In T4930#209720, @runar wrote:

Routgh idea:

If peer is created with hostname over IP, do not add it during commit

I would insist only not adding endpoint, let peer be ready if they have configured with hostname endpoint.

The peer should be pre-provisioned with everything needed to be accessible externally for a remote peer to reconnect prior to dns resolution.
To allow for this the peer can be added with a endpoint of 0.0.0.0. (if a wireguard peer is not able to be provisioned without a endpoint at least)
This can then be used to "abort" a DNS resolution if the remote end has reconnected.
Only the "resolve dns" part should then be the blocking part, and only that part needs to be moved out of the commit loop.

I create drafted PR https://github.com/vyos/vyos-1x/pull/4224

I came up with a possible solution:

Here are all config commands I used with my ubnt plugin

Code committed.

Here is how to get the latest-handshakes in seconds:

In T4930#208881, @c-po wrote:

@runar @sskaje

In general I like the idea and it's a very useful addition. Given the current implementation and design of wireguard to be easy, lightweight and not messed with 1000 of config options the design choice is to move everything requiring brain out of the WG core code.

In T4930#208505, @runar wrote:

Hi!

I do not like the concept that this should be done inline while in the middle of a commit.
As this will halt the commit phase for potentially a long time (relative) if dns is not up'n'running.
This in itself is not that critical, but if this is done the same on multiple sub-systems you potentially can have an exponentionall increase of boot time because of this.
And in a time where we are optimising milliseconds of code to get shorter boot and commit times in other subsystems i feel this is not the correct way to do it.

5 endpoints using domain, limit retry to 5 times, total start costs around 5 * 10 = 50 seconds.

In T4930#208083, @runar wrote:

Hi @sskaje!

In reference to T1700 and other tickets, there are things in wireguard that is not implemented the "best way".
For the first as noted earlier, the Wireguard kernel module have NO information of the existance of a "DNS peer", DNS to IP mappings are done by the wg config utillity at the moment the command is executed on the device.. this means that entering a DNS name as a peer address will execute a DNS request ONCE and its never retried .

I thought dns look up causes the block. So I made some changes like:

@Viacheslav I made is based on T6490, PR here: https://github.com/vyos/vyos-1x/pull/4194
This PR makes peers no longer required, so WireGuard interfaces will be created on boot, with or without Internet connection, with or without DNS resolution.

Code commit here: https://github.com/sskaje/vyos-1x/tree/T4930

I simply added hostname/fqdn to address and here is my test result:

I'm migrating my EdgeRouter to VyOS, its module 'https://github.com/WireGuard/wireguard-vyatta-ubnt/releases' supports endpoint as domain:port, which is same as wg set or wg-quick.

I created a PR https://github.com/vyos/vyos-1x/pull/4194

My fault, the double quotes were mis-removed in the PR when cleaning code.

I've made some changes but not sure if the logic is what VyOS team accept.

Code changed, to override all settings in build_config instead of args from cli only.