From 22ecae0eea8bc58ae446dfac1f1eaf5a7b438059 Mon Sep 17 00:00:00 2001 From: Ahmed Abdelhalim Date: Wed, 19 Nov 2025 16:39:18 +0100 Subject: Fix gateway direct-mode not triggering on VPN disconnect The gateway-direct-mode.service was never triggering when WireGuard interfaces were removed, leaving VPN iptables rules active even when VPN was disconnected. This caused internet connectivity to fail in direct mode. Root cause: SYSTEMD_WANTS in udev rules only works for ACTION=="add" events. When a device is removed, the device unit is already gone before systemd can process the SYSTEMD_WANTS dependency, so the service never starts. This is a documented systemd limitation. Fix: Replace SYSTEMD_WANTS with RUN+ for the remove action, which executes systemctl directly during udev event processing without requiring a device unit to exist. References: - https://stackoverflow.com/questions/72208534/why-does-systemd-wants-not-pass-a-parameter-to-a-service-file-from-a-udev-remov - https://stackoverflow.com/questions/73148448/how-to-start-systemd-user-service-when-device-is-removed-and-stop-it-when-devic - https://bugzilla.redhat.com/show_bug.cgi?id=871074https://bugzilla.redhat.com/show_bug.cgi?id=871074 - https://unix.stackexchange.com/questions/528803/systemd-doesnt-stop-the-service-when-the-device-is-removed The VPN mode (ACTION=="add") continues to use SYSTEMD_WANTS as it works correctly for device addition events. --- roles/gateway/templates/99-wireguard-gateway.rules.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'roles/gateway') diff --git a/roles/gateway/templates/99-wireguard-gateway.rules.j2 b/roles/gateway/templates/99-wireguard-gateway.rules.j2 index a4164bc3..6bc5d2a0 100644 --- a/roles/gateway/templates/99-wireguard-gateway.rules.j2 +++ b/roles/gateway/templates/99-wireguard-gateway.rules.j2 @@ -1,2 +1,2 @@ ACTION=="add", SUBSYSTEM=="net", KERNEL=="wg*", TAG+="systemd", ENV{SYSTEMD_WANTS}="gateway-vpn-mode.service" -ACTION=="remove", SUBSYSTEM=="net", KERNEL=="wg*", TAG+="systemd", ENV{SYSTEMD_WANTS}="gateway-direct-mode.service" +ACTION=="remove", SUBSYSTEM=="net", KERNEL=="wg*", RUN+="/usr/bin/systemctl start gateway-direct-mode.service" -- cgit v1.2.3