WARNING: WireGuard does not seem to be running. main process exited. FirewallD is not running

[slrslr]

Thank You for creating this VPN installer.

I tried to run it on CentOS Linux release 7.7.1908 (Core), kernel 3.10.0-1062.18.1.el7.x86_64

Only issues i seen was "WARNING: WireGuard does not seem to be running."

systemctl status wg-quick@wg0 -l

Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] ip -4 address add 10.66.66.1/24 dev wg0
Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] ip -6 address add myaddresshere::1/64 dev wg0
Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] ip link set mtu 1420 up dev wg0
Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] firewall-cmd --add-port xxxxx(myporthere)/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.66.66.0/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=myaddresshere::0/24 masquerade'
Jul 03 18:24:17 my.host.name wg-quick[24031]: FirewallD is not running
Jul 03 18:24:17 my.host.name wg-quick[24031]: [#] ip link delete dev wg0
Jul 03 18:24:17 my.host.name systemd[1]: wg-quick@wg0.service: main process exited, code=exited, status=1/FAILURE
Jul 03 18:24:17 my.host.name systemd[1]: Failed to start WireGuard via wg-quick(8) for wg0.
Jul 03 18:24:17 my.host.name systemd[1]: Unit wg-quick@wg0.service entered failed state.
Jul 03 18:24:17 my.host.name systemd[1]: wg-quick@wg0.service failed.

I also tried quick look on "journalctl -xe" but seen nothing interesting. Which commands to run to discover the cause of the issue? On same server is running OpenVPN server which i am actively using:

systemctl status openvpn@server.service -l

● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2020-04-**
 Main PID: 1128 (openvpn)
   Status: "Initialization Sequence Completed"
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─1128 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf

openvpn is using device tun and 10.8.0.0 as IP. But maybe the issue is not caused by OpenVPN.

[randshell]

Run yum install kernel kernel-devel kernel-headers and reboot. It shouldn't be necessary to rebuild the dkms module.

In my tests there is a version mismatch between kernel and kernel-devel/kernel-headers. The dkms was build with headers of a kernel version I didn't have installed.

yum install kernel-devel kernel-headers:

Package kernel-devel-3.10.0-1127.13.1.el7.x86_64 already installed and latest version
Package kernel-headers-3.10.0-1127.13.1.el7.x86_64 already installed and latest version

yum install kernel:

Installing:
 kernel                       x86_64            3.10.0-1127.13.1.el7               updates             50 M

---

Would you like to open a PR to add these packages for centos?

wireguard-install/wireguard-install.sh

Line 157 in 59570c7

yum -y install epel-release

[slrslr]

In my case i got following when running Yours mentioned commands:

--> Running transaction check
---> Package kernel.x86_64 0:3.10.0-1127.13.1.el7 will be installed
---> Package kernel-devel.x86_64 0:3.10.0-1127.13.1.el7 will be installed
---> Package kernel-headers.x86_64 0:3.10.0-1062.18.1.el7 will be updated
---> Package kernel-headers.x86_64 0:3.10.0-1127.13.1.el7 will be an update
--> Finished Dependency Resolution
...
DKMS: build completed.

wireguard.ko.xz:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/3.10.0-1127.13.1.el7.x86_64/extra/
Adding any weak-modules

depmod....................

DKMS: install completed.

I rebooted and "systemctl restart wg-quick@wg0.service" is failed/exitted as before, with following lines in "journalctl -xe" output:

nm-dispatcher[2437]: req:1 'up' [wg0]: new request (4 scripts)
nm-dispatcher[2437]: req:1 'up' [wg0]: start running ordered scripts...
wg-quick[2393]: FirewallD is not running
wg-quick[2393]: [#] ip link delete dev wg0
NetworkManager[645]: <info>  [1593853486.0182] device (wg0): state change: activated -> unmanaged (reason 'unmanaged', sys-iface-state: 'removed')
nm-dispatcher[2437]: req:2 'down' [wg0]: new request (4 scripts)
nm-dispatcher[2437]: req:2 'down' [wg0]: start running ordered scripts...
systemd[1]: wg-quick@wg0.service: main process exited, code=exited, status=1/FAILURE
systemd[1]: Failed to start WireGuard via wg-quick(8) for wg0.

"ifconfig" does not show wg0 interface.
Any idea what is the reason/what to try please?

@randomshell says "Would you like to open a PR to add these packages for centos?"
I do not understand these things so if you can do it, then please do it.

[randshell]

Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] ip -4 address add 10.66.66.1/24 dev wg0
Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] ip -6 address add myaddresshere::1/64 dev wg0
Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] ip link set mtu 1420 up dev wg0
Jul 03 18:24:05 my.host.name wg-quick[24031]: [#] firewall-cmd --add-port xxxxx(myporthere)/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.66.66.0/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=myaddresshere::0/24 masquerade'
Jul 03 18:24:17 my.host.name wg-quick[24031]: FirewallD is not running
Jul 03 18:24:17 my.host.name wg-quick[24031]: [#] ip link delete dev wg0

In your case firewalld is not running. We configure wireguard to use firewalld over iptables if the system supports it. You can enable firewalld or if you have reasons to disable it you can edit PostUp and PostDown in /etc/wireguard/wg0.conf to use iptables.

PostUp = iptables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE
PostDown = iptables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE

Replace $SERVER_WG_NIC and $SERVER_PUB_NIC with your system configuration, look in /etc/wireguard/params/.

[slrslr]

Yes, without replacing $SERVER_WG_NIC and $SERVER_PUB_NIC by values from /etc/wireguard/params it was failing complaining about bad ACCEPT parameter in iptables command. Unsure why i had to replace it, but after replacing, it worked (wg service started).
Thank you for the pull requests. Hopefully it solves the issue.