Wireguard Wireguard Server - Backup/Restore/Migrate

[ZebMcKayhan]

This is a continuation of a discussion sparked by @jsbeddow here.

This have been requested a couple of times, by me as well so I figured it is time to write down something to get things going. However, I only have 1 router and Im not planning on doing any factory reset any time soon and I am very dependant on my Wireguard Server so I will not be able to restore any NVRAM variables, instead I am hoping there are people here that have the ability to try it out and report back. I will try to keep these instructions as updated as I can.

This is my understand of what should be needed to get this done:

1. Install @Martinski script for saving subset of NVRAM variables:

mkdir -m 755 -p /jffs/addons/SaveRestoreNVRAM
curl  -kLSs --retry 3 --retry-delay 5 --retry-connrefused https://raw.githubusercontent.com/Martinski4GitHub/CustomMiscUtils/master/NVRAM/SaveRestoreNVRAMvars.sh -o /jffs/addons/SaveRestoreNVRAM/SaveRestoreNVRAMvars.sh && chmod 755 /jffs/addons/SaveRestoreNVRAM/SaveRestoreNVRAMvars.sh

2. Download the sample config for convenience:

curl  -kLSs --retry 3 --retry-delay 5 --retry-connrefused https://raw.githubusercontent.com/Martinski4GitHub/CustomMiscUtils/master/NVRAM/NVRAM_VarList_SAMPLE.txt -o /jffs/addons/SaveRestoreNVRAM/NVRAM_VarList.txt

3. Edit the config to enable storing the Wireguard server NVRAM parameters (only):

nano /jffs/addons/SaveRestoreNVRAM/NVRAM_VarList.txt

scroll down to:

#------------------#
# WireGuard Server #
#------------------#
# wgs_.*
# wgs1_.*
# wgsc_.*

and change to:

#------------------#
# WireGuard Server #
#------------------#
# wgs_.*
wgs1_.*
# wgsc_.*

Save & Exit (Cntrl+x, y, [ENTER])
let all others be commented as we dont want to migrate more nvram parameters than we need.

4. Run the script in menu mode:

/jffs/addons/SaveRestoreNVRAM/SaveRestoreNVRAMvars.sh -menu

Check under "dp" option so the path for saving backups are correct and proper. choose something differently if needed by selecting this option.
Check under "fl" that the config file we edited are used, if not, adjust by selecting this option.

5. For backing up your Wireguard server, select option "bk". If everything is alright, the script will output each NVRAM variable its backing up. For sanity check, there should be 10 entries for the server peer itself and additionally 9 entires for each client peer. in my case with the server and 2 client I have 28 entires backed up.
If you even want to double check which NVRAM variables are included in a backup file, use option "ls".

6. When you need to restore your wireguard server after a factory reset for example, you will need to install the script again (repeat #1). You dont need the config file to restore but I recommend to do the whole install (#1 - #3) as you probably want to continue your backup from the new router state.
In the script, make sure option "dp" points to where the backups are from your previous backup.
To start restore, select option "rt". You will be prompted about which backup file in the target you wish to restore.

Reboot your router after a restoration.

As I have not been able to do this myself, I cannot tell you for sure it is working so if anyone tries this, please report back with your router model and FW version.

Im not sure if entware needs to be installed or not, perhaps @Martinski could answer if his script have this dependecy?

 

[ZebMcKayhan]

Reserved.

 

[jsbeddow]

Awesome work, I am in a similar situation as you though: I am not really in a great position to test this (the restore especially) without cause. Sure, I could probably also recover via BACKUPMON if need be, but don't really want to shut out users that are currently connected via VPN if not strictly necessary.

Looking forward to feedback from other (more brave) testers.

 

[ZebMcKayhan]

Awesome work, I am in a similar situation as you though: I am not really in a great position to test this (the restore especially) without cause. Sure, I could probably also recover via BACKUPMON if need be, but don't really want to shut out users that are currently connected via VPN if not strictly necessary.

I understand, no worries.

other (more brave) testers.

I'm not that worried really. I have already tested with bogus nvram variables backing up, manually changing them, restore backup and they are back. As we only affect Wireguard Server variables the process are very slim and targeted.

What I am curious about is:
1. There are another set of nvram variables only used by the gui to remember last view (afaik). These are not part of the backup currently. Not sure if one needs to click around in the gui to get these updated. We could include these if we wish but its nice to only change a minimum to keep compability.
2. There are server client config files in /etc/wg/ that will not be there after factory reset and restore. I assume the fw will recreate them, but I don't know.