OPNsense: Start/stop WireGuard based on single interface CARP state change (place in /usr/local/etc/rc.syshook.d/carp/)

10-wireguard

#!/usr/local/bin/php
<?php

/*
 * Copyright (C) 2004 Scott Ullrich <[email protected]>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright notice,
 *    this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 */

# Set the carp physical interface name, e.g. gb0, cxl1, vlan01, etc you want to follow, normally your LAN
$carp_if = 'igc0';

# Get interface friendly name
$cmd_ifname = "/sbin/ifconfig $carp_if | grep 'description:' | awk '{print $2}'";
$ifname = shell_exec($cmd_ifname);
$ifname = trim($ifname);

# Get carp status for specified interface
$cmd_carp_status = "/sbin/ifconfig $carp_if | grep 'carp:' | awk '{print $2}'";
$carp_status = shell_exec($cmd_carp_status);
$carp_status = trim($carp_status);

if ($carp_status != 'MASTER' && $carp_status != 'BACKUP') {
    exit(1);
}

if ($carp_status === "MASTER") {
    log_msg("Starting WireGuard due to CARP event $carp_status on $ifname");
    # Checking `isset` avoids a race condition during startup when the
    # WireGuard config stanza seems like it's not yet loaded. Without it, this
    # can create an extra, empty, invalid stanza that breaks WireGuard.
    if (isset($config['OPNsense']['wireguard']['general']['enabled'])) {
      $config['OPNsense']['wireguard']['general']['enabled'] = '1';
    }
    configd_run('wireguard start');
	sleep(1);
	configd_run('wireguard start');
    write_config("Enable WireGuard due to CARP event $carp_status on $ifname", false);
} else {
    log_msg("Stopping WireGuard due to CARP event $carp_status on $ifname");
    configd_run('wireguard stop');
    if (isset($config['OPNsense']['wireguard']['general']['enabled'])) {
        $config['OPNsense']['wireguard']['general']['enabled'] = '0';
    }
    write_config("Disable WireGuard due to CARP event $carp_status on $ifname", false);
}

Thanks to many others. This certainly is not all "my work". I have borrowed others ideas from a large variety of sources and I especially acknowledge jprenken for the original script from which I forked.

1. You MUST alter this script and set the actual CARP physical interface name, e.g. gb0, cxl1, vlan01, etc. you want to follow, normally your LAN interface.

2. Place in file "10-wireguard" in /usr/local/etc/rc.syshook.d/carp/

3. Make the script executable:
   -> chmod +x /usr/local/etc/rc.syshook.d/carp/10-wireguard

4. You need to be running WireGuard with kmod - from the CLI run pkg install wireguard-kmod

5. I have found it best to disable HA syncing of the wireguard configuration. Untick WireGuard in the master/primary firewall under System > High Availability > Settings and then don't forget to enable this briefly if you make any WireGuard config changes or manually make the same changes on both HA master/primary and slave/backup firewalls.

This will not work if you have more than one carp VIP on the interface in question -- you can fix that by telling it to use the first like so:

$cmd_carp_status = "/sbin/ifconfig $carp_if | grep 'carp:' | head -n 1 | awk '{print $2}'

This is now unnecessary as proper CARP support is now built into OPNsense with WireGuard since OPNsense 23.7.8 released 09 Nov 2023 and further improved in the latest OPNsense firmware.

The WireGuard follow CARP implementation by the OPNsense dev team is excellent and it works really well!