Here's a simple set of scripts that allow you to export wireguard tunnel statistics to a file in Prometheus text format. This file can be read by the node_exporter textfile collector, for example.
You might be asking, why does this exist? Why not MindFlavor/prometheus_wireguard_exporter? The reality is that a full-fledged webserver written in Rust to expose wireguard metrics is a bit overkill. I've accomplished the same thing in ~100 lines of (well documented) Awk. It's dead simple, and a no brainer if you're already using node-exporter.
For those conscious about security, you'll be happy to know the script itself does't run any wireguard commands; it doesn't even need to be run as root. It accepts a wg dump from stdin, and that's it. The metrics exposition is completely isolated from the wireguard configuration, unlike MindFlavor/prometheus_wireguard_exporter. No need to deal with docker containers attached to the host network, which is annoying when you're running mostly rootless containers.
If you want to dump prometheus metrics to stdout, try this:
# wg show all dump | wg-dump.awk
You'll get something like this:
# HELP node_network_wireguard_interface Wireguard network interface information.
# TYPE node_network_wireguard_interface gauge
node_network_wireguard_interface{device="wg0",public_key="wDArzrW4UnZ6Zfp7/zHvGNH0wx71yhEqOXTu6Jgfbgc=",port="51820",fwmark="off"} 1.0
# HELP node_network_wireguard_peer_handshake Latest handshake for a particular Wireguard peer.
# TYPE node_network_wireguard_peer_handshake gauge
node_network_wireguard_peer_handshake{device="wg0",public_key="Hav2lvmaicPSly4I25oEHcv8o4ycFNIzriADheeSFjY=",endpoint="192.168.3.8/32",persistent_keepalive="off"} 1677452335
node_network_wireguard_peer_handshake{device="wg0",public_key="ypLMnc92ZUDNMSuEUtW0Nh5VWFooxXXWYcaZx8zLU2c=",endpoint="192.168.3.14/32",persistent_keepalive="off"} 1677208600
node_network_wireguard_peer_handshake{device="wg0",public_key="JAJ264l63wILq02WmcWDwFuLAUPhI8XTweRc/Wgxw2M=",endpoint="192.168.3.5/32",persistent_keepalive="off"} 1677452428
...
If you want to use this script to expose wireguard metrics to Prometheus:
- enable the prometheus textfile collector (e.g.
--collector.textfile.directory=/var/run/prometheus) - create a systemd timer or cron that runs the script on a interval
# cp prometheus-collect-wg.timer /etc/systemd/system/
# cp prometheus-collect-wg.service /etc/systemd/system/
# systemctl enable prometheus-collect-wg.timer
# systemctl enable prometheus-collect-wg.service
# systemctl start prometheus-collect-wg.timer
Public keys aren't all that useful for us mortals. Mapping these keys to human-friendly names is easy (and no it does not involve vanity keys). Simply create a key map file and provide the path to the file as an environment variable.
The key map file is a tab-separated file where each line in the file maps a public key to it's human-friendly name.
Zo0Z5MClSQZsWlG3hS9RgoE6kHQHWYhGJ3i9DuB1yV4= Home Server
fvEBlU5mZGelXse9copyYt/c75H9XfQeVMFGVItJu1Q= Phone
wDArzrW4UnZ6Zfp7/zHvGNH0wx71yhEqOXTu6Jgfbgc= Personal Laptop
pQNmjK+YF7/OLTYCon/rUf707gD29SHuKvhxM6f93Eg= Friend
Once set up, create some visualization for the health and statistics of your Wireguard network in Grafana. You can import the dashboard shown below from the JSON model wg-grafana-dashboard.json.
