[client] Keep WireGuard keepalive only until the first handshake

Gated behind NB_DISABLE_WG_KEEP_ALIVE for battery measurements; unset the
variable and the behaviour is unchanged.

Peers start with the 25s persistent keepalive so an idle responder still
emits traffic and triggers the handshake initiation, then the interval
drops to zero once the watcher observes a fresh handshake. The keepalive
is re-armed whenever a connection attempt restarts, so every new
handshake gets initiated the same way.

The watcher also stops its periodic handshake check after that first
observation: with keepalive disabled an idle peer never rotates its
handshake, so the periodic check would report a false disconnect every
checkPeriod and trigger a full reconnect.

client/iface/iface_test.go

@@ -464,6 +464,8 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
+	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
+
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -505,12 +507,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP, err := getLocalIP()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
+	localIP1 := "127.0.0.1"
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -546,7 +544,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
+	localIP2 := "127.0.0.1"
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -621,28 +620,3 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
-
-func getLocalIP() (string, error) {
-	// Get all interfaces
-	addrs, err := net.InterfaceAddrs()
-	if err != nil {
-		return "", err
-	}
-
-	for _, addr := range addrs {
-		ipNet, ok := addr.(*net.IPNet)
-		if !ok {
-			continue
-		}
-		if ipNet.IP.IsLoopback() {
-			continue
-		}
-
-		if ipNet.IP.To4() == nil {
-			continue
-		}
-		return ipNet.IP.String(), nil
-	}
-
-	return "", fmt.Errorf("no local IP found")
-}

client/internal/peer/conn.go

@@ -841,6 +841,8 @@ func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
 		return
 	}
 
+	conn.endpointUpdater.EnableKeepAlive()
+
 	watcher := NewWGWatcher(conn.Log, conn.config.WgConfig.WgInterface, conn.config.Key, conn.dumpState)
 	watcher.PrepareInitialHandshake()
 
@@ -888,6 +890,7 @@ func (conn *Conn) resetEndpoint() {
 		return
 	}
 	conn.Log.Infof("reset wg endpoint")
+	conn.endpointUpdater.EnableKeepAlive()
 	if conn.wgWatcher != nil {
 		conn.wgWatcher.Reset()
 	}
@@ -945,7 +948,12 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
+	presharedKey := conn.presharedKey(conn.rosenpassRemoteKey)
 	conn.mu.Unlock()
+
+	if err := conn.endpointUpdater.DisableKeepAlive(presharedKey); err != nil {
+		conn.Log.Warnf("failed to disable WireGuard keepalive: %v", err)
+	}
 }
 
 // recordConnectionMetrics records connection stage timestamps as metrics

client/internal/peer/conn_test.go

@@ -316,11 +316,16 @@ func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
 		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
 	}
 
+	connLog := log.WithField("peer", cfg.Key)
+	endpointUpdater := NewEndpointUpdater(connLog, cfg.WgConfig, false)
+	endpointUpdater.keepAlive = 0
+
 	conn := &Conn{
-		ctx:           context.Background(),
-		config:        cfg,
-		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &MetricsStages{},
+		ctx:             context.Background(),
+		config:          cfg,
+		Log:             connLog,
+		metricsStages:   &MetricsStages{},
+		endpointUpdater: endpointUpdater,
 	}
 	conn.SetOnDisconnected(func(remotePeer string) {
 		*disconnected = append(*disconnected, remotePeer)

client/internal/peer/endpoint.go

@@ -20,10 +20,11 @@ type EndpointUpdater struct {
 	wgConfig  WgConfig
 	initiator bool
 
-	// mu protects cancelFunc
+	// mu protects cancelFunc and keepAlive
 	mu         sync.Mutex
 	cancelFunc func()
 	updateWg   sync.WaitGroup
+	keepAlive  time.Duration
 }
 
 func NewEndpointUpdater(log *logrus.Entry, wgConfig WgConfig, initiator bool) *EndpointUpdater {
@@ -31,6 +32,7 @@ func NewEndpointUpdater(log *logrus.Entry, wgConfig WgConfig, initiator bool) *E
 		log:       log,
 		wgConfig:  wgConfig,
 		initiator: initiator,
+		keepAlive: defaultWgKeepAlive,
 	}
 }
 
@@ -73,6 +75,31 @@ func (e *EndpointUpdater) RemoveEndpointAddress() error {
 	return e.wgConfig.WgInterface.RemoveEndpointAddress(e.wgConfig.RemoteKey)
 }
 
