WireGuard expert Tailscale has achieved a breakthrough in the performance of WireGuard-based VPNs, resulting in significant improvements in throughput.
More specifically, the Tailscale team applied optimizations such as UDP segmentation offload, UDP receive coalescing, and checksum unwinding, which led to substantial throughput improvements for VPN clients using the WireGuard Go implementation.
WireGuard is an open-source communication protocol that implements virtual private networks, designed to be leaner and better performing than preceding tunneling standards such as IPsec and OpenVPN.
Tailscale is a company that provides scalable VPN solutions built on top of the WireGuard protocol and which has previously contributed significant optimizations and improvements on the standard to the benefit of all WireGuard users.
10Gbit/s on “Bare Metal” Server
The mentioned improvements applied by Tailscale were identified after carefully studying the WireGuard codebase, locating potential areas where performance could be enhanced.
The three main performance improvements implemented by Tailscale’s engineers are the following:
- UDP Segmentation Offload (GSO): offloads packet segmentation to network hardware, reducing CPU overhead and improving throughput.
- UDP Receive Coalescing (GRO): aggregates multiple smaller packets into a larger one at the receiving end, minimizing CPU usage and enhancing network performance.
- Checksum Unwinding: eliminates redundant checksum calculations, reducing CPU usage and contributing to increased VPN performance.
The team conducted tests using wireguard-go on two different systems: c6i.8xlarge and i5-12400, both with UDP GSO, GRO, and checksum unwinding optimizations. The results indicated a substantial increase in performance, with the c6i.8xlarge system achieving 7.32 Gbps, while the i5-12400 system reached 13.0 Gbps.
Tailscale
This performance enhancement allows Tailscale to join the 10 Gb/s club on bare-metal Linux servers and wireguard-go to surpass the in-kernel WireGuard implementation on the tested hardware. The term “bare metal” refers to physical (non-virtualized) servers that are dedicated to a single tenant, offering consistent and predictable performance results.
WireGuard to Get Speedier for All
This development is crucial for all users of VPNs that rely on WireGuard, as it showcases the potential for improving performance through the application of these optimizations. In our own tests for the WireGuard vs OpenVPN comparison, we’ve also found WireGuard to be significantly faster than legacy protocols.
The increased speed and efficiency achieved by Tailscale are expected to be rolled to the entire community of WireGuard-based VPN users and make the pioneering protocol even more appealing to VPN providers who haven’t adopted it yet. Due to performance and security advantages, there are many VPNs with WireGuard support already available.
Tailscale’s Jordan Whited has already submitted commits for consideration by WireGuard’s core developers and could be implemented upstream very soon. Of course, projects that use WireGuard will see varying levels of performance improvements based on the specific hardware, network conditions, and VPN client implementation.
We will be particularly interested to see whether the relative performance of various WireGuard VPNs changes in comparisons such as these:
If we could just get WireGuard to work on routers…
Wireguard is already crazy impressive. Bet this is going to make things even better. Can’t wait to see what the next few years bring to tunneling technology.
You impress too easily, lol
Privado vpn free and windscribe vpn free both 10gb is pretty good and fast. especially privado vpn.
Both vpn’s you mention are good and fast unlike Surfshark and Nord. in my experience.
I personally prefer Windscribe. My subscription with Nord ended recently and I couldn’t be happier with Windscribe’s it’s simple and effective interface and speeds.
What I don’t like about Privado is it supports SOCKS5 and that doesn’t hide your actions from your ISP. For instance, if you’re torrenting, your ISP will know if you’re using SOCKS5.
Nice, thank you Heinrich Sir,
I am using Nord and Surfshark VPN and both have Wireguard Protocol. Nord’s Nord Lynx is based on Wireguard.