Wireguard Site-to-Site Performance

Hi everyone, happy Monday :slight_smile:

I know, this post could also go to a Wireguard/AVM/OpenWRT/… forum, but around here answers are usually most useful. :slight_smile:

Upon being notified by Discomp s.r.o. (discomp.cz) about Turris Academy #4 I decided to evaluate the performance on my site-to-site Wireguard VPN.

What is working?

  • everything
  • I can access resources on the other site, pings work, transfers work

What is not working?

  • Nothing.

Setup:

  • Site A
    • Wireguard runs on Turris Omnia
    • Limited by upload to 15 MBit/s (indicated by red arrow in picture below)
  • Site B
    • The Wireguard VPN endpoints runs on a RaspberryPi 4 behind an AVM FritzBox 7490
    • Limited by upload to 40 MBit/s (indicated by red arrow in picture below)

What is questionable / problem:

  • Performance across the site-to-site Wireguard VPN
  • From Site A to Site B transfers range around 10 MBit/s (only 66% of the line’s capacity) (I would expect approx. 12-14 MBit/s)
  • From Site B to Site A transfers range around 18 MBit/s (only 45% of the line’s capacity) (I would expect approx. 30-35 MBit/s)

Analysis done so far:

  • Both routers (Turris Omnia and AVM Fritz Box) are “bored”. There is no significant CPU usage when performing tests using iperf (running on the Turris Omnia and the RaspberryPi)
  • The RaspberryPi 4 is “bored” also, no significant impact on the CPU either.
  • Speedtests (e.g. Ookla) confirm the lines’ capacity indicated by the green and red arrows.

Key questions:

  1. What my be reasons for the low performance?
  2. What should be evaluated to identify the bottleneck?

Thanks so much!