45 lines
1.6 KiB
Markdown
45 lines
1.6 KiB
Markdown
# WireGuard Backup Fallback Strategy
|
|
|
|
The home router backup script (`/root/.hermes/scripts/wisp-backup/wisp-backup.py`) now attempts WireGuard first before falling back to L2TP/IPsec.
|
|
|
|
## Why
|
|
|
|
WireGuard is always-on (persistent keepalive), lower latency, and already configured. The old L2TP/IPsec connection was failing because the ppp0 interface never negotiated. Rather than debug L2TP, we use the working WireGuard tunnel and keep L2TP as a dead-code fallback.
|
|
|
|
## How it works (in main())
|
|
|
|
The change was in `main()` — Step 1 of the backup process:
|
|
|
|
```python
|
|
# Step 1: Try WireGuard first
|
|
vpn_was_connected = False
|
|
router_ip = cfg['towers'][0]['ip'] # e.g. 10.77.0.2
|
|
ping_check = subprocess.run(
|
|
["ping", "-c", "1", "-W", "2", router_ip],
|
|
capture_output=True, timeout=5
|
|
)
|
|
if ping_check.returncode == 0:
|
|
print(f" [+] Router reachable at {router_ip} via WireGuard — skipping VPN")
|
|
else:
|
|
print(" [-] Router not reachable, trying L2TP/IPsec VPN ...")
|
|
if not run_vpn_script("up", script_dir):
|
|
print("[-] VPN connection failed. Aborting.")
|
|
sys.exit(1)
|
|
vpn_was_connected = True
|
|
```
|
|
|
|
## Tracking `vpn_was_connected`
|
|
|
|
The variable tracks whether WE brought up the VPN, so we don't tear it down at the end if WireGuard was already active:
|
|
|
|
- All `run_vpn_script("down", script_dir)` calls are now gated: `if vpn_was_connected:`
|
|
- Exits, dry-runs, and the final cleanup all check before tearing down
|
|
|
|
## WireGuard status
|
|
|
|
- Interface: wg0 on Core (152.53.192.33)
|
|
- Peer: home router at 76.195.7.60:13231
|
|
- Handshake: every ~2 minutes
|
|
- Router IP over tunnel: 10.77.0.2
|
|
- Allowed IPs: 10.77.0.2/32, 10.10.10.0/24
|