I am building a Wireguard VPN network, in which I want to add and remove peers on the server without restarting the service or losing connections with existing peers. Tried searching for the results, but I found nothing that can suit my needs (all the solutions will cause a few second freeze or will require clients to redo handshake with server). Is it possible to implement this with Wireguard and if yes, how?
I'm working on a similar project, and my conclusion is that you're better off keeping all configuration inside your own database, and completely skipping wireguard config files for the peer setup. You might still want to use the wireguard config file for the
[Interface] section, which my example below uses. But you could do that programmatically too, should you need to.
So, assuming we have an interface called wg0, defined in
ListenPort = 51820
Address = 10.100.1.1
PrivateKey = <your private key>
In the above config, there are zero peers.
Add a new peer:
wg set wg0 peer "K30I8eIxuBL3OA43Xl34x0Tc60wqyDBx4msVm8VLkAE=" allowed-ips 10.101.1.2/32
ip -4 route add 10.101.1.2/32 dev wg0
Remove a peer:
wg set wg0 peer "K30I8eIxuBL3OA43Xl34x0Tc60wqyDBx4msVm8VLkAE=" remove
ip -4 route delete 10.101.1.2/32 dev wg0
As far as I know, this will not cause downtime for other peers.
The technique I used to figure out the
ip -4 route ... commands to run, is simply by using
wg-quick up wg0 and taking note of the commands that it spits out.
You can use
wg conjointly with
wg is a lower-level command, actually the one used by
wg-quick to really do WireGuard-specific configuration on the interface (along various
ip xxx commands for the base networking parts).
wg syncconf used conjointly with
wg-quick strip is intended to update settings without disruption for current peer communication with changed settings in the configuration file as documented in
Use strip to output a configuration file with all wg-quick(8)-specific options removed, suitable for use with wg(8).
The strip command is useful for reloading configuration files without disrupting active sessions:
# wg syncconf wgnet0 <(wg-quick strip wgnet0)
setconf, but reads back the existing configuration first and only makes changes that are explicitly different between the configuration file and the interface. This is much less efficient than
setconf, but has the benefit of not disrupting current peer sessions. The contents of must be in the format described by CONFIGURATION FILE FORMAT below.
So to repeat the example, if the configuration for interface
wg0, usually used with
wg-quick is in
/etc/wireguard/wg0.conf (or any other Distribution-specific place) and a
[Peer] section was just added (resp. removed) to this file, to make this peer available (resp. not available anymore) without disrupting communication with already configured peers, then run as root in a bash shell:
wg syncconf wg0 <(wg-quick strip wg0)
Some parts will have to be completed manually, since they are not handled by
wg, as described in
wg-quick's CONFIGURATION section: additional routes, iptables rules...