From: "Muenz, Michael" <m.muenz@spam-fetish.org>
To: wireguard@lists.zx2c4.com
Subject: Re: [ANNOUNCE] OPNsense 19.7 supports WireGuard
Date: Thu, 29 Aug 2019 06:47:58 +0200 [thread overview]
Message-ID: <c87496a2-b47b-c15c-763c-3b01d0b039cb@spam-fetish.org> (raw)
In-Reply-To: <CAHwDNp2pLJBV8M0sPa+XA4MDMVqJOp2=PQ1B=_W++k7V=wYfGA@mail.gmail