wgtrack tracks WireGuard links, exports the status, and updates endpoints as needed
"wgtrack" tracks WireGuard links, exports the links' status, and updates endpoints as needed.
WireGuard is a great VPN solution. wgtrack provides the tooling around it to track the status of the links and export the data for monitoring solutions. It also re-resolves endpoint hostnames to thus support connections between dial-in peers with changing IP addresses.
Note: This is code in "works for me" quality but in use for quite some time now. This tool started as an exercise in using Python's asyncio library.
wgtrack can be installed easily on Linux:
$ pip install wgtrack
Clone this repo to your local machine using https://github.com/towalink/wgtrack.git
Start wgtrack using the config file /etc/wgtrack.conf:
$ python -m wgtrack
Alternative config file:
$ python -m wgtrack --config /etc/my_special_wgtrack.conf
$ python -m wgtrack --loglevel debug
$ python -m wgtrack --help
After initialization (1), this tool periodically queries the status (2) of the WireGuard links, acts on their peers' status (3), and outputs the status (4) as requested.
The wgtrack configuration file and also the WireGuard configuration files in "/etc/wireguard" are read. Based on this, the tool knows about all configured WireGuard interfaces and their peers (including configured endpoint hostnames). In case of a change of the configuration, wgtrack may be notified by a SIGHUP signal to redo this initialization step.
The wgtrack configuration file uses the ini format. General parameters are specified in the "[general]" section. Parameters that shall be applied to all sections are specified in the "[DEFAULT]" section. Parameters for individual interfaces are specified in sections named "[interface:<ifname>]" with "<ifname>" being the name of the interface. Parameters for individual outputs are specified in sections named "[output:<outputname>]" with "<outputname>" being the name of the output.
wgtrack periodically queries the status of the WireGuard interfaces and their peers. This is done using the "wg show all dump" command. How often this is done can be configured using the "cycle_time" parameter (default: 30s).
In case the heartbeat of a link to a peer shows usual times that indicate a working link, the link can be checked using echo requests. By default, this is done each "cycle_time" (default "ping_interval" is 1 for this). It can be disabled by setting "ping_interval" to 0. After the configured number of failed echo requests ("ping_failafternum", default 2), the link is considered down despite the heartbeat appearing ok. The first "allowed-ip" configured for the respective peer is used as the destination for the respective echo request.
If a link is considered down, its peer endpoint can be re-resolved. Before this is done, the tool waits for the configured number of periods ("cycles_wait", default 2) to wait for an Internet connection with a dynamic IP address to be reestablished after disconnection. After that, the endpoint is re-resolved "cycles_checking" times each multitude "cycles_checkperiod" of the "cycle_time". After that, an exponential back-off takes place. However, "cycles_slowcheckingperiod" (default 20) defines the longest interval (as a multitude of the "cycle_time" until a regular recheck is done.
Outputs for the status information can be configured. Currently, the wire protocol of InfluxDB is supported as output format. This format is used by "Telegraf".
Add the following in your wgtrack.ini to enable output in the Influx wire format:
[output:influx]
In the Telegraf config, something like the following needs to be added:
[[inputs.file]]
files = ["/var/cache/wg-track_influx.out"]
FAQs
wgtrack tracks WireGuard links, exports the status, and updates endpoints as needed
We found that wgtrack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.
Security News
The npm package for the LottieFiles Player web component was hit with a supply chain attack after a software engineer's npmjs credentials were compromised.