Initially I left a FIXME in the code around this option for the [Peer] section of the peer config:
# FIXME: Do we want this value (picked from https://wiki.debian.org/WireGuard),
# something else, or do we want to use whatever the default is?
DEFAULT_WG_PERSISTENT_KEEP_ALIVE = 20
…
lines.append(f'PersistentKeepAlive = {DEFAULT_WG_PERSISTENT_KEEP_ALIVE}')
but this issue is not only about this specific option.
The wg manpage mentions this about PersistentKeepalive:
PersistentKeepalive — a seconds interval, between 1 and 65535
inclusive, of how often to send an authenticated empty packet to
the peer for the purpose of keeping a stateful firewall or NAT
mapping valid persistently. For example, if the interface very
rarely sends traffic, but it might at anytime receive traffic
from a peer, and it is behind NAT, the interface might benefit
from having a persistent keepalive interval of 25 seconds. If
set to 0 or "off", this option is disabled. By default or when
unspecified, this option is off. Most users will not need this.
Optional.
It might make sense to have 20 or 25 everywhere (including on the WireGuard “server”) to be on the safe side.
Still for the [Peer] section, we have the PresharedKey option:
PresharedKey — a base64 preshared key generated by wg genpsk.
Optional, and may be omitted. This option adds an additional
layer of symmetric-key cryptography to be mixed into the already
existing public-key cryptography, for post-quantum resistance.
I'll leave it up to someone like @U039b to draw the line regarding post-quantum resistance, esp. for traffic traveling through the public intarwebz…
Finally, for the [Interface] section, documented in the wg-quick manpage:
MTU — if not specified, the MTU is automatically determined from
the endpoint addresses or the system default route, which is
usually a sane choice. However, to manually specify an MTU to
override this automatic discovery, this value may be specified
explicitly.
I've heard from people having forced MTU=1280 and being very happy with it, maybe we'll want to do something similar?
Initially I left a FIXME in the code around this option for the
[Peer]section of the peer config:but this issue is not only about this specific option.
The
wgmanpage mentions this aboutPersistentKeepalive:It might make sense to have 20 or 25 everywhere (including on the WireGuard “server”) to be on the safe side.
Still for the
[Peer]section, we have thePresharedKeyoption:I'll leave it up to someone like @U039b to draw the line regarding post-quantum resistance, esp. for traffic traveling through the public intarwebz…
Finally, for the
[Interface]section, documented in thewg-quickmanpage:I've heard from people having forced
MTU=1280and being very happy with it, maybe we'll want to do something similar?