get_vpn_tunnels: WireGuard peers are keyed by position, so adding a peer renumbers the ones after it #32

New Issue

2026-10-27T08:06:32Z

christianmanivong commented

2026-10-27 08:06:32 +00:00

Priority: P2 — whatever a consumer stores per tunnel key silently moves to another peer.

get_vpn_tunnels() keys WireGuard peers with a running counter over the peer rows of /api/wireguard/service/show:

wg_idx += 1
...
tunnels[f"wireguard-{wg_idx}"] = {...}

Adding a peer ahead of an existing one shifts every key after it. Seen in practice: three peers, a new one added at position 3. The former wireguard-3 became wireguard-4, and the new, offline peer inherited wireguard-3 together with netOrk's site link and tunnel check, which then alarmed while the real tunnel was up.

IPsec (ipsec-{name}) and OpenVPN (openvpn-{iid}) are already stable; WireGuard is the only positional one.

Fix

Key on interface + public key, as napalm-linux does (wireguard-{iface}-{pubkey[:8]}). if and public-key are present on every peer row. A peer row without a public key falls back to the positional key.

This changes every WireGuard key once, so it lands together with netOrk's carry-over of per-tunnel metadata.

Priority: P2 — whatever a consumer stores per tunnel key silently moves to another peer. `get_vpn_tunnels()` keys WireGuard peers with a running counter over the peer rows of `/api/wireguard/service/show`: ```python wg_idx += 1 ... tunnels[f"wireguard-{wg_idx}"] = {...} ``` Adding a peer ahead of an existing one shifts every key after it. Seen in practice: three peers, a new one added at position 3. The former `wireguard-3` became `wireguard-4`, and the new, offline peer inherited `wireguard-3` together with netOrk's site link and tunnel check, which then alarmed while the real tunnel was up. IPsec (`ipsec-{name}`) and OpenVPN (`openvpn-{iid}`) are already stable; WireGuard is the only positional one. ## Fix Key on interface + public key, as napalm-linux does (`wireguard-{iface}-{pubkey[:8]}`). `if` and `public-key` are present on every peer row. A peer row without a public key falls back to the positional key. This changes every WireGuard key once, so it lands together with netOrk's carry-over of per-tunnel metadata.

christianmanivong referenced this issue from a commit

2026-10-27 08:10:42 +00:00

fix: WireGuard peers keep their tunnel key when others come and go (#32) (0.4.1)

christianmanivong referenced this issue from a commit

2026-10-27 08:21:06 +00:00

fix: WireGuard peers keep their tunnel key when others come and go (#32)

christianmanivong referenced a pull request that will close this issue

2026-10-27 08:21:06 +00:00

fix: WireGuard peers keep their tunnel key when others come and go (#32) #33

christianmanivong referenced this issue from NAPALM/napalm-linux

2026-10-27 08:21:23 +00:00

get_vpn_tunnels: a WireGuard key can contain "/" from the public key #43