[Solved] Flint 2 Vanilla Openwrt - Wireguard VPN slow speed?

Installing and Using OpenWrt
1

Hello. I flashed my Flint 2 with the latest vanilla Openwrt, and after researching online I could make it run with Wireguard VPN with PBR and multiple VPN locations.

One thing I tested was the speed, to compare with the Gli.Net firmware, and the VPN speed was much, much slower for the same server and speedteat destination.

Is there a way to get similar speed, or at least more speed, with Wireguard? I enabled HW on the Firewall configs and reduced the MTU on Wireguard to 1280.

Searched online but didn't found anything (only Gen AI suggesting things).

I have 2 routers, so now I went back to the Gli.Net one, but I would love to use OpenWrt for more stability and be outside the vendor firmware (and issues that sometimes appear).

Thank you in advance for the help!

2

WireGuard itself normally won't use the firewall hardware offload path; that mostly helps routed/NAT traffic, not the crypto work. I would first test one plain tunnel with PBR disabled, then watch top/htop during a speedtest or iperf3 run. If one core is pinned, irqbalance/packet steering can matter more than MTU tweaks. Also try the provider/default MTU again instead of forcing 1280. GL.iNet firmware may have vendor/kernel tweaks too, so matching it exactly on vanilla OpenWrt is not always realistic.

3

I have a flint 2 running openwrt 25-12

I have setup WireGuard following this guide:
WireGuard Client Setup Guide

I get about 850 Mb/s running WireGuard might be my server side which maxes out

When switching from GL.iNet make sure you do not keep settings

You can enable hardware flow offload (Network > Firewall) and packet steering (Interfaces > Global network options)
You can also install irqbalance: https://openwrt.org/docs/guide-user/services/irqbalance

4

Thank you both - I'll try one at a time to see if I can improve the speed, even I'd doesn't match vendor firmware

5

So even with PBR enabled, with irqbalance (I think the remaining was already configured), I'm having much greater speeds (like the same as Flint 2 firmware). Maybe it was temporary, or turning off and now connecting everything made a difference.

So, I'll need to replace the router again with this and check in real life scenarios, if we can say like that. Thank you for the help!

7

@LongQT-sea - Your script and advice is very likely orthogonal to the OP's needs and does not address the stated issue (speed).

Please be mindful of the context of the thread before posting suggestions.

8

Glad you have got the speed is on par with the GL.iNET firmware.

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

9

Is it ok to enable both irqbalance and packet steering?

10

Yes you can normally do that without a problem.

11

Sorry to be nit picking but there is only "OpenWrt" and then there are vendor forks of OpenWrt.

It's like with Debian. There is Debian and its kind of spinoff Ubuntu. Same at the base but then there are few similarities....

12

There's no magic here. The throughput promises for WireGuard apply to GL.iNet's stock firmware and only when not using a VPN provider. Even then, it depends on several factors. Another thing, does the ChaCha20-Poly1305 cipher used by WireGuard actually have hardware offload support? From my experience, just set up WireGuard properly, whether it's a VPN provider or a local setup, and you'll get the results.

13

No there is no hardware offload for ChaCha20-Poly, some CPU's with AVX (X86) or Arm Neon can accelerate it a bit but there is no AES256 like hardware acceleration in a general purpose CPU I know.

14

I don't have a deep understanding of cryptography, which is why I rely on sources, and those sources may be right or wrong.

Would the Crypto++ Wiki be correct or incorrect here? Is ChaCha20 fast in software, but not accelerated by dedicated hardware in the same way as AES?

15

Yes that is correct