[BUG] LE 12.1 - enable wireguard forces wg default route and removes dhcp defaulte route, breaking networking

[g6094199]

Information

• LibreELEC Version: (official): 12.2.1
• Hardware Platform: RPi2.arm

Context

i need to connect my kodi box to my home NAS via wg. just routing, no default route.
i installed a clean LE version to a RPi3 with dhcp client enabled and the routing and wired ip looks like:.

LibreELEC:~ # ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP8000> mtu 1500 qdisc fq_codel qlen 1000
    link/ether bxxxxxx7c brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.91/24 brd 192.168.2.255 scope global eth0
       valid_lft forever preferred_lft forever
3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel qlen 1000
    link/ether bxxxxxxxx9 brd ff:ff:ff:ff:ff:ff

LibreELEC:~ # ip r
default via 192.168.2.1 dev eth0 
192.168.2.0/24 dev eth0 scope link  src 192.168.2.91 
192.168.2.1 dev eth0 scope link 

very normal.

i used the wiki article to find where to put the wg config and activated it. the connection:

Type = WireGuard
Name = xxx VPN Tunnel
Host = vpn.xxxxx.de
WireGuard.Address = 10.99.0.16/24
WireGuard.ListenPort = 51820
WireGuard.PrivateKey = yDaccccccccccccccccccccccccccccccccS03Q=
WireGuard.PublicKey = ZhcccccccccccccccccccccccccccccccccccccwY=
WireGuard.PresharedKey = DfcccccccccccccccccccccccccccccccccccccccccQ=
WireGuard.DNS = 192.168.2.222, 9.9.9.9
WireGuard.AllowedIPs = 10.99.0.0/24
WireGuard.EndpointPort = 51822
WireGuard.PersistentKeepalive = 25

connmanctl services
*AO Wired                ethernet_b8aaaaaaaa17c_cable
* R xxxx VPN Tunnel     vpn_vpn_xxxxx_de
    Vodafone Hotspot     wifi_b8sssssss9_566f6461666f6e6520486f7473706f74_managed_none
    Vodafone Homespot    wifi_bcccccc9_566f6461666f6e6520486f6d6573706f74_managed_none
    Vodafone-6D3B        wifi_b8ccccc429_566f6461666f6e652d36443342_managed_psk

also i created the systemd service and activated it:

Description=WireGuard VPN Service
After=network-online.target nss-lookup.target connman-vpn.service time-sync.target
Wants=network-online.target nss-lookup.target connman-vpn.service time-sync.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/connmanctl connect vpn_vpn_xxx_de
ExecStop=/usr/bin/connmanctl disconnect vpn_vpn_xxx_de

[Install]
WantedBy=multi-user.target

the connection pops up successfully on my server but i cant ping though the tunnel from both sides. after some debugging i found out that LE breaks the DHCP network connection!
as u can see from the config wg should only route 10.99.0.0/24 through the tunnel, but after a clean reboot with wg enabled routing looks like this:

10.99.0.0/24 dev wg0 scope link  src 10.99.0.16 
192.168.2.0/24 dev eth0 scope link  src 192.168.2.91 
192.168.2.1 dev eth0 scope link 
255.255.255.255 via 192.168.2.1 dev eth0 

WHY?
LW (connman) removes the DHCP default gw and puts in wg as default. no one told LE that to do. this breaks networking completely.
after shutting down wg, connman also doesnt reinject the dhcp default route again. this must be an bug.

Disconnected vpn_vpn_xxxxx_de
LibreELEC:~ # ip r
192.168.2.0/24 dev eth0 scope link  src 192.168.2.91 
192.168.2.1 dev eth0 scope link 
255.255.255.255 via 192.168.2.1 dev eth0 

after disabling the wg service and a reboot we are back to normal:

default via 192.168.2.1 dev eth0 
192.168.2.0/24 dev eth0 scope link  src 192.168.2.91 
192.168.2.1 dev eth0 scope link 

so there seems to be a connman messup where it makes wg unusable.

[heitbaum]

Please raise as a forum post - https://forum.libreelec.tv/

[g6094199]

this is the way to say: rtfm and piss off

bye.

[chewitt]

@heitbaum This probably is a ConnMan bug. It smells rather similar to an issue I see with two WireGuard tunnels active; after boot I have two default routes, one per WireGuard interface. The route for wg0 is correct as the config routes all traffic down tunnel but wg1 is a point-to-point tunnel giving access to a remote Tvheadend instance so there should only be a route to the remote subnet and not a default route. The presence of the second default route kills all internet access until I manually run (or script) ip route del default dev wg1 and then all is good again.

I'm submerged in other things since noticing this and haven't had time to bisect the breaking commit, but the change comes in a semi-recent ConnMan bump. NB: at the moment I am tracking official ConnMan releases and no longer have experimental patches from @LaakkonenJussi in my test images (the one that supported hostnames intead of IP addresses, with re-resolve, etc.) as the patchset doesn't apply.

@LaakkonenJussi @igaw ^ any ideas? - I don't appear to be on the ConnMan mailing list these days.

NB: I don't see any issues with routing using a single tunnel, only with two.

[chewitt]

this is the way to say: rtfm and piss off

I've reopened as I think it's an issue, but please keep things polite if you want anyone to show interest in the problem.

[LaakkonenJussi]

@chewitt Sorry, I forgot to update this branch - seemed to go over the recent 2.0 of ConnMan now without any hiccup.

I'll need to return to this matter a bit later to see if I have some ideas on this.

[chewitt]

@LaakkonenJussi thanks, I'll have a play with the patchset 👍🏻