Load-balancing between 2 wireguard connections with the same endpoint (server/ip)

Hello everyone. I have already read a lot here in the forum while looking for a solution to my case and must say that it is a very nice community. congratulations on this.

My problem is that my ISP limits every single connection to 100Mbps. That's exactly what it has to do as a minimum according to the terms of the contract. The fiber contract is advertised with 200Mbps download as well as upload. The provider is cheap and 100Mbps tends to be enough for me. However, I would like to be able to use my full line sometimes. Not every download source offers downloads via multiple connections. Actually none.

I know that if I e.g. set up 2 separate wireguard connections to my vpn provider and start a download with both, that I get my full bandwidth. So 200Mpbs.
I searched a lot about load-balancing between 2 wireguard connections with the same endpoint (server/ip) and would like to know if I can get there with openWRT to my goal.

I would be very happy to receive answers. First I wanted to implement it only via Docker to then run certain containers over it. The only project I have found is:

Although the project rather follows the approach to unite several ISP connections, but actually this meets my problem pretty well. However, there seem to be problems with wireguard in this project. :frowning:

There are a number of assumptions that would need to be true (like CPU power) for this to work properly, but I think that fundamentally you'll still be in a situation where you are only load balancing, not aggregating/bonding the connections. You'd theoretically have 2 tunnels that are capable of 100Mbps operation each (so 200Mbps of available total bandwidth), but, just as it is now, your any individual connection would travel via one tunnel or the other. So your load balancer would achieve exactly what you've already proven -- you can get two simultaneous 100Mbps streams. But it wouldn't be able to aggregate/bond these connections for one 200Mbps stream.

That said, if you actually control the other end of the connection, it might be possible to setup bonding on both sides. But if I read it properly, you have a commercial VPN provider, so you wouldn't be able to bond connections without their cooperation.

Do you actually need two tunnels, not just one?

Based on the OP's description, any individual connection created (i.e. a single tunnel) has a max bandwidth of 100Mbps. They have proven that they can get 200Mbps by establishing two separate tunnels. So, yes, two tunnels would be necessary to get a total of 200Mbps throughput. However, I don't think that the OP will be able to aggregate the connection, but load balancing should be possible.

Still don't understand why one "clear text", and one encrypted connection wouldn't suffice, but let's drop the subject...

Oh, yeah, that could work, too... unless the OP wants everything to traverse the tunnels (to keep it encrypted so the ISP cannot snoop).

There is a way to aggregate two (or more) tunnels using the bonding from both sides and get the aggregated speed, provided that the server has the necessary throughput. It was accomplished in Zeroshell for quite some time. But it can be quite costly and needs a beefy router to route 2 VPNs at such speeds.

1 Like

That's right, I have a commercial VPN provider. And it is also true that it is important to me that the provider is not allowed to look into the packets.

As hardware I have just 2 x Netgear Nighthawk X4S R7800 lying around. I wanted to set them up the next few weeks and connect via LAN and then set up a mesh via B.A.T.M.A.N.. I strongly suspect that the power of a Netgear R7800 is not enough to implement my project, right? :smiley:

EDIT:
Is mwan3 perhaps a good choice?

I think here is someone who did almost the same:
https://lore.kernel.org/wireguard/s7r35rV6aqXJrq9tA0DjWLgyiS1fYwO_0gkBFyuyVK73vx5qN60gt2_1ZVRHnG6R3htZiBJOWZMz9wBmMLYP3Bz0SZYvNvIrhKLjkNbzTxI=@alexago.xyz/T/

That is not necessarily good, as it is not guaranteed they will bond your tunnels.

mwan3 is fine, but it won't aggregate. You'll have to open multiple connections to utilize both uplinks.

I don't know if the R7800 will be able to handle those speeds. How much is it utilized when you fully utilize one tunnel?

How can I test this?

Start 2 parallel downloads and look in the web-ui? Is there a cpu/ram utilization range?