Wireguard with vpn director rules disable hardware acceleration?

[littlepopkaka]

I use Wireguard to connect the lan of two houses. My bandwidth is 500m. Recently, I found that when I download steam games , all device networks will become too laggy. I can't play games. After checking the causes, i found that wireguard with VPN Director is problem. If it is turned off the VPN Director rules or the bandwidth is reduced to around 300m, it will be normal. Additionally, I found that using OpenVPN is also very smooth. So, does Wireguard with rules will affect hardware acceleration functionality？my device is ax86u with 388.7

 

[Adooni]

OpenVPN work with 1 core only and WireGuard with all for you router internet speed with WireGuard should be 4x OpenVPN ones - this depend of max speed of VPN provider. With your router OpenVPN speed should be 250-300Mbit with WireGuard max ISP speed 500Mbit.

you did not provided what VPN provider you are using, please check what WireGuard setting are for it.

ping should be the same for OpenVPN and WireGuard.

 

[RMerlin]

The WireGuard protocol is not compatible with hardware acceleration. Enabling a tunnel will also enable a bypass for traffic related to that tunnel.

 

[littlepopkaka]

The WireGuard protocol is not compatible with hardware acceleration. Enabling a tunnel will also enable a bypass for traffic related to that tunnel.

i see runner and flowcache is enable. so in fact ,if i use wireguard client ,hw acceleration id disable?

 

[RMerlin]

i see runner and flowcache is enable. so in fact ,if i use wireguard client ,hw acceleration id disable?

I said bypass, not disable...

Only traffic related to the tunnel IPs will bypass flow cache.

 

[littlepopkaka]

I said bypass, not disable...

Only traffic related to the tunnel IPs will bypass flow cache.

ok thanks. and its openvpn also bypass flow cache?

 

[RMerlin]

ok thanks. and its openvpn also bypass flow cache?

No, OpenVPN is compatible with it because it works over a regular TLS connection, like a web browser connecting to a site over HTTPS.

 

[littlepopkaka]

No, OpenVPN is compatible with it because it works over a regular TLS connection, like a web browser connecting to a site over HTTPS.

thanks. by the way ,the wireguard of official asuswrt is the same? i use wireguard for game streaming, but as you said, it bypass flow cache, so sometimes the network will lag，its make me uncomfortable,,,,,,,,,,,,,,,,,

 

[RMerlin]

the wireguard of official asuswrt is the same?

Yes. The bypass code was developed by them and Broadcom.

 

[littlepopkaka]

Yes. The bypass code was developed by them and Broadcom.

thanks,its seems that i need to find another way for game streaming

 

[RMerlin]

thanks,its seems that i need to find another way for game streaming

Streaming over a VPN will never be ideal latency-wise, due to encryption, the probable higher number of hops, etc...

 

[MayBe]

I said bypass, not disable...

Only traffic related to the tunnel IPs will bypass flow cache.

In my case, when I enable the rule for the VPN tunnel in VPNDirector on my GT-AX6000 with 388.7
When only lan LAN traffic (not related to any tunnel),
the local speed drops to 1 Gbps with a frenzied load on one core at least 100%.
I have a 2.5 Gbps NAS and a Wi-Fi client with a 2400 Mbps connection speed.
After disabling this rule - Speed is restored to theoretical maximum in this situation ( LAN to WiFI about 2G)

 

[BVGeek]

Hi @RMerlin - many thanks for the amazing firmware you've been working on over the years.

I can report similar behavior when using CIDR rules in VPN Director, however, at least in my case, I only notice it with an RT-AX58U. An RT-AX88U Pro with the same VPN Director configuration works as expected.

The RT-AX58U is connected to a 1Gbit/.5Gbit PPPoE fiber (MTU is 1492). Speedtests to the ISP's Ookla server report 700Mbit/300Mbit with CIDR rules in VPN Director and 950Mb/480Mbit with CIRD rules removed.
The RT-AX88U Pro is connected to a 1.5Gbit/1Gbit PPPoE fiber (MTU is 1492). Speedtests to the ISP's Ookla server report identical speeds with both CIDR rules in VPN Director and without - 1600Mbit/1060Mbit.

Site 1 subnet is 10.AA.0.0/24 - RT-AX88U Pro router
Site 2 subnet is 10.BB.0.0/24 - RT-AX58U router
Site 3 subnet is 10.CC.0.0/24 - RT-AX56U router (no WG client connections from this router).

VPN Director for Site 1:
<1>Site2>>10.BB.0.0/24>WGC1
<1>Client1>10.AA.0.252>>WGC1
<1>Client2>10.AA.0.251>>WGC1
<1>Site3>>10.CC.0.0/24>WGC2

VPN Director for Site 2:
<1>Site1>>10.AA.0.0/24>WGC1
<1>Client1>10.BB.0.113>>WGC1
<1>Client2>10.BB.0.114>>WGC1
<1>Client3>10.BB.0.116>>WGC1
<1>Site3>>10.CC.0.0/24>WGC2

Disabling the entries marked in RED restores full thruput for Site 2.

Is it possible that the cache flow bypass developed by Broadcom is not applied on the older AX58U router or is it a WAD we just have to live with?

 

[michael249478]

Hi,

I have a same issue on AXE16000 with VPN Director.

Enable a CIDR on destination network, slow down all clients, even for a destination that are not on this CIDR.

But if i not use VPN Director, and make a manual routing policy (ip rule), i can route all clients for a CIDR destination trought a vpn, without slow down for other destinations.

Best Regards

 

[ZebMcKayhan]

Enable a CIDR on destination network, slow down all clients, even for a destination that are not on this CIDR.

The bypass designed by Asus/Broadcom is only for source ip, figure to fit VPNFusion. Once populated with destination ip entire lan is probably bypassed. This is likely by design. See https://www.snbforums.com/threads/session-manager-4th-thread.81187/post-815389

But if i not use VPN Director, and make a manual routing policy (ip rule), i can route all clients for a CIDR destination trought a vpn, without slow down for other destinations.

Interesting... I would assume this is a case not considered, thereby no part of the firmware is checking this. But I would also assume this is no solution to the NAT incompability. Check your log file for crashes, blog mcast related error messages. If not, your lucky!

 

[MayBe]

Same situation, ip route add xxx.xxx.xxx.xxx/24 via xxx.xxx.xxx.xxx dev iface_name - works without slow down on main network

Hi,

I have a same issue on AXE16000 with VPN Director.

Enable a CIDR on destination network, slow down all clients, even for a destination that are not on this CIDR.

But if i not use VPN Director, and make a manual routing policy (ip rule), i can route all clients for a CIDR destination trought a vpn, without slow down for other destinations.

Best Regards