Wireguard: Peer IP check

Anyone using Wireguard with peers whose IP address changes (e.g. because they are on a private DSL connection) must regularly check the IP address.

Wireguard itself only does DNS resolution when the interface is started to get the current IP address of the peer. However, if, for example, the server's address changes, the connection will eventually fail.

Fortunately, this can be intercepted with a small script, which is executed e.g. every 10 minutes. One approach is the Script in the Ubuntu documentation for Wireguardwhich didn't work on my Debian client (and also seemed a bit complicated).

#!/bin/bash
# Check status of the interface
# wg0-client: Name of the interface to be checked
# mypeer.dyndns.net: the name of the peer whose IP should be checked
        
cip=$(wg show wg0-client endpoints | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
echo "$cip"
digIP=$(dig +short mypeer.dyndns.net) # The address of the peer must be adjusted
   echo "$digIP"
     if [ "$digIP" != "$cip" ]
       then
          echo "Data is different"
          /usr/sbin/service wg-quick@wg0-client restart
            
        else
	  echo "Data are equal"
	  1TP3Nothing to do
	 fi

The main elements of the script above: in line 6, using the wireguard-tools and grep, the current IP address used by the interface is determined. In line 8 it checks which IP address the peer currently has. If these two values differ, the wireguard interface is restarted in line 13 - then the IP address is also resolved again and the connection is established again.

The restart of the Wireguard interface on line 13 may need to be adjusted, depending on what the interface is actually called in your setup.

There are of course other approaches to IP resolution, but for my setup this is a very simple way. One disadvantage: if there are several peers, this approach does not work that easily - then you would have to determine the right peer via regex first, and then read out the corresponding data there.

This script is necessary for maintaining the connection in my FreeNAS Replications Setupwhich now works with Wireguard.

Addition: IP check with multiple peers

If you have entered several peers in your wireguard configuration (e.g. a static connection and once the dial-in via a smartphone for a VPN), you may only want to perform the IP check described here for one peer. The easiest way is to additionally check for a specific peer. Starting from the following peer configuration (whose values do not correspond to a real peer):

[Peer]
PublicKey = mhzqblUOAzxVhOypkidxLnxp5rfYD7uRtvyj0sOi4GE=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = mypeer.dyndns.net:51820

The first line in the check script must be adjusted accordingly:

cip=$(wg show wg0-client endpoints | grep -E "mhzqblUO" | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}") 	

Completely it looks like this:

#!/bin/bash
# Check status of the interface
# wg0-client: Name of the interface to be checked
# mypeer.dyndns.net: the name of the peer whose IP should be checked
        
cip=$(wg show wg0-client endpoints | grep -E "mhzqblUO" | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}")
echo "$cip"
digIP=$(dig +short mypeer.dyndns.net) # The address of the peer must be adjusted
   echo "$digIP"
     if [ "$digIP" != "$cip" ]
       then
          echo "Data is different"
          /usr/sbin/service wg-quick@wg0-client restart
            
        else
	  echo "Data are equal"
	  1TP3Nothing to do
	 fi

It is important to note that the check script will not work in the variant with certain peers if you do not replace the corresponding value with the one from your setup. In my setup I run it every 5min, so far it has served its purpose so far. Since it is only a pure comparison of the IP address, it should also work in an IPv6 setup - but since I still use a classic telecom connection with IPv4, I didn't deal with this topic in detail. If anyone of the readers has any experience with this (also concerning DynDNS and IPv6 on the Fritzbox) feel free to leave something in the comments!