Wireguard, NAT (?) speed problem

Installing and Using OpenWrt
1

Hello!

I have two vanilla (only the wireguard packages are added, and configured to the installed system) x86 OpenWRT 19.07.2 appliances connected together with wireguard:
Site A:
Router local ip: 192.168.11.254
Router wireguard ip: 192.168.22.1

Site B:
Router local ip: 192.168.33.254
Router wireguard ip: 192.168.22.2
Client: 192.168.33.120

My problem is as follows:
When transferring (running iperf server (both UDP and TCP), or pulling a file with wget) on the Client on Site B (192.168.33.120), the speed is just abnormally slow:
192.168.22.1 to 192.168.33.120: about 3.5MB/sec
192.168.11.254 (note that is the very same device as above, just its local address) to 192.168.33.120: about 1.70MB/sec

  • the same measurement applies if i pull anything from 192.168.11.0/24

Further observations:

  • If i initiate the test from the router on Site B:
    192.168.22.1 to 192.168.22.2: about 20MB/sec (wire speed)
    192.168.11.254 (again, the same device, just different address) to 192.168.22.2: about 20MB/sec (wire speed)

  • If I set up a portforward on Site B router (192.168.33.254:81 to 192.168.22.2:80: socat TCP4-LISTEN:81,su=nobody,fork,reuseaddr TCP4:192.168.22.1:80), then run the wget http://192.168.33.254:81/testfile on the client (192.168.33.120), I am getting wire speed again.

  • Downloading on the client (192.168.33.120) anything from the internet is also at wire speed.

  • I do not see any cpu, interrupt starvation on either of the routers during the tests.

  • I have tried permuting mtu_fix on all interfaces, but nothing changed.

  • All measurements were repeated multiple times, at different times of day, and are consistent.

This indicates that it is not an ISP throttling, or mtu issue on the VPN.

Could you help me diagnose and solve this issue?

Thanks
wD40

2

UPDATE:

  • I don't know how to explain, but pulling from 192.168.11.0/24 or 192.168.22.1 to 192.168.33.120 are now equally fast (slow) at 3.5MB/sec
  • the problem persists with butchering the firewall, and applying only the essential nat rules on Router B:
/etc/init.d/firewall stop
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o wireguard0 -j MASQUERADE
3

I was shooting myself in the foot with adjusting the TCP window scaling on the client. Reverting it to normal brings wire speed on the VPN link.

4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.