Bug #14489
openFRR Needs VPN Linkup Initialization Detection
0%
Description
Hi,
FRR is currently started before completing Wireguard tunnels initialization:
[FRR startup]
2023-06-17 18:48:30 ,754 INFO: Called via "Namespace(input=None, reload=True, test=False, debug=False, log_level='info', stdout=False, pathspace=None, filename='/var/etc/frr/frr.conf', overwrite=False, bindir='/usr/local/bin', confdir='/var/etc/frr', rundir='/var/run/frr', vty_socket=None, daemon='')"
[Wireguard initialization]
Jun 17 18:48:31 fw1 kernel: wg2: changing name to 'tun_wg2'
Jun 17 18:48:31 fw1 kernel: tun_wg2: link state changed to UP
Note that Wireguard starts 1 second after FRR, but in FRR there are already references to the renamed interfaces, which doesn't exist until 1 second later. To workaround this I have to manually restart FRR after each boot.
Just delaying the startup of FRR until Wireguard is fully set up would be enough.
Regards
Updated by Tjabo T. about 1 year ago
Spike R.D. wrote:
Hi,
FRR is currently started before completing Wireguard tunnels initialization:
[FRR startup]
2023-06-17 18:48:30 ,754 INFO: Called via "Namespace(input=None, reload=True, test=False, debug=False, log_level='info', stdout=False, pathspace=None, filename='/var/etc/frr/frr.conf', overwrite=False, bindir='/usr/local/bin', confdir='/var/etc/frr', rundir='/var/run/frr', vty_socket=None, daemon='')"[Wireguard initialization]
Jun 17 18:48:31 fw1 kernel: wg2: changing name to 'tun_wg2'
Jun 17 18:48:31 fw1 kernel: tun_wg2: link state changed to UPNote that Wireguard starts 1 second after FRR, but in FRR there are already references to the renamed interfaces, which doesn't exist until 1 second later. To workaround this I have to manually restart FRR after each boot.
Just delaying the startup of FRR until Wireguard is fully set up would be enough.
Regards
+1 (fully patched system, same behavior and fix request)
Updated by Andrew Collings 9 months ago
I had the same issue so I wrote a system patch to sleep for 30 seconds at the beginning of frr.inc. It's janky, but it works for me. If anyone else wants to use it until there's a more permanent solution the patch and installation instructions are available at https://github.com/alc5440/pfSense-frr-delay/tree/main
Updated by Kris Phillips 12 days ago
- Status changed from New to Confirmed
- Affected Version changed from 2.7.x to 2.8.x
- Affected Plus Version set to 25.07
Updating affected version for both CE and Plus and marking Confirmed, as I've also seen this behavior.
Rather than adding an arbitrary "delay" into FRR, which while it may work is a hacky workaround, we should add detection to verify VPN processes are fully started before attempting connections to neighbors that utilize VPN links, as this could also greatly help IPSec VTI tunnels that can have similar behavior.
Updated by Kris Phillips 12 days ago
- Subject changed from FRR needs delayed startup to FRR Needs VPN Linkup Initialization Detection
Updating title