31–40 of 293 posts
I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.
Pedantic: Linus’s
So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?
I don’t know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.
If you're wondering what it is: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many…
So like IPSec? e: I mean that doesn’t suck
So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?
A polling/batching implementation of WireGuard would be faster than the Linux kernel implementation although it would be much less convenient to use. If WireGuard spends, say, 90% of its time in ChaCha20-Poly1305 (which is already highly optimized) then there's only room for less than 10% speedup.
So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?
WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.
Wrote a little post some time ago on how to set it up on linux and use it on android. Super simple. https://blog.oxplot.com/wireguard-vpn-on-android/
Earlier quoted context omitted.
A major difference, besides WireGuard's simplicity, is that IPSec is a layer 4 protocol (ESP packets instead of TCP/UDP packets) whereas WireGuard is a layer 5 protocol (runs over UDP), so switches don't choke on it, and so a WireGuard peer doesn't need a public-routable IP address, but can be behind NAT.
WireGuard operates at layer 3. The first sentence from the white paper by Jason A.: “ WireGuard is a secure network tunnel, operating at layer 3...”. [1] Regardless of the layer, in a few words WireGuard is a simple encrypted tunnel over UDP. Since it’s UDP - there’s no guarantee all packets will be delivered, BUT - what WireGuard places emphasis on is all packets delivered from the WireGuard interface will be authen…
My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information it maintains.