Suppose I have a a wireguard network called
10.0.0.1/24. I use systemd to start it on boot:
# systemctl enable wg-quick@wg0
I want sshd to only listen on the wireguard address,
10.0.0.1, instead of
0.0.0.0. So I set the
ListenAddress 10.0.0.1 #ListenAddress :: AddressFamily inet
Note: I set the address family because I'm only using IPv4 and not IPv6 here. I think if it's not set, ssh will continue to listen to
:: on IPv6.
If I save the config and restart sshd, it works great. But after the server restarts, ssh fails to start, despite being enabled in systemd. The syslog output tells us why:
sshd[xxx]: error: Bind to port 22 on 10.0.0.1 failed: Cannot assign requested address.
Clearly, we have a race condition where sshd is trying (and failing) to start before the wireguard interface is ready.
The obvious solution is to edit
/etc/systemd/system/sshd.service and add
wg-quick@wg0 as a dependency. However, no combination of
Requires= does the trick. It seems that
wg-quick@wg0 reports that it's finished, even though the network interface isn't actually ready yet.