Should I expect faster recovery after one side goes down
Bruno Wolff III
bruno at wolff.to
Mon Nov 27 14:49:14 CET 2017
On Mon, Nov 27, 2017 at 12:04:06 +0100,
"Jason A. Donenfeld" <Jason at zx2c4.com> wrote:
>The first question is - how long?
For "systemctl iptables stop" I have waited around a minute before
using control C. After running "systemctl stop wireguard" or
"systemctl restart wireguard" (which will delete wg0) "systemctl stop
iptables" will run with no noticeable delay.
For network traffic, I waited around 10 minutes and things were still not
working. Web page loads would still time out after a minute or two. But
I did have a few DNS lookups succeed. I'm not sure if I did something
that allowed a value to get cached (there is a local caching resolver
on the affected machines) or if a response eventually made it through.
After "systemctl restart wireguard" things start working normal right
away. So I don't know the delay for specific traffic, but it looks to
be at least a minute for most traffic. The problem does not seem to
resolve for at least 10 minutes, though I don't think I have ever seen it
resolve on its own.
More information about the WireGuard