Wireguard interface not automatically configured during 1.6->2.0 migration

[OoYo0uto]

Hi,

we just performed the migration from Defguard 1.6.1 to 2.0.1. We use the standalone packages in the following setup:

• One VM with Defguard Core
• One VM with Defguard Edge
• One Opnsense with Defguard Gateway

We followed the migration guide, and everything went well, but clients couldn't use the wireguard tunnel. The gateway was connected to the core.

The cause for these problems was that the defguard gateway running on the OPNsense did not migrate the ifname setting correctly. We use the wireguard interface wg2 instead of the default one wg0, and after the migration the config did contain again wg0. After modifying the setting manually in the text file, and after rebooting the OPNsense, defguard worked again.

I only wanted to report this here for others having the same issue.

[moubctez]

@OoYo0uto Was the Gateway properly adopted? Please, consult our troubleshooting guide https://docs.defguard.net/support-1/troubleshooting-guides/gateway

[OoYo0uto]

Yes, the Gateway was properly adopted and also shown as "connected" in the UI. We were also able to resolve the issue directly after the issue arose by setting the ifname again to wg2 as it was before and restarting the Opnsense. I debugged it by now and the issue was that the /etc/defguard/gateway.toml is overwritten during the package installation with pkg add defguard-gateway-2.0.1_x86_64-unknown-opnsense.pkg.

For OPNSense the solution could be quite simple. You can probably just click "Save" in the defguard-gateway settings of the OPNSense which should regenerate the configuration file. For the FreeBSD version, this is not possible, but I am also not sure if the issue is also present there.

If the solution is not present in FreeBSD, the simplest solution is probably to add in the Upgrade notes that you should save again the settings inside the OPNSense UI after a package upgrade.