Re: Problems with wireguard and maybe DDNS - SOLVED

[Martijn van Wely <martijnvanwely%mailbox.org@localhost>]

Hi all!

A while back I started this thread.
I'm happy to report I've found a configuration that works!
So if anyone else is running into this issue, here's my solution:

Long story short: yes wgconfig, unlike wg-quick on linux, can't make use 
of ddns hostnames, urls, however you're supposed to call them. It needs 
a ip-address:port combination to set the endpoint of a given peer.
Luckily, getaddrinfo can actually resolve the ddns hostname and provide 
the current IP address of the server peer (tested on NetBSD 10.1 amd64).

So I now have this working ifconfig.IF file:

---------------<ifconfig.wg0>------------------------

[host's ip within the wg network]
!wgconfig ${int} set private-key [path to private key file]
!wgconfig ${int} add peer [peername] [peer's public key] 
--preshared-key=[path to preshared-key file] --allowed-ips=[allowed ip 
range in peer's network] --endpoint=$(getaddrinfo [ddns hostname] | awk 
'NR==1 {print $4; exit 0}'):[peer's listening port]
up

------------------------------------------------------------

Of course this only works for a limited time since the peer is behind a 
residential IP.
So we just fix it by re-adding the peer.

I wrote this script for it:

----------<wg-ip-updater>--------------------------

#!/bin/sh

if test $# -ne 7
then
            echo 'usage: wg-ip-updater interface peer public-key 
preshared-key-path allowed-ips hostname port'
            exit 1
fi

int=$1
peer=$2
pubkey=$3
preshared=$4
ips=$5
host=$6
port=$7

case $(ifconfig ${int} | awk '/status/ {print $NF; exit 0}') in
            active)
                            # update peer
                            endpoint=$(getaddrinfo ${host} | awk 'NR==1 
{print $4; exit 0}'):${port}

                            wgconfig ${int} delete peer ${peer}
                            wgconfig ${int} add peer ${peer} \
                                             ${pubkey} \
 --preshared-key=${preshared} \
                                             --allowed-ips=${ips} \
 --endpoint=${endpoint}

                            ;;
esac

------------------------------------------------------------

Then just install that to wherever you think is appropriate (I went with 
/usr/local/sbin).
And then add it to root's crontab with the appropriate arguments.
I have it set to run every five minutes, since that is how often the 
peer device sends an updated ip-address to the dns provider.

There's probably ways to improve the script, like only updating things 
when the peer's ip-address has actually changed, but this works for now.
If anyone knows how to actually fix this without running this cronjob, 
of course please share.
This solution is fairly duct-tape-y.

Thanks to all the people who replied, your suggestions where very 
helpful in figuring things out.

Kind regards,

Martijn



On 06-07-2026 22:57, Martijn van Wely wrote:
> Hi!
>
> I'm trying to add a NetBSD device to my wireguard network.
> Since the wireguard 'server' peer is in a homenetwork, I've configured 
> it to be reachable through duckdns.
> On Debian Linux I would have a /etc/wireguard/wg0.conf like this for 
> one of the peers connecting to the server:
>
> [Interface]
> PrivateKey = [this peer's private key]
> Address = [this peer's ip adress]
>
> [Peer]
> PublicKey = [server's public key]
> PresharedKey = [a preshared key]
> AllowedIPs = [the ip range]
> Endpoint = [the duckdns url]:[listening port]
>
> And then you can activate it by running wg-quick wg0 up (or via the 
> init system: systemctl start wg-quick@wg0).
>
> I noticed that wg-quick isn't available after installing 
> wireguard-tools from pkgsrc (I guess because NetBSD's networking works 
> differently from most Linux distros?).
> But after some googling I've found some examples of setting it up via 
> an ifconfig.if file with a bunch of calls to wgconfig.
> Since the command-line arguments for wgconfig map pretty well on to 
> the lines in the wg0.conf I would normally write, I wrote this in 
> /etc/ifconfig.wg0:
>
> [the selected ip/range within the wg-network]
> !wgconfig ${int} set private-key /etc/wireguard/private.key
> !wgconfig ${int} add peer wgserver $(cat /etc/wireguard/public.key) 
> --preshared-key=/etc/wireguard/preshared.key --allowed-ips=[the 
> wg-network's ip-range] --endpoint=[the duckdns url]:[listening port]
> up
>
> (also for context, yes they keys are stored as separate files in 
> /etc/wireguard. They're owned by root:wheel with chmod 600 permission 
> bits).
>
> When I restart the network (by calling doas sh /etc/rc.d/network 
> restart) I get the following error message:
> wg0wgconfig: getaddrinfo: hostname or servname not provided or not known.
>
> getaddrinfo [duckdns url] does work though, but maybe there's a 
> problem with the fact that --endpoint is provided with a url:port 
> instead of a ip:port (the man page does specify ip:port)?
> getaddrinfo with [duckdns url]:[listening port] fails.
> I've also tried quoting various part in the url and port in case it's 
> a shell parsing problem, but that didn't help either.
>
> Anyhow, does anyone know how to configure NetBSD as a wireguard peer 
> when the other peer is behind a ddns url?
>
> Also: I am relatively experienced with Linux but new to NetBSD, so am 
> I completely off base in how I should configure wireguard here in the 
> first place?
> Also also, I'm new to mailing lists, so please say if I'm breaking 
> some kind of etiquette or formatting rule.
>
> Kind regards,
>
> Martijn.