Re: Should I expect faster recovery after one side goes down

[Bruno Wolff III <bruno@wolff.to>]

On Mon, Nov 27, 2017 at 12:04:06 +0100,
  "Jason A. Donenfeld" <Jason@zx2c4.com> wrote:
>Hi Bruno,
>
>The first question is - how long?

For "systemctl iptables stop" I have waited around a minute before 
using control C. After running "systemctl stop wireguard" or 
"systemctl restart wireguard" (which will delete wg0) "systemctl stop 
iptables" will run with no noticeable delay.

For network traffic, I waited around 10 minutes and things were still not 
working. Web page loads would still time out after a minute or two. But 
I did have a few DNS lookups succeed. I'm not sure if I did something 
that allowed a value to get cached (there is a local caching resolver 
on the affected machines) or if a response eventually made it through. 
After "systemctl restart wireguard" things start working normal right 
away. So I don't know the delay for specific traffic, but it looks to 
be at least a minute for most traffic. The problem does not seem to 
resolve for at least 10 minutes, though I don't think I have ever seen it 
resolve on its own.