+func (e *EndpointUpdater) DisableKeepAlive(presharedKey *wgtypes.Key) error {
+	if !isWgKeepAliveDisabled() {
+		return nil
+	}
+
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	if e.keepAlive == 0 {
+		return nil
+	}
+
+	e.waitForCloseTheDelayedUpdate()
+	e.keepAlive = 0
+	e.log.Debugf("disable WireGuard persistent keepalive")
+	return e.updateWireGuardPeer(nil, presharedKey)
+}
+
+func (e *EndpointUpdater) EnableKeepAlive() {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	e.keepAlive = defaultWgKeepAlive
+}
+
 func (e *EndpointUpdater) configureAsInitiator(addr *net.UDPAddr, presharedKey *wgtypes.Key) error {
 	if err := e.updateWireGuardPeer(addr, presharedKey); err != nil {
 		return err
@@ -127,7 +154,7 @@ func (e *EndpointUpdater) updateWireGuardPeer(endpoint *net.UDPAddr, presharedKe
 	return e.wgConfig.WgInterface.UpdatePeer(
 		e.wgConfig.RemoteKey,
 		e.wgConfig.AllowedIps,
-		defaultWgKeepAlive,
+		e.keepAlive,
 		endpoint,
 		presharedKey,
 	)

client/internal/peer/env.go

@@ -7,8 +7,9 @@ import (
 )
 
 const (
-	EnvKeyNBForceRelay       = "NB_FORCE_RELAY"
-	EnvKeyNBHomeRelayServers = "NB_HOME_RELAY_SERVERS"
+	EnvKeyNBForceRelay         = "NB_FORCE_RELAY"
+	EnvKeyNBHomeRelayServers   = "NB_HOME_RELAY_SERVERS"
+	EnvKeyNBDisableWgKeepAlive = "NB_DISABLE_WG_KEEP_ALIVE"
 )
 
 func IsForceRelayed() bool {
@@ -18,6 +19,10 @@ func IsForceRelayed() bool {
 	return strings.EqualFold(os.Getenv(EnvKeyNBForceRelay), "true")
 }
 
+func isWgKeepAliveDisabled() bool {
+	return strings.EqualFold(os.Getenv(EnvKeyNBDisableWgKeepAlive), "true")
+}
+
 // OverrideRelayURLs returns the relay server URL list set in
 // NB_HOME_RELAY_SERVERS (comma-separated) and a boolean indicating whether
 // the override is active. When the env var is unset, the boolean is false

client/internal/peer/wg_watcher.go

@@ -109,10 +109,15 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 			}
 
 			lastHandshake = *handshake
+			w.stateDump.WGcheckSuccess()
+
+			if isWgKeepAliveDisabled() {
+				w.log.Debugf("WireGuard watcher waiting for peer reset")
+				continue
+			}
 
 			resetTime := time.Until(handshake.Add(checkPeriod))
 			timer.Reset(resetTime)
-			w.stateDump.WGcheckSuccess()
 
 			w.log.Debugf("WireGuard watcher reset timer: %v", resetTime)
 		case <-w.resetCh:

management/server/types/account_components.go

@@ -321,19 +321,10 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 
 	relevantPeerIDs[peerID] = a.GetPeer(peerID).ToComponent()
 
-	addRelevantGroup := func(groupID string) *Group {
-		if g, ok := relevantGroupIDs[groupID]; ok {
-			return g
-		}
-		g := a.GetGroup(groupID)
-		relevantGroupIDs[groupID] = g
-		return g
-	}
-
 	peerGroupSet := make(map[string]struct{}, 8)
 	for groupID, group := range a.Groups {
 		if slices.Contains(group.Peers, peerID) {
-			relevantGroupIDs[groupID] = group
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
 			peerGroupSet[groupID] = struct{}{}
 		}
 	}
@@ -364,12 +355,15 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			continue
 		}
 
+		for _, groupID := range r.PeerGroups {
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
+		}
 		for _, groupID := range r.Groups {
-			addRelevantGroup(groupID)
+			relevantGroupIDs[groupID] = a.GetGroup(groupID)
 		}
 		if r.Enabled {
 			for _, groupID := range r.AccessControlGroups {
-				addRelevantGroup(groupID)
+				relevantGroupIDs[groupID] = a.GetGroup(groupID)
 				routeAccessControlGroups[groupID] = struct{}{}
 			}
 		}
@@ -395,7 +389,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			}
 		}
 		for _, groupID := range r.PeerGroups {
-			g := addRelevantGroup(groupID)
+			g := a.GetGroup(groupID)
 			if g == nil {
 				continue
 			}
@@ -430,10 +424,10 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					if _, needed := routeAccessControlGroups[destGroupID]; needed {
 						policyRelevant = true
 						for _, srcGroupID := range rule.Sources {
-							addRelevantGroup(srcGroupID)
+							relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
 						}
 						for _, dstGroupID := range rule.Destinations {
-							addRelevantGroup(dstGroupID)
+							relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
 						}
 						break
 					}
@@ -469,7 +463,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					}
 				}
 				for _, dstGroupID := range rule.Destinations {
-					addRelevantGroup(dstGroupID)
+					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
 				}
 			}
 
@@ -481,7 +475,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					}
 				}
 				for _, srcGroupID := range rule.Sources {
-					addRelevantGroup(srcGroupID)
+					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
 				}
 
 				if rule.Protocol == PolicyRuleProtocolNetbirdSSH {

sharedsock/sock_linux.go

@@ -24,7 +24,7 @@ import (
 )
 
 // ErrSharedSockStopped indicates that shared socket has been stopped
-var ErrSharedSockStopped = fmt.Errorf("shared socked stopped")
+var ErrSharedSockStopped = fmt.Errorf("shared socket stopped")
 
 // SharedSocket is a net.PacketConn that initiates two raw sockets (ipv4 and ipv6) and listens to UDP packets filtered
 // by BPF instructions (e.g., IncomingSTUNFilter that checks and sends only STUN packets to the listeners (ReadFrom)).