Wireguard in a Bastille jail - getting if_wg_load to work?
-
Gentlefolk,
I am trying to set up a wireguard client inside a Bastille jail - both the host and the jail are on FreeBSD 15.1.
I have encountered an error (SIOCIFCREATE2 (wg0): Invalid argument) when I try to bring up the interface.
Apparently this is because, while the host system has access to the kernel module that enables wireguard, the jail does not.
After a bit of research, it seems that the way to handle this is to put the declaration
if_wg_load="YES"
into /boot/loader.conf, or perhaps into a file inside /boot/loader.conf.d.However, Bastille sets up /boot as a read-only filesystem.
Hence the only way I can see to fix this is to edit the fstab for this jail and change the flags for /boot to rw from ro, restart the jail, edit the necessary files, and then go back out to the host and reset the flags in fstab.
Now, call me an optimist, but I suspect the good folks behind Bastille will already have seen this problem and worked out a less awkward solution - I just can't find it anywhere. Am I missing something?
Many thanks as ever,
---WBTD.
-
Gentlefolk,
I am trying to set up a wireguard client inside a Bastille jail - both the host and the jail are on FreeBSD 15.1.
I have encountered an error (SIOCIFCREATE2 (wg0): Invalid argument) when I try to bring up the interface.
Apparently this is because, while the host system has access to the kernel module that enables wireguard, the jail does not.
After a bit of research, it seems that the way to handle this is to put the declaration
if_wg_load="YES"
into /boot/loader.conf, or perhaps into a file inside /boot/loader.conf.d.However, Bastille sets up /boot as a read-only filesystem.
Hence the only way I can see to fix this is to edit the fstab for this jail and change the flags for /boot to rw from ro, restart the jail, edit the necessary files, and then go back out to the host and reset the flags in fstab.
Now, call me an optimist, but I suspect the good folks behind Bastille will already have seen this problem and worked out a less awkward solution - I just can't find it anywhere. Am I missing something?
Many thanks as ever,
---WBTD.
<sigh/> The awkward solution does not appear to work, either. Any suggestions?
-
...and it was an idiot error. I had to enable wg in the host kernel. I knew it was built into the kernel these days...I just hadn't realised I needed to enable it. -->facepalm<--
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login