Slow performance when running wireguard on Archer C6 v2(EU)

[sunsdejotajs]

Hello! Yesterday I installed OpenWRT on my Archer C6 v2(EU) to run wireguard as a server on my router. Unfortunately the performance is really slow and I think it could be router CPU issue.
I have set up wireguard on my Ubuntu VM as well as my router now.

These are the readings when I connect from my phone to router wireguard:

Iperf readings when using router as WG server

top command readings

But when I use my wireguard server on my VM the readings are a lot better:

Iperf readings when using VM as WG server

top command readings

Here are my configs, I hope I didn't leak anything trivial in them. I also have enabled Software flow offloading and Hardware flow offloading which definitely helped, but not with wireguard.

cat /etc/config/network

config interface 'loopback'

    option device 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'

    option ula_prefix 'fd09:7c54:08f0::/48'
    option packet_steering '1'

config device

    option name 'br-lan'
    option type 'bridge'
    list ports 'eth0.1'

config interface 'lan'

    option device 'br-lan'
    option proto 'static'
    option ipaddr '192.168.1.1'
    option netmask '255.255.255.0'
    option ip6assign '60'

config interface 'wan'

    option device 'eth0.2'
    option proto 'dhcp'
    option peerdns '0'
    list dns '1.1.1.1'
    list dns '1.0.0.1'

config interface 'wan6'

    option device 'eth0.2'
    option proto 'dhcpv6'

config switch

    option name 'switch0'
    option reset '1'
    option enable_vlan '1'

config switch_vlan

    option device 'switch0'
    option vlan '1'
    option ports '2 3 4 5 0t'

config switch_vlan

    option device 'switch0'
    option vlan '2'
    option ports '1 0t'

config interface 'vpn'

    option proto 'wireguard'
    option private_key 'PRIVATE KEY********************'
    option listen_port '5182'
    list addresses '192.168.5.1/24'

config wireguard_vpn 'wgclient'

    list allowed_ips '192.168.5.2/32'
    option public_key 'Publick key*****************'
    option private_key 'Private key**************'
    option endpoint_host 'endpoint IP *********'
    option endpoint_port '5182'
    option route_allowed_ips '1'

cat /etc/config/firewall

config defaults

    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option synflood_protect '1'
    option flow_offloading '1'
    option flow_offloading_hw '1'

config zone 'lan'

    option name 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    list network 'lan'
    list network 'vpn'

config zone 'wan'

    option name 'wan'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'
    option input 'DROP'
    list network 'wan'
    list network 'wan6'

config forwarding

    option src 'lan'
    option dest 'wan'

config rule

    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule

    option src 'wan'
    option proto 'icmp'
    option family 'ipv4'
    option name 'Drop-Ping'
    list icmp_type 'echo-request'
    option target 'DROP'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule

    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule

    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule

    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule

    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule

    option name 'Allow-IPSec-ESP'
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule

    option name 'Allow-ISAKMP'
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config rule 'wg'

    option name 'Allow-WireGuard'
    option src 'wan'
    option dest_port '5182'
    option proto 'udp'
    option target 'ACCEPT'

cat /etc/config/wireless

config wifi-device 'radio0'

    option type 'mac80211'
    option path 'pci0000:00/0000:00:00.0'
    option band '5g'
    option htmode 'VHT80'
    option cell_density '0'
    option channel 'auto'
    option country 'LV'

config wifi-iface 'default_radio0'

    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option ssid '************************'
    option encryption 'psk2'
    option key '******************'

config wifi-device 'radio1'

    option type 'mac80211'
    option path 'platform/ahb/18100000.wmac'
    option band '2g'
    option cell_density '0'
    option htmode 'HT40'
    option channel 'auto'
    option country 'LV'

config wifi-iface 'default_radio1'

    option device 'radio1'
    option network 'lan'
    option mode 'ap'
    option ssid '************************'
    option encryption 'psk2'
    option key '**********************'

cat /etc/config/dhcp

config dnsmasq

    option domainneeded '1'
    option localise_queries '1'
    option rebind_protection '1'
    option rebind_localhost '1'
    option local '/lan/'
    option domain 'lan'
    option expandhosts '1'
    option authoritative '1'
    option readethers '1'
    option leasefile '/tmp/dhcp.leases'
    option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
    option localservice '1'
    option ednspacket_max '1232'

config dhcp 'lan'

    option interface 'lan'
    option start '100'
    option limit '150'
    option leasetime '12h'
    option dhcpv4 'server'
    option dhcpv6 'server'
    option ra 'server'
    list ra_flags 'managed-config'
    list ra_flags 'other-config'

config dhcp 'wan'

    option interface 'wan'
    option ignore '1'

config odhcpd 'odhcpd'

    option maindhcp '0'
    option leasefile '/tmp/hosts/odhcpd'
    option leasetrigger '/usr/sbin/odhcpd-update'
    option loglevel '4'

[bigsmile]

Archer C7 v2 with WireGuard topped out around 35 Mbit, quite similar. So afaict this is a CPU-issue.

[egc]

Also note that running iperf on the router itself taxes the CPU.

Better run iperf on the clients to accurately measure throughput.

[sunsdejotajs]

That is what I did, I had iperf running on phone to my PC rather than router not to exhaust it even more.

[frank92735]

I tested WG on a vpn service provider at 80Mbps max on a c7 v2 on owrt version 21. You would think the slightly faster chip on the c6 should be able to match the c7.

Surprised WG was able to load on an c6 v2 eu (8mb flash machine)! Nice.

[bigsmile]

I did not do any tuning whatsoever, but your 80Mpbs is far better than what I ever got from it. Mine chokes at 35Mpbs (around 4MB/s).

EDIT: Ohh, almost forgot. I do have LUCI installed but not running, and my wireless is disabled (just putting that out there)

[frank92735]

Sorry I got my numbers mixed up. You are correct.

C7 V2 21.02.3 and 22.03.0 wireguard woes

Helllo I am using luci-app-wireguard to connect to a VPN provider and got full bandwidth ~230mbps on v19.07.7 but not on the newer versions listed above. 22.03.0 (squash upgrade) wireguard on a C7 V2 I am seeing 35mbps. With dnsmasq-full and wpad-mesh-openssl installed in addtion to the non ct ath10k packages. 21.02.3 (squash upgrade) Same 35mbps. Default packages plus luci-app-wireguard. Is this related to the new DSA and nftables? Should I try a fresh install of the full version factor…

[bigsmile]

Too bad you were, we all would have liked the +125% increase in speed

[frank92735]

It hurts being wrong sometimes but either way my C7 v2 is still getting 825-850Mbps straight through configured as a 4 port/4 vlan zero trust network. I use EA8300 daisy chained off that and they get around 180-225Mbps running wg. EA8300 does 400Mbps stock firmware or 380Mbps as of v21-22 (wan to lan).

[bigsmile]

Speedtest running over a Wire-guard connection, just tagging it here for historical purposes

[Varistan]

Theoretically, this could be helpful for somebody

OpenWrt 21.02 with Wireguard - low DL speed

@rzwo and @bass443 Try enabling packet steering: [screen246] This restored my speed. You can find this setting under: Network > Interfaces > Global network options.