Hi all!
A while back I started this thread.
I'm happy to report I've found a configuration that works!
So if anyone else is running into this issue, here's my solution:
Long story short: yes wgconfig, unlike wg-quick on linux, can't make use
of ddns hostnames, urls, however you're supposed to call them. It needs
a ip-address:port combination to set the endpoint of a given peer.
Luckily, getaddrinfo can actually resolve the ddns hostname and provide
the current IP address of the server peer (tested on NetBSD 10.1 amd64).
So I now have this working ifconfig.IF file:
---------------<ifconfig.wg0>------------------------
[host's ip within the wg network]
!wgconfig ${int} set private-key [path to private key file]
!wgconfig ${int} add peer [peername] [peer's public key]
--preshared-key=[path to preshared-key file] --allowed-ips=[allowed ip
range in peer's network] --endpoint=$(getaddrinfo [ddns hostname] | awk
'NR==1 {print $4; exit 0}'):[peer's listening port]
up
------------------------------------------------------------
Of course this only works for a limited time since the peer is behind a
residential IP.
So we just fix it by re-adding the peer.
I wrote this script for it:
----------<wg-ip-updater>--------------------------
#!/bin/sh
if test $# -ne 7
then
echo 'usage: wg-ip-updater interface peer public-key
preshared-key-path allowed-ips hostname port'
exit 1
fi
int=$1
peer=$2
pubkey=$3
preshared=$4
ips=$5
host=$6
port=$7
case $(ifconfig ${int} | awk '/status/ {print $NF; exit 0}') in
active)
# update peer
endpoint=$(getaddrinfo ${host} | awk 'NR==1
{print $4; exit 0}'):${port}
wgconfig ${int} delete peer ${peer}
wgconfig ${int} add peer ${peer} \
${pubkey} \
--preshared-key=${preshared} \
--allowed-ips=${ips} \
--endpoint=${endpoint}
;;
esac
------------------------------------------------------------
Then just install that to wherever you think is appropriate (I went with
/usr/local/sbin).
And then add it to root's crontab with the appropriate arguments.
I have it set to run every five minutes, since that is how often the
peer device sends an updated ip-address to the dns provider.
There's probably ways to improve the script, like only updating things
when the peer's ip-address has actually changed, but this works for now.
If anyone knows how to actually fix this without running this cronjob,
of course please share.
This solution is fairly duct-tape-y.
Thanks to all the people who replied, your suggestions where very
helpful in figuring things out.
Kind regards,
Martijn
On 06-07-2026 22:57, Martijn van Wely wrote:
Hi!
I'm trying to add a NetBSD device to my wireguard network.
Since the wireguard 'server' peer is in a homenetwork, I've configured
it to be reachable through duckdns.
On Debian Linux I would have a /etc/wireguard/wg0.conf like this for
one of the peers connecting to the server:
[Interface]
PrivateKey = [this peer's private key]
Address = [this peer's ip adress]
[Peer]
PublicKey = [server's public key]
PresharedKey = [a preshared key]
AllowedIPs = [the ip range]
Endpoint = [the duckdns url]:[listening port]
And then you can activate it by running wg-quick wg0 up (or via the
init system: systemctl start wg-quick@wg0).
I noticed that wg-quick isn't available after installing
wireguard-tools from pkgsrc (I guess because NetBSD's networking works
differently from most Linux distros?).
But after some googling I've found some examples of setting it up via
an ifconfig.if file with a bunch of calls to wgconfig.
Since the command-line arguments for wgconfig map pretty well on to
the lines in the wg0.conf I would normally write, I wrote this in
/etc/ifconfig.wg0:
[the selected ip/range within the wg-network]
!wgconfig ${int} set private-key /etc/wireguard/private.key
!wgconfig ${int} add peer wgserver $(cat /etc/wireguard/public.key)
--preshared-key=/etc/wireguard/preshared.key --allowed-ips=[the
wg-network's ip-range] --endpoint=[the duckdns url]:[listening port]
up
(also for context, yes they keys are stored as separate files in
/etc/wireguard. They're owned by root:wheel with chmod 600 permission
bits).
When I restart the network (by calling doas sh /etc/rc.d/network
restart) I get the following error message:
wg0wgconfig: getaddrinfo: hostname or servname not provided or not known.
getaddrinfo [duckdns url] does work though, but maybe there's a
problem with the fact that --endpoint is provided with a url:port
instead of a ip:port (the man page does specify ip:port)?
getaddrinfo with [duckdns url]:[listening port] fails.
I've also tried quoting various part in the url and port in case it's
a shell parsing problem, but that didn't help either.
Anyhow, does anyone know how to configure NetBSD as a wireguard peer
when the other peer is behind a ddns url?
Also: I am relatively experienced with Linux but new to NetBSD, so am
I completely off base in how I should configure wireguard here in the
first place?
Also also, I'm new to mailing lists, so please say if I'm breaking
some kind of etiquette or formatting rule.
Kind regards,
Martijn.
