add persistent keepalive for wireguard connections from LAN to the internet

2 files changed, 12 insertions, 2 deletions

diff --git a/README.md b/README.md
index b10976c..1db3e2c 100644
--- a/README.md
+++ b/README.md
@@ -109,6 +109,8 @@ cat <<END | doas tee -a /etc/hosts
 END
 ```
 
+> By default, WireGuard tries to be as silent as possible when not being used; it is not a chatty protocol. For the most part, it only transmits data when a peer wishes to send packets. When it's not being asked to send packets, it stops sending packets until it is asked again. In the majority of configurations, this works well. However, when a peer is behind NAT or a firewall, it might wish to be able to receive incoming packets even when it is not sending any packets. Because NAT and stateful firewalls keep track of "connections", if a peer behind NAT or a firewall wishes to receive incoming packets, he must keep the NAT/firewall mapping valid, by periodically sending keepalive packets. This is called persistent keepalives. When this option is enabled, a keepalive packet is sent to the server endpoint once every interval seconds. A sensible interval that works with a wide variety of firewalls is 25 seconds. Setting it to 0 turns the feature off, which is the default, since most users will not need this, and it makes WireGuard slightly more chatty. This feature may be specified by adding the PersistentKeepalive = field to a peer in the configuration file, or setting persistent-keepalive at the command line. If you don't need this feature, don't enable it. But if you're behind NAT or a firewall and you want to receive incoming connections long after network traffic has gone silent, this option will keep the "connection" open in the eyes of NAT.
+
 ### Install the config
 
 This generates the WireGuard config for my f3s project. This script is run on my Fedora Linux laptop.
diff --git a/wireguardmeshgenerator.rb b/wireguardmeshgenerator.rb
index 0f7b5eb..c678a1c 100644
--- a/wireguardmeshgenerator.rb
+++ b/wireguardmeshgenerator.rb
@@ -52,7 +52,7 @@ class KeyTool
 end
 
 PeerSnippet = Struct.new(:myself, :peer, :domain, :wgdomain,
-                         :allowed_ips, :endpoint) do
+                         :allowed_ips, :endpoint, :keepalive) do
   def to_s
     keytool = KeyTool.new(myself)
     <<~PEER_CONF
@@ -62,6 +62,7 @@ PeerSnippet = Struct.new(:myself, :peer, :domain, :wgdomain,
       PresharedKey = #{keytool.psk(peer)}
       AllowedIPs = #{allowed_ips}/32
       #{endpoint_str}
+      #{keepalive_str}
     PEER_CONF
   end
 
@@ -70,6 +71,12 @@ PeerSnippet = Struct.new(:myself, :peer, :domain, :wgdomain,
 
     "Endpoint = #{endpoint}:56709"
   end
+
+  def keepalive_str
+    return '# No KeepAlive configured' unless keepalive
+
+    'PersistentKeepalive = 25'
+  end
 end
 
 WireguardConfig = Struct.new(:myself, :hosts) do
@@ -120,8 +127,9 @@ WireguardConfig = Struct.new(:myself, :hosts) do
                  else
                    :behind_nat
                  end
+      keepalive = i_am_in_lan && !peer_is_in_lan
       PeerSnippet.new(peer, myself, reach['domain'], data['wg0']['domain'],
-                      data['wg0']['ip'], endpoint)
+                      data['wg0']['ip'], endpoint, keepalive)
     end
   end
 end