Does it make sense to turn the Wireguard server off and on with such a
bash script?
reddit / selfhosted

----------------------------------------------------------------------
mrRNobodY1 · 2023-11-26 02:18

Hi,
when I am at home I don't need Wireguard, while when I go out of the
house I would like it to turn on.

In summary by passing the mac address of my iPhone to the script, it
is checked if it is present in the ARP table and if it is connected to
the LAN by scanning with nmap. If I don't find it connected, I starto
Wireguard. If it is connected, however, I turn it off.

I was planning to schedule it with crontab every 15 minutes.

Do you see any potential security issues with that? Could it be done
better?


```#!/Bin/Bash
network=192.168.1.0/24
if [ “$#” -ne 1 ]; then echo Usage example: $0 aa:bb:cc:dd:ee:ff; exit
2; fi;
nmap -sP -T4 $network >& /dev/null
ip=$(sudo arp -n | grep $1 | awk ‘ { print $1 }’)
ping $ip -n -q -c 2 -i 0.2 -w 1 >& /dev/null
if [ $? -eq 0 ]; then
   echo Device is online \($ip\)
   sudo wg-quick down wg0
   echo Wireguard killed
else
   echo Device is offline
   sudo wg-quick up wg0
   echo Wireguard started
   exit 1
fi;

----------------------------------------------------------------------
starbuck93 · 2023-11-26 02:30

A quick Google search reveals that modern devices turn off their wifi
radios while sleeping, so you may get false positives on your if
statement sometimes. Also, I suppose the port will still be open in
your router while Wireguard is off. I probably wouldn't worry about
switching off the Wireguard process if it were my setup.

----------------------------------------------------------------------
BunnyEruption · 2023-11-26 02:43

What's the point of this? If you don't think wireguard is secure
enough to leave running I'm not sure only running it half the time or
whatever is going to be much more secure?

----------------------------------------------------------------------
sidusnare · 2023-11-26 04:09

I'd use a state file, test for state change, and only run wg-quick on
change. This way you can run every minute, and avoid weirdness about
running up when already up or down when down.

----------------------------------------------------------------------
ElevenNotes · 2023-11-26 04:50

Funny idea but I see no point in it?

----------------------------------------------------------------------
gryd3 · 2023-11-26 04:55

Honestly... what could possibly be the benefit of doing this?
Wireguard will not respond to someone if the keys are incorrect.
Leaving it running 24/7 means someone can 'try' to brute-force the
keys... assuming there's actually a wireguard server running... and
assuming it's on the port they are attempting to brute-force.
\*Ensure your device is not set to randomize it's MAC when connecting
to WiFi... it's a privacy feature enabled on many Android and iOS
devices.

Keep your private keys secure.

Firewall your wireguard interface if you don't trust it.

Leave the wireguard interface running and frequently rotate keys and
ports if you are worried.

----------------------------------------------------------------------
subven1 · 2023-11-26 09:14

Some people turn off their router at night or when they leave home.
Does it make sense? Not really. Can you still do it? Of course...

----------------------------------------------------------------------
Legitimate_Proof · 2023-11-26 20:38

Others have said that there's no security impact because WireGuard is
secure enough to use when it's running, so no benefit to turning it
off. That answers the question asked: "does it make sense..any
potential security issues?"

Aside from the security question, there could be a server resource
issue? I use a very low power server, and some services are fairly
heavy for it so I only run them when needed. I don't think WireGuard
is very heavy, but shutting it off could let the server focus on your
at-home services which might want all the resources they can get, so
if your server isn't high performance, there could be a benefit to
your plan.