpages:
Use strip to output a configuration file with all wg-quick(8)-specific options removed, suitable for use with wg(8).
The strip command is useful for reloading configuration files without disrupting active sessions:
# wg syncconf wgnet0 <(wg-quick strip wgnet0)
syncconf
<interface> <configuration-filename>Like
setconf
, but reads back the existing configuration first and only makes changes that are explicitly different between the configuration file and the interface. This is much less efficient thansetconf
, but has the benefit of not disrupting current peer sessions. The contents of must be in the format described by CONFIGURATION FILE FORMAT below.
So to repeat the example, if the configuration for interface wg0
, usually used with wg-quick
is in /etc/wireguard/wg0.conf
(or any other Distribution-specific place) and a [Peer]
section was just added (resp. removed) to this file, to make this peer available (resp. not available anymore) without disrupting communication with already configured peers, then run as root in a bash shell:
wg syncconf wg0 <(wg-quick strip wg0)
Some parts will have to be completed manually, since they are not handled by wg
, as described in wg-quick
's CONFIGURATION section: additional routes, iptables rules...
![](../../users/profiles/217515.webp)
- 9,037
- 2
- 19
- 37
-
Thanks for the answer, but will wg-strip work with wg addconf? First I want to modify config with wg addconf newpeer.conf, then I want to syncconf and apply those changes. Is it possible? – Anton2319 May 21 '22 at 17:07
-
I did answer your question. If you have an other question, please submit an other one properly, with the correct context. – A.B May 21 '22 at 17:59
I'm working on a similar project, and my conclusion is that you're better off keeping all configuration inside your own database, and completely skipping wireguard config files for the peer setup. You might still want to use the wireguard config file for the [Interface]
section, which my example below uses. But you could do that programmatically too, should you need to.
So, assuming we have an interface called wg0, defined in
/etc/wireguard/wg0.conf
[Interface]
ListenPort = 51820
Address = 10.100.1.1
PrivateKey = <your private key>
In the above config, there are zero peers.
Add a new peer:
wg set wg0 peer "K30I8eIxuBL3OA43Xl34x0Tc60wqyDBx4msVm8VLkAE=" allowed-ips 10.101.1.2/32
ip -4 route add 10.101.1.2/32 dev wg0
Remove a peer:
wg set wg0 peer "K30I8eIxuBL3OA43Xl34x0Tc60wqyDBx4msVm8VLkAE=" remove
ip -4 route delete 10.101.1.2/32 dev wg0
As far as I know, this will not cause downtime for other peers.
The technique I used to figure out the ip -4 route ...
commands to run, is simply by using wg-quick up wg0
and taking note of the commands that it spits out.
![](../../users/profiles/67603.webp)
- 111
- 2