Linux kernel WireGuard can go 'fast' on decent hardware

utcc.utoronto.ca

43 points·zdw··8 comments

This mirrors my anecdata on consumer (<$150) wifi router hardware. I recently upgraded my home router specifically for wireguard and it's been 5x faster than openvpn.

More or less my experience as well. I run Mikrotiks usually, but also on openwrt consumer hardware it's at least 3-4x more throughput than OpenVPN.

Very useful for low-end routers, travel routers and similar.

Also initial connection time is basically instant.

In addition to been faster it is also the only vpn that reliably handle roaming, without interrupting active connections.

Well apart from tinc, which has been doing that for decades [0] :-) -- and has been doing that since Linux was something that still ran on 8MB of RAM.

[0]: https://www.tinc-vpn.org/

I also did use tinc in the past, and while it was very robust it was not as reliable/fast on roaming as wireguard, BUT to be fair it may have been user error.

tinc can also automatically select routes through the mesh, and it supports layer 2 (tap) VPN too. Wireguard is a long way from this feature set unfortunately.

My laptop can run chacha20 at 2GB/s on a single core. Encryption performance hasnt really been an issue for a long time. Most VPNs will be running AES128 that has hardware support and should be even faster.

Used 10GbE ethernet components are cheap on ebay.

I built a 10GbE 'switch' by buying 2 4 port SPI+ PCIE cards off of Ebay and then joining them together with a conventional Linux Br0 bridge on a old Intel gaming machine. Had no problem keeping up with line speed.

I didn't test wireguard with it, but it should work pretty effectively for testing what speed it can get up to.

Reply on news.ycombinator.com