1

Wireguard setup instructions don't work for me on my OpenBSD 6.7 machine:

$ uname -a
OpenBSD foobar 6.7 GENERIC.MP#3 amd64
$ sysctl kern.version
kern.version=OpenBSD 6.7 (GENERIC.MP) #3: Thu Jul  9 07:21:14 MDT 2020
    root@syspatch-67-amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP

I believe that my system should have the kernel-space Wireguard driver (i.e., wg(4)) due to the output above.

By default, there are no Wireguard interfaces:

$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 32768
    index 3 priority 0 llprio 3
    groups: lo
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
    inet 127.0.0.1 netmask 0xff000000
vio0: flags=e48843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,INET6_NOPRIVACY,AUTOCONF6,INET6_NOSOII,AUTOCONF4>     mtu 1500
    lladdr 56:00:02:f5:e5:fa
    index 1 priority 0 llprio 3
    groups: egress
    media: Ethernet autoselect
    status: active
    inet6 fe80::5400:2ff:fef5:e5fa%vio0 prefixlen 64 scopeid 0x1
    inet 149.28.165.216 netmask 0xfffffe00 broadcast 149.28.165.255
    inet6 2401:c080:1800:4463:5400:2ff:fef5:e5fa prefixlen 64 autoconf pltime 604596 vltime 2591796
enc0: flags=0<>
    index 2 priority 0 llprio 3
    groups: enc
    status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33136
    index 4 priority 0 llprio 3
    groups: pflog

As there are also no man pages for Wireguard, I install wireguard-tools:

$ sudo pkg_add wireguard-tools
quirks-3.326 signed on 2020-09-09T17:39:55Z
wireguard-tools-1.0.20200319v0: ok
New and changed readme(s):
    /usr/local/share/doc/pkg-readmes/wireguard-tools

The man page for wg(4) provides these instructions for creating a Wireguard interface. This fails on my machine with:

$ ifconfig wg0 create wgport 111 wgkey `openssl rand -base64 32` rdomain 1
ifconfig: wgport: bad value
$ echo $?
1
$ sudo ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 32768
    index 3 priority 0 llprio 3
    groups: lo
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
    inet 127.0.0.1 netmask 0xff000000
re0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,AUTOCONF4> mtu 1500
    lladdr dc:4a:3e:d6:23:bd
    index 1 priority 0 llprio 3
    groups: egress
    media: Ethernet autoselect (100baseTX full-duplex)
    status: active
    inet 192.168.0.16 netmask 0xffffff00 broadcast 192.168.0.255
enc0: flags=0<>
    index 2 priority 0 llprio 3
    groups: enc
    status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33136
    index 4 priority 0 llprio 3
    groups: pflog
wg0: flags=8082<BROADCAST,NOARP,MULTICAST> mtu 1420
    index 26 priority 0 llprio 3
    groups: wg

Clearly, the wg0 interface is created, but the parameters are silently dropped (i.e., no private key, no port, and no rdomain).

2

1 Answer 1

1
+50

You aren't entirely clear on what version of the OS you are using. Note that wg wasn't available on 6.7-release and isn't available on 6.7-stable (i.e., -release plus patches). Your uname and sysctl kern.version suggests that you are using the latter. wg is available on -current, and FWIW works fine for at least a month now (I tested your command on a machine running a snapshot from Aug 15 ).

However you have (apparently) partial support for wg on ifconfig but no man page for it, which indicates that the kernel isn't synced with userland, as @A.B already noted.

Since the system already appears not to be following -stable, having been partially upgraded with a -current kernel, if wg is an urgent need, my advice would be to bring it all up to date with -current using sysupgrade -s (don't forget to upgrade the packages as well). Also, note that it shouldn't be long now before 6.8-release, which will have native wireguard support, so if the urgency of having wg doesn't outweigh the advantages for running -stable, you might just wait a couple of weeks and upgrade to 6.8-release when it comes out.

1
  • Thank you! You're correct, sysupgrade -s brought the system up-to-date with native Wireguard support and now the instructions I was following (xosc.org/wireguard.html) work!
    – jmcph4
    Sep 14, 2020 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.