Speed loss when using wireguard

ahm · December 10, 2022, 9:42pm

Hey

Recently, with the help of people in this forum, I was able to setup an OpenWrt router with WireGuard for my internal home use.

My struggle is documented under the following thread:

Here is how my network looks like:

I'm very happy with the setup, and it is catering my needs :). The only problem which I face is drop in speed which I connect with WireGuard WiFi. Following is the speed test result which I'm connected with WireGuard Wifi:

To benchmark, when i connect with Normal Wifi and run WireGuard locally on my computer i get way better speed:

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd28:714c:ff0d::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'

config device
	option name 'eth0.1'
	option macaddr '50:d3:f4'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.178.120'
	list dns '8.8.8.8'
	option gateway '192.168.178.1'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 6t'

config interface 'gate'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.2.2'

config interface 'g0'
	option proto 'wireguard'
	option peerdns '0'
	list dns '10.0.0.243'
	list dns '10.0.0.242'
	option private_key '+6Hny+i4c5H30='
	list addresses '10.14.XX.XX/24'

config wireguard_g0
	option description 'Imported peer configuration'
	list allowed_ips '0.0.0.0/0'
	option persistent_keepalive '25'
	option endpoint_port '1337'
	option route_allowed_ips '1'
	option public_key '+U6WkVImkNjRoUVDD5l4='
	option endpoint_host '102.165.XX.XX'

cat /etc/config/firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'
	option flow_offloading '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option masq '1'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'gate'
	option input 'ACCEPT'
	option output 'ACCEPT'
	list network 'gate'
	option forward 'ACCEPT'

config zone
	option name 'g0'
	option output 'ACCEPT'
	list network 'g0'
	option input 'REJECT'
	option forward 'REJECT'
	option masq '1'

config forwarding
	option src 'gate'
	option dest 'g0'

cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac8'
	option path 'pci0000:00/0000:00:00.0/0000:01:00.0'
	option channel '36'
	option band '5g'
	option htmode 'VHT80'
	option cell_density '0'

config wifi-device 'radio1'
	option type 'mac80'
	option path 'platform/10180000.wmac'
	option channel '1'
	option band '2g'
	option htmode 'HT20'
	option disabled '1'

config wifi-iface 'wifinet2'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Normal'
	option encryption 'sae'
	option key 'blue$ock$'
	option network 'lan'

config wifi-iface 'wifinet3'
	option device 'radio0'
	option mode 'ap'
	option network 'gate'
	option ssid 'Wireguard'
	option key 'blue$ock$'
	option encryption 'psk2'

cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option nonwildcard '1'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config dhcp 'gate'
	option interface 'gate'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

I want to understand that is it normal to expect such speed drop when using WireGuard on OpenWrt, or there is something incorrect with my configuration.

lleachii · December 10, 2022, 9:49pm

Yes, it is normal. It takes CPUs to run the encryption, etc. of a VPN. These resources must come from somewhere - they come from your router.

ahm · December 10, 2022, 9:52pm

@lleachii Thanks for replying.
So there is not much which I can do about this? (Other than buying a better Router)

mk24 · December 10, 2022, 9:53pm

It should show you have a different ISP when going through VPN. Here it looks like it is DET Africa in both cases.

ahm · December 10, 2022, 9:55pm

@mk24 In both cases I'm using VPN. In the first case, it is running on the Router and In the second case, VPN is running on my computer.

znevna · December 10, 2022, 9:59pm

What router are we talking about?

ahm · December 10, 2022, 9:59pm

@znevna I'm talking about OpenWrt router.

znevna · December 10, 2022, 10:00pm

We got that, but what secret hardware is it?

ahm · December 10, 2022, 10:03pm

@znevna It's not a fancy Router:

Model: Asus RT-AC51U
Architecture: MediaTek MT7620A ver:2 eco:6

znevna · December 10, 2022, 10:05pm

That has a slow single core CPU, probably should've started with that.
Get better hardware if you want better performance.

ahm · December 10, 2022, 10:07pm

@znevna
Thanks for replying, so basically it's just a hardware problem.

system · December 20, 2022, 10:07pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.