feat(wireguard): support configurable server interface MTU

[dr-hoseyn]

Summary

WireGuard core configs currently ignore mtu, so changing it in the panel does not change the server interface. Accept an optional integer MTU (576–9000) and apply it before the interface is brought up and during in-place restarts.

Keep the kernel default when MTU is omitted. Capture the interface MTU before the first override so clearing the setting restores it. Reject invalid values before interface initialization and propagate netlink failures through the existing permission-error handling.

Related to PasarGuard/panel#906. Companion panel PR: PasarGuard/panel#917.

Validation

Verified on Linux against this PR's production code using a separate fork branch: https://github.com/dr-hoseyn/node/actions/runs/35507877164

• Passed go test -race ./backend/wireguard.
• Passed a live kernel WireGuard check: create at 1320, update to 1280, reject 575 without changing the interface, clear the override back to the original 1420, and recreate with the default.
• Passed JSON validation and netlink permission-failure checks.
• Passed go build ./cmd/node and git diff --check.

make test was also run but is not green: the unchanged controller tests call keepAliveStale with three arguments while the dev implementation accepts two; Xray and REST/RPC tests require the Xray binary and TLS fixtures absent from this runner. The verification workflow allows that full-suite step to fail so the independent WireGuard checks can complete.

Only three production Go files are included. Verification-only tests and workflow are in a separate branch; no test or documentation files are part of this PR.

Summary by CodeRabbit

• New Features

  • Added optional MTU configuration for WireGuard interfaces.
  • MTU values are applied during startup and configuration updates.
  • Supported MTU values range from 576 to 9000.

• Bug Fixes

  • Invalid MTU values are now rejected with a clear validation error.
  • Existing default MTU behavior is preserved when no MTU is configured.

[coderabbitai]

Understand this PR’s impact

Explore downstream dependencies and potential security impact with Blast Radius.

View blast radius →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e58ca765-eeb6-40e8-b463-0d5666a15c3f

📥 Commits

Reviewing files that changed from the base of the PR and between d44ca8e and a10b715.

📒 Files selected for processing (3)

• backend/wireguard/config.go
• backend/wireguard/manager.go
• backend/wireguard/wireguard.go

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The change adds optional WireGuard MTU configuration. Values are validated between 576 and 9000. The manager applies MTU values during interface initialization and configuration restart, while tracking the kernel default for restoration.

Changes

WireGuard MTU management

Layer / File(s)	Summary
MTU configuration and validation backend/wireguard/config.go	Config accepts an optional MTU. NewConfig and validateMTU reject values outside the inclusive 576–9000 range.
Manager MTU application backend/wireguard/manager.go	Manager tracks MTU state, captures the default interface MTU, and applies configured or restored values through netlink.
Startup and restart wiring backend/wireguard/wireguard.go	Instance creation validates MTU configuration. Startup and restart pass MTU values to the manager.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant WireGuard
  participant Manager
  participant netlink
  WireGuard->>Manager: initializeWithPeers(..., mtu)
  Manager->>netlink: Apply interface MTU
  netlink-->>Manager: Return MTU result
  Manager-->>WireGuard: Return initialization result
  WireGuard->>Manager: applyConfig(config, mtu)
  Manager->>netlink: Apply interface MTU
  netlink-->>Manager: Return MTU result

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configurable server interface MTU support for WireGuard.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit sets the MTU with care
The WireGuard link now knows its share
Defaults wait beneath the new
Restart paths carry settings through
Safe bounds guide each change there}

_{Comment @coderabbitai help to get the list of available commands.}

[ImMohammad20000]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.