Source
r/PrivateInternetAccess•
MockingFaith

WireGuard

How are PIAs WireGuard VPNs setup?

Are they default config for a wirguard connection which stores user IPs indefinitely, or have they done what other providers have and set them up to delete a user's IP if they have not had a key exchange for X amount of time?

Posted Jan 7, 2022, 5:09 PM UTC

114
triffid_hunter•

I made some notes in the readme for my PIA wireguard scripts

The way that PIA implemented Wireguard is that:

  • Your user account details are used to fetch an auth token.
  • The auth token is then used to send your wireguard public key to a PIA endpoint, which returns its public key and various other connection details like local non-routable IPs for both ends of the link.
  • If PIA's endpoint detects that the wireguard configuration has been unused for "several hours", they'll flush it - and they reboot their servers periodically at which point it'll also be flushed.

Unfortunately this means you can't have a static Wireguard link with PIA if your device is ever offline for long periods of time.

2
MockingFaithOP•

So every 7 hours or so of no activity my local IP and its corresponding token will be flushed, however if I login within the 7 hours I will continue to use the same token?

Would that be correct?

1
triffid_hunter•

So every 7 hours or so of no activity my local IP and its corresponding token will be flushed

The exact time is unknown, but is apparently in that ballpark according to comments from PIA staff.

however if I login within the 7 hours I will continue to use the same token?

No, your client just needs to perform a Wireguard key exchange.

By default this happens every minute or two as long as your client can contact the endpoint, and should be silently handled by whichever Wireguard driver you're using.

If your client drops offline for 'several' hours or otherwise can't perform a key exchange and the endpoint flushes your public key and other connection details, only then do you need to reorganize connection details via https.

One of the fun features of Wireguard is that it silently handles IP address changes - if your non-VPN public IP changes, the connection should silently hop over to the new IP, and if for some bizarre reason the server IP changes, the same should happen.
Unfortunately, the PIA Android app doesn't seem to understand this, and will trigger a reconnect cycle if you switch from WiFi to mobile data or vice versa.

tl;dr: A wireguard connection to PIA should continue to work as long as your client is online.
If your client is unable to contact PIA's endpoint for 'several hours', you may have to renegotiate the connection.
If your device switches internet connections, the Wireguard connection should remain live - unless you're using PIA's app which handles this poorly.

2
MockingFaithOP•

Exactly what I needed to know, thanks for imparting your knowledge, have a great week!

2