[Experimental] WireGuard for HND platform (4.1.x kernels)

[mattmcspirit]

chmod 000 /opt/etc/init.d/S50wireguard

Thanks - with this applied, how do I have enough permission to manually start/stop? I'm logged in as the admin user, but get permission denied.

Thanks for your help - much appreciated.

 

[Odkrys]

ow do I have enough permission to manually start/stop?

Unlike systemctl, I don't know how to prevent autostart and enable manual start.

 

[mattmcspirit]

Unlike systemctl, I don't know how to prevent autostart and enable manual start.

Thanks - I may have figured out a workaround for now; I've moved the S50wireguard file from init.d to /opt/home/ and and can confirm that it doesn't start automatically on reboot, and also still functions manually with the start/stop/restart commands.

 

[Zonkd]

Possible to run a server and a client simultaneously? If so, how? If not, why not?

 

[Odkrys]

Possible to run a server and a client simultaneously? If so, how? If not, why not?

make copy S50wireguard

 

[heysoundude]

Has anyone here using WireGuard with Merlin updated to the latest version?
There may be some interesting additions/updates contained within:
https://www.snbforums.com/threads/beta-asuswrt-merlin-384-17-beta-is-out.63565/

 

[The Chief]

Has anyone here using WireGuard with Merlin updated to the latest version?
There may be some interesting additions/updates contained within:
https://www.snbforums.com/threads/beta-asuswrt-merlin-384-17-beta-is-out.63565/

These changes are unrelated to wireguard. It works perfectly with 384.16, don't see why not with 384.17.

 

[heysoundude]

These changes are unrelated to wireguard.

I'll give you the "unrelated:" they may yet still prove complimentary I would think.

 

[The Chief]

I'll give you the "unrelated:" they may yet still prove complimentary I would think.

Updated to 384.17 beta, no issues with WG.

 

[heysoundude]

Updated to 384.17 beta, no issues with WG.

Fantastic, but I wasn't looking for issues. I'm hoping for improvements, synergies...time will tell no doubt.

 

[Wallace_n_Gromit]

When I go to amazon I see several Models:

RT-AC86U
RT-AC2900
GT-AC2900

Are they all the same/interchangeable with the Merlin/wireguard firmware/addon's?

sorry if this question has been asked already, did a search on this thread for "AC2900" and got nothing. Even the MD5 hashes on the latest firmware at ASUS for the RT-AC86U and RT-AC2900 are exactly the same.

 

[doczenith1]

sorry if this question has been asked already, did a search on this thread for "AC2900" and got nothing. Even the MD5 hashes on the latest firmware at ASUS for the RT-AC86U and RT-AC2900 are exactly the same.

I'm fairly certain the RT models use the same firmware. In the past some GT models if I remember correctly used a different firmware and were not compatible with Asuswrt-Merlin.

Edit: And from Asuswrt-Merlin website....the RT-AC2900 (same firmware as RT-AC86U)

Edit 2: From the FAQ in the Asuswrt-Merlin forum.

Model support

Q: Will you support the GT-xxxxx?
A: No, because of infrequent GPL releases from Asus (mandatory for proper support by Asuswrt-Merlin), the amount of extra work involved in supporting specifically those GT models, and their low popularity due to their high price.

 

[Odkrys]

Rough benchmark of WireGuard Userspace implementation.

Server : RT-AC86U
Client : Windows 10 laptop. WireGuard-windows. Connected over wi-fi.

The measurement tool was iperf.

wireguard-go (64bit) 120Mbps Cpu 100%/200%
wireguard-go (32bit) 102Mbps Cpu 110%/200%

boringtun (64bit) 178Mbps Cpu 110%/200%
boringtun (32bit) 73Mbps Cpu 120%/200%

Rust was better on 64bit and Go was better on 32bit.
Do not believe too much as it was a rough measure.


Edit : Wired test.

wireguard-go doesn't seem to be using all of router's resources.
On the other hand, boringtun shows 100% utilization when pinning to the second cpu using taskset.
However, it looks very bad on 32bit.

kernel 422Mbps CPU 180~190%/200%

wireguard-go 132Mbps (64bit) CPU 110%~120%/200%
wireguard-go 110Mbps (32bit) CPU 120%/200%

boringtun (64bit) 242Mbps CPU 150%/200% (core 1 50%/core 2 100%)
boringtun (32bit) 72Mbps CPU 120%/200% (core 1 20%/core 2 100%)


Edit 2 : wireguard-rs. Wired.

wireguard-rs looks good.

wireguard-rs (64bit) 216Mbps CPU 160~190%/200%
wireguard-rs (32bit) 208Mbps CPU 170~190%/200%

 

[RMerlin]

Rough benchmark of WireGuard Userspace implementation.

Server : RT-AC86U
Client : Windows 10 laptop. WireGuard-windows. Connected over wi-fi.

The measurement tool was iperf.

wireguard-go (64bit) 120Mbps Cpu 100%/200%
wireguard-go (32bit) 102Mbps Cpu 110%/200%

boringtun (64bit) 178Mbps Cpu 110%/200%
boringtun (32bit) 73Mbps Cpu 120%/200%

Rust was better on 64bit and Go was better on 32bit.
Do not believe too much as it was a rough measure.

Still shows that it's not very far away from OpenVPN, confirming that what's mostly killing OpenVPN performance are the context switches, not the OpenVPN code itself.

 

[Odkrys]

Still shows that it's not very far away from OpenVPN, confirming that what's mostly killing OpenVPN performance are the context switches, not the OpenVPN code itself.

I agree. Userspace and single-threaded are really problems.

 

[Fredrik <RND>]

Wireguard for Mullvad suddenly stopped working for me. I made no change but have now updated to latest beta.
openvpn works but I only get 150Mbit down instead of 600Mbit with wireguard.

Anyone have a tip?

router: RT-AC86U

 

[RMerlin]

I agree. Userspace and single-threaded are really problems.

OpenVPN 2.5.0 will be great for low-powered devices, as it will introduce Chacha20 support.

 

[Odkrys]

OpenVPN 2.5.0 will be great for low-powered devices, as it will introduce Chacha20 support.

did you tested personally?
I tested on ac86u but I dont have other devices. (no improvement on ac86u)

 

[L&LD]

@Odkrys the RT-AC86U is not a 'low powered' device currently. The opposite actually for OpenVPN.

 

[Odkrys]

@Odkrys the RT-AC86U is not a 'low powered' device currently. The opposite actually for OpenVPN.

I know. As Rmerlin said, "what's mostly killing OpenVPN performance are the context switches,", I just wanna know real number.
In openvpn, the encryption level obviously affects throughput, but it's not much bigger than I thought.
On AC86U, cipher / auth = none and aes-gcm are almost the same throughput.
And aes-gcm is quite faster than chacha20, but the actual speed doesn't seem to make any difference.

https://www.snbforums.com/threads/rt-ax58u-vpn-speeds.62591/#post-559129
https://www.snbforums.com/threads/openvpn-performance-of-the-rt-ac86u.41217/page-13#post-457660