Routes for enabled Wireguard peers are created irrespective of their connection status.

[einalex]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

When adding and enabling wireguard peers, upon applying changes, routes to all enabled wireguard peers are created. This includes routes to unconnected wireguard peers, i.e. it includes erroneous routes.

This means, that connections to temporarily not directly connected peers fail, even if there is a connection possible via a forwarding proxy peer (with the vpn subnet as allowed ip).

If such a not-directly connected peer is either disabled (which removes the erroneous route) or directly connected (which makes the erroneous route correct), it can be reached again.

To Reproduce

Steps to reproduce the behavior:

1. open a shell to opnsense
2. run 'route monitor'
3. in the web ui, create a wireguard instance
4. save your work
5. create a peer entry, keep it disabled, do NOT actually set up another wireguard instance somewhere for that peer, apply
6. see that for this peer no direct route shows up in monitoring, which is correct
7. now enable the peer, apply
8. see that now, a route is created for the peer, although it is offline, which is incorrect.

Expected behavior
Create routes for peers when they connect, and remove those routes when they disconnect.

Describe alternatives you considered

Running wireguard outside opnsense, but that leaves the problem for everyone else.

Additional context

Wireguard on linux (wg-quick) adds routes upon peer connection and removes routes upon peer disconnection, as should be the sane approach to route creation. It does not create routes to peers' vpn addresses as far as I can tell, which opnsense wireguard seems to do...

Environment

Software version used and hardware type if relevant, e.g.:

OPNsense 24.7.8-amd64