Absolute values for comparability #35
Comments
Yeah. I also mentioned this here: https://forum.openwrt.org/t/a-wireguard-comparison-db/187586/110?u=cyyself
Yeah. But this requires a complex setup. We can't collect as many results as we do now. We can have a separate result board for this benchmark in a real environment if you can do it. Also, there is a more straightforward way to use Cloudflare Warp, which provides public wireguard tunnels to reach the internet: we can override the reserved bytes on the wg packet to use kernel wireguard instead of Cloudflare's userspace client. As the largest CDN provider in the world, it might be capable of providing enough speed to reach your WAN ISP limit in most countries. The point is that I don't know if an ISP with a 1Gbps download speed subscription is common in the world. |
Living in Germany, the government considers 50Mbit/s as good enough... I'll think about it and may come up with something which would be working locally. Thanks for your time. |
Oh.... In China, 10G PON-based fiber connection is very common. About 23.0% of home broadband users have Download Speed >= 1000Mbps in 2023. However, we can reach Cloudflare at just about 100Mbps since they have no servers in mainland China. The nearest servers might be Hong Kong or Japan, or even route the traffic to Los Angeles on some ISPs. The latency also ranges from 15-200ms, depending on different ISPs.
Another suggestion is assuming the server and the client on the router have no significant performance impact. Still, ethernet MAC hardware and driver will influence the performance; we can set up switch configuration on the router hardware and split two LAN ports to separate VLAN to bridge to different netns and then set up the topology like this: +-----------+ +-----------+
| netns 1 | | netns 2 |
| LAN1-----(RJ45 Cable)------LAN2 |
| | | |
| wireguard | | wireguard |
| iperf3 | | iperf3 |
+-----------+ +-----------+In this case, a single RJ45 cable connected to 2 unused LAN ports would be enough. Since many routers supported by OpenWRT have a switch driver that supports DSA (Distributed Switch Architecture), writing a script to find unused LAN ports and setting up a VLAN like this might be easy. |
1Gbps should be quite common now. In fact, there are quite some places with 5Gbps/8Gbps/10Gbps connection now. Singapore is one such lucky place where the price of 10Gbps plans have dropped a lot in year 2024. Only one ISP still offers consumer 1Gbps Fibre internet service now. The rest are mostly offer 2Gbps/2.5Gbps/3Gbps/5Gbps/10Gbps services The government's goal is to have 50% of the household using 10Gbps plan in 2028. |
|
Testing Wireguard perfromance using the router behind a main router (Double NAT) is one good idea. iperf3 can be used. In that case, internet service speed does not matter, only the internal network speed matters. Main router --> router to be tested for wireguard VPN server performance --> LAN client of the router to be tested as iperf3 server iperf3 client needs to go to the Wireguard VPN tunnel to access the iperf3 server. Example: I have used this idea to test wireguard VPN server performance of Asus RT-AX86U and TUF-BE6500. I will try to test this with OpenWRT virtual router as well. |
|
BTW, here is one LxC container result for wg-bench. Proxmox PVE 8.2.7, Intel N100 Mini PC, 8GB RAM. The LxC container runs Ubuntu 22.04 and I assign 1GB RAM to it and with two virtual CPU cores. |
|
This is vitual OpenWRT router data, Proxmox PVE 8.2.7. I assign 4GB RAM and two virtual CPU core to the virtual OpenWRT Virtual Machine. |
OpenWRT virtual router, Intel N100 mini PC running Proxmox PVE 8.2.7. I assign 4GB RAM and two virtual CPU core to the OpenWRT virtual machine. OpenWRT WAN: 192.168.50.138 When the Laptop Wireguard client is not ON, then we can not ping the iperf3 server. OOkla Speedtest will be able to saturate the 2.5Gbe connection (using Singtel 5Gbps Fibre Internet service here in Singapore). When the Laptop Wireguard client is ON, then we can ping the iperf3 server from the laptop. OOkla SpeedTest results will be reduced but not much. From iperf3 results (NAT involved), we can say the virtual OpenWRT Wireguard VPN server performance is about 1.99Gbps download and 2.09Gbps upload. From OOkla SpeedTest results (no NAT involved), we can say the OpenWRT Wireguard VPN server performance is 1.999Gbps download and 2.226Gbps. |
|
Other than iperf3, Crusader may be used to check the performance -- both speed and latency. |
Hi, this project looks fun, however I'm a bit unsure about the use-case. It gives a nice relative idea how how much faster/slower devices are within this specific test setup, however unlikely to represent real data since it does not incorporate NAT performance but adds the overhead of running two iPerf instances.
Since the benchmark shows that i.e. a network runs fine around 10Gbit/s, wouldn't it be a nice (additional) test-setup to test for real data, too? My idea would be to use network namespaces and two network cards (i.e. USB) on a strong device (i.e. Laptop) to route through a router and then compare the results. Since most laptops and USB ethernet adapters easily push 1Gbit/s and routers hardly ever, it would be rather simple to have valid results even with slightly different hardware.
Would that be of interested? I think the OpenWrt community could profit from something like that and even vendors should run their tests on a reproducible set.
The text was updated successfully, but these errors were encountered: