Re: Problems with wireguard and maybe DDNS

Hey Greg, thanks for your response.

First, yes you're mostly correct.
Duckdns provides a url that resolves to an ip of your choice. The server 
device has a simple cronjob that calls Duckns' web-api every five 
minutes to update the ip the url points to.
The port thing is a bit different though.
The url is set to resolve to the current ip of the server (hence the 
cronjob, since the server is on a residential LAN), and the port is the 
port on the server that wireguard is listening to.
The NetBSD device is a laptop.
The only way my home router is involved is that I has a firewall rule 
set to allow incoming traffic to that port on the server with the 
protocol wireguard uses (udp I think).
The url does indeed look like foo.duckdns.org

Anyhow I found a man page for wg which suggests you can use an INI like 
config file like I would have on Linux and explicitly suggests you can 
use a url or an ip address to set the endpoint.
I'll get back to this tomorrow (GMT+1 time) when I'm off work.

Thanks for the help! Your explanations are very clear.
Also thanks for the other people replying to my thread.

Kind regards,

Martijn.


On 07-07-2026 00:56, Greg Troxel wrote:
> Martijn van Wely <[email protected]> writes:
>
>> I'm trying to add a NetBSD device to my wireguard network.
> Note that NetBSD does not have wireguard(tm) but it has wg which is
> compatible.
>
> Note that NetBSD 10 and later have wg(4) in the kernel, and on 9 there
> is some userland tools instead.  My advice, for just about any question,
> is make sure you are on 10 or an RC of 11.
>
>> Since the wireguard 'server' peer is in a homenetwork, I've configured
>> it to be reachable through duckdns.
> What does that mean?   I would expect:
>
>    some domain name e.g. foo.duckdns.com resolves to your public IP
>    address
>
>    you have configured  port 51280 on your router to forward to the wg
>    machine
>
> Is that right, or if not ??
>
>> On Debian Linux I would have a /etc/wireguard/wg0.conf like this for
>> one of the peers connecting to the server:
>>
>> [Interface]
>> PrivateKey = [this peer's private key]
>> Address = [this peer's ip adress]
>>
>> [Peer]
>> PublicKey = [server's public key]
>> PresharedKey = [a preshared key]
>> AllowedIPs = [the ip range]
>> Endpoint = [the duckdns url]:[listening port]
> URL?  What does that look like?  NetBSD wg wants endpoint to look like
> "IP-address:port".  See wgconfig(8).  wgconfig might take a name and do
> a lookup.  It might not.  See the sources for that, or try it.
>
>> And then you can activate it by running wg-quick wg0 up (or via the
>> init system: systemctl start wg-quick@wg0).
>>
>> I noticed that wg-quick isn't available after installing
>> wireguard-tools from pkgsrc (I guess because NetBSD's networking works
>> differently from most Linux distros?).
> Yes, networking was added to BSD quite a few years before Linux existed,
> and Linux has new/different interfaces for a lot of things.  The various
> BSDs are mostly similar, but new things like wg surely differ.
>
> I suppose one could make wg-quick use ifconfig/wgconfig.  I have no idea
> if anyone has tried or is motivated.
>
>> But after some googling I've found some examples of setting it up via
>> an ifconfig.if file with a bunch of calls to wgconfig.
>> Since the command-line arguments for wgconfig map pretty well on to
>> the lines in the wg0.conf I would normally write, I wrote this in
>> /etc/ifconfig.wg0:
> I think you absorbed this but lines with ! if /etc/ifconfig.foo0 are
> exactly commands that are run at network configuration time.  Lines
> without ! are arguments to an invocation of ifconfig foo0.
>
> You may or may not need to "!ifconfig wg0 create" first.
>
>> [the selected ip/range within the wg-network]
>> !wgconfig ${int} set private-key /etc/wireguard/private.key
>> !wgconfig ${int} add peer wgserver $(cat /etc/wireguard/public.key)
>>   --preshared-key=/etc/wireguard/preshared.key --allowed-ips=[the
>>   wg-network's ip-range] --endpoint=[the duckdns url]:[listening port]
>> up
> Here I think "the duckdns url" is probably trouble.
>
>> (also for context, yes they keys are stored as separate files in
>> /etc/wireguard. They're owned by root:wheel with chmod 600 permission
>> bits).
> Sure, but I would suggest naming them somehow with your local hostname
> and the servers, so that as you make things more complicated it will be
> easier to follow.
>
>> When I restart the network (by calling doas sh /etc/rc.d/network
>> restart) I get the following error message:
>> wg0wgconfig: getaddrinfo: hostname or servname not provided or not known.
> I would suggest running the commands one at a time by cutting and
> pasting, so you can understand more clearly what's going wrong.
>
>> getaddrinfo [duckdns url] does work though, but maybe there's a
>> problem with the fact that --endpoint is provided with a url:port
>> instead of a ip:port (the man page does specify ip:port)?
> I would expect this not to work.
>
>> getaddrinfo with [duckdns url]:[listening port] fails.
>> I've also tried quoting various part in the url and port in case it's
>> a shell parsing problem, but that didn't help either.
> I would hope that the hostname (not url) has just letters/numbers/period.
>
>> Anyhow, does anyone know how to configure NetBSD as a wireguard peer
>> when the other peer is behind a ddns url?
> I would suggest skipping ifconfig.wg0 and writing a script and calling
> the script from rc.local.  In the script, use getaddrinfo/host/dig or
> whatever and then grep/awk/sed/etc. to extract the IP address.
>
>> Also: I am relatively experienced with Linux but new to NetBSD, so am
>> I completely off base in how I should configure wireguard here in the
>> first place?
> You are not completely off base.  You're quite close, except:
>
>    you are saying "duckdns url" but I think you mean "hostname"
>
>    the man page says IP address.  Believe it, until you experiment and/or
>    read the source code.  It's in the procedure handle_option_endpoint.
>    It looks to me like addresses only.
>
> I have configured NetBSD as a wg server, and configured macOS, AOSP-ish,
> and iOS clients.
>    
> A hint is that in Linux ethernets tend to be eth0.  In BSD, interfaces
> are named for the hardware type, and there's no assumption that there is
> a primary ethernet eth0.  This may be less true in Linux now.
>
>> Also also, I'm new to mailing lists, so please say if I'm breaking
>> some kind of etiquette or formatting rule.
> Welcome to NetBSD, and you are doing great!
>
> The basic etiquette guidelines are (IMHO of course):
>
>    - Don't post LLM output, and don't ask humans to debug or enhance LLM
>      output as in ("I got AI advice to do X, but what should I do next").
>    - Write to one list only; pick the best one.
>    - When replying to someone helping you, keep the reply on list.
>    - Don't reply to a message to start a new topic.
>    - Send plain text messages.
>    - When replying, don't top post, and trim text except when it's needed
>      for context for something you are saying.
>    - Quote properly; don't tell people that your text is in green or some
>      other HTMLism.
>    - If you are sending logs or some other machine output, don't wrap it.
>      If your MUA can't handle that, attach a text file.  (Wrapped logs
>      are very hard to read.)
>
> Your first message was 100% compliant.  "netbsd-users@" is exactly the
> right list.