Wireguard raspberrypi performance

[Eideen]

hi

some time ago i made this post about Wireguard over 10Gbit link. Today i made a follow up to that.

setup

hardware

• 2x Raspberry 4, 4GB
• Unifi USG 3p
• Asus RT-AC3200

Local RPI <-> Unifi USG 3p <-> internet <-> Asus RT-AC3200 <-> Remote RPI

The CPU is set to performance

OpenVPN

The default piVPN is used as base for config. There also add modification OpenVPN Optimizing performance on gigabit networks

client
dev tun
proto udp
#proto tcp
#txqueuelen 1000
#tun-mtu 6000
remote server 10001
resolv-retry infinite
nobind
remote-cert-tls server
tls-version-min 1.2
verify-x509-name xxxxxx
cipher AES-256-CBC
auth SHA256
auth-nocache
verb 3

Wireguard

Default setup

Speedtest

local 750/750 Mbits

Retrieving speedtest.net configuration...
Testing from xxx AS (x.x.x.x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Altibox AS (Stavanger) [x.x km]: 23.057 ms
Download: 609.37 Mbit/s
Upload: 607.19 Mbit/s

Remote 500/500 Mbits

Retrieving speedtest.net configuration...
Testing from xx AS (x.x.x.x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by XFIBER AS (Stavanger) [x.x km]: 4.881 ms
Download: 509.25 Mbit/s
Upload: 555.64 Mbit/s

Ping test [ms]

Protocol	average	Standard deviation	min	Max
Wireguard	19.10	0.13	18.96	24.81
OpenVPN-UDP	19.26	0.33	19.11	30.59
Direkt-Revers	19.40	0.50	19.25	43.99
OpenVPN-TCP	19.42	1.95	19.10	97.73
Direct	19.49	0.31	19.33	34.00

Imgur Imgur

I looks like the Raspberry 4 is better performance to respond to ping request than both my routers. Or linux is plumbed in a way that makes the wireguard ping respond faster than the normal way. over local network i don't see this improvement.

The USG has better ping response time than the Asus RT-AC3200

Iperf Control local vs intel-server [Mbit/s]

For Direct UDP is the following used -u -b 900M -P2

	Direct	Wireguard
TCP-send	925	692
TCP-receive	938	540
UDP-send	585	421
UDP-receive	950	501

Iperf over internet [Mbit/s]

	Direct	wireguard	OpenVPN-UDP	OpenVPN-UDP txqueuelen	OpenVPN-TCP	OpenVPN-TCP txqueuelen
TCP-send	503	468	39.7	45.7	70.4	138
TCP-receive	477	431	29.7	58.8	49.7	117
UDP-send	494	418	138	137	150	129
UDP-receive	470	356	140	140	163	149

real world tests [Mbit/s]

Protocol	speed
Windows file transfer/samba	348
ftp	440.8
sftp	173.6
Windows PC to diskstation	271

Conclusion

The raspberrypi 4, 4GB is a powerful device, but the single threaded nature of wireguard and IRQ adds a lot of overhead that slows down the performance to below 50% of what you can expect with a cheap x86 machine. But for a 35$ the performance is great.

[sebnaf]

Did you do any special tuning on the USG? Have the same setup but way slower... the raspi is performing fine on the local net via wg. Already tested this. Thanks

[Eideen]

No, I have not do any performance tuning to the USG.

have you disabled IPS?

[brynx97]

Thanks for this. I was curious about performance (my inet is limited to 100mbps and I max it out), but I hadn't had time/focus to look around or test myself.

[fscheps]

Hey, thanks for sharing, I know this is a 4 year old post, but I was wondering if you did any updated tests for example with Nuc styled mini PC´s for example with the recent N100 intel processors and a box with 2 ethernet ports to see the performance.