hermes-skills/skills/devops/infrastructure-automation/references/wireguard-backup-fallback.md

WireGuard Backup Fallback Strategy

The home router backup script (/root/.hermes/scripts/wisp-backup/wisp-backup.py) now attempts WireGuard first before falling back to L2TP/IPsec.

Why

WireGuard is always-on (persistent keepalive), lower latency, and already configured. The old L2TP/IPsec connection was failing because the ppp0 interface never negotiated. Rather than debug L2TP, we use the working WireGuard tunnel and keep L2TP as a dead-code fallback.

How it works (in main())

The change was in main() — Step 1 of the backup process:

# Step 1: Try WireGuard first
vpn_was_connected = False
router_ip = cfg['towers'][0]['ip']  # e.g. 10.77.0.2
ping_check = subprocess.run(
    ["ping", "-c", "1", "-W", "2", router_ip],
    capture_output=True, timeout=5
)
if ping_check.returncode == 0:
    print(f"  [+] Router reachable at {router_ip} via WireGuard — skipping VPN")
else:
    print("  [-] Router not reachable, trying L2TP/IPsec VPN ...")
    if not run_vpn_script("up", script_dir):
        print("[-] VPN connection failed. Aborting.")
        sys.exit(1)
    vpn_was_connected = True

Tracking vpn_was_connected

The variable tracks whether WE brought up the VPN, so we don't tear it down at the end if WireGuard was already active:

• All run_vpn_script("down", script_dir) calls are now gated: if vpn_was_connected:
• Exits, dry-runs, and the final cleanup all check before tearing down

WireGuard status

• Interface: wg0 on Core (152.53.192.33)
• Peer: home router at 76.195.7.60:13231
• Handshake: every ~2 minutes
• Router IP over tunnel: 10.77.0.2
• Allowed IPs: 10.77.0.2/32, 10.10.10.0/24