Wireguard Client Addition without restart

za flag

I am building a Wireguard VPN network, in which I want to add and remove peers on the server without restarting the service or losing connections with existing peers. Tried searching for the results, but I found nothing that can suit my needs (all the solutions will cause a few second freeze or will require clients to redo handshake with server). Is it possible to implement this with Wireguard and if yes, how?

cn flag

If wireguard is started by systemd, there is a command to ask wireguard to reload the configuration:

systemctl reload wg-quick@wg0

Should reload the configuration for the wg0 adapter without restarting the service, and without disrupting current connections.

cl flag

You can use wg conjointly with wg-quick. wg is a lower-level command, actually the one used by wg-quick to really do WireGuard-specific configuration on the interface (along various ip xxx commands for the base networking parts).

Its subcommand wg syncconf used conjointly with wg-quick strip is intended to update settings without disruption for current peer communication with changed settings in the configuration file as documented in wg-quick and wg's manpages:

Use strip to output a configuration file with all wg-quick(8)-specific options removed, suitable for use with wg(8).

The strip command is useful for reloading configuration files without disrupting active sessions:

# wg syncconf wgnet0 <(wg-quick strip wgnet0)

syncconf <interface> <configuration-filename>

Like setconf, but reads back the existing configuration first and only makes changes that are explicitly different between the configuration file and the interface. This is much less efficient than setconf, but has the benefit of not disrupting current peer sessions. The contents of must be in the format described by CONFIGURATION FILE FORMAT below.

So to repeat the example, if the configuration for interface wg0, usually used with wg-quick is in /etc/wireguard/wg0.conf (or any other Distribution-specific place) and a [Peer] section was just added (resp. removed) to this file, to make this peer available (resp. not available anymore) without disrupting communication with already configured peers, then run as root in a bash shell:

wg syncconf wg0 <(wg-quick strip wg0)

Some parts will have to be completed manually, since they are not handled by wg, as described in wg-quick's CONFIGURATION section: additional routes, iptables rules...

cdhowie avatar
in flag
Very nice answer. This should be the accepted answer.
Anton2319 avatar
za flag
Thanks for the answer, but will wg-strip work with wg addconf? First I want to modify config with wg addconf newpeer.conf, then I want to syncconf and apply those changes. Is it possible?
A.B avatar
cl flag
I did answer your question. If you have an other question, please submit an other one properly, with the correct context.

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.