36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
# WireGuard Backup Pipe for Home Router
|
|
|
|
Deployed Jul 9, 2026. The home router backup now uses WireGuard instead of L2TP/IPsec.
|
|
|
|
## Why WireGuard over L2TP/IPsec
|
|
|
|
- WireGuard is always-on — no tunnel setup/teardown delay (handshake happens in seconds)
|
|
- L2TP/IPsec was failing to bring up `ppp0` interface despite IPsec phase succeeding
|
|
- WireGuard was already configured on both sides — the backup script just wasn't using it
|
|
- Lower latency: 37ms vs longer for multi-protocol negotiation
|
|
|
|
## How the backup script chooses
|
|
|
|
The modified `wisp-backup.py` now:
|
|
|
|
1. Pings the router at `10.77.0.2` (WireGuard tunnel IP) with a 2-second timeout
|
|
2. If reachable — skips VPN entirely, uses WireGuard directly
|
|
3. If unreachable — falls back to L2TP/IPsec VPN
|
|
4. Tracks `vpn_was_connected` flag to avoid unnecessary VPN teardown
|
|
|
|
## WireGuard peer status
|
|
|
|
- Local interface: `wg0` on Core (152.53.192.33)
|
|
- Peer: home router at `76.195.7.60:13231`
|
|
- Allowed IPs: `10.77.0.2/32, 10.10.10.0/24`
|
|
- Key commands:
|
|
- `wg show` — see peer status + latest handshake time
|
|
- `ping 10.77.0.2` — test connectivity
|
|
- `ssh -i /root/.ssh/wisp_rsa shonuff@10.77.0.2` — SSH to router
|
|
|
|
## Pitfalls
|
|
|
|
- The old `run_vpn_script("down", script_dir)` calls ran unconditionally even when WireGuard was active. All exit paths (error, dry-run, normal) need a `vpn_was_connected` guard.
|
|
- WireGuard handshake freshness: if > 5 min since last handshake, the tunnel may be down and the backup will fall back to L2TP.
|
|
- The router uses port 13231 for WireGuard, not the default 51820.
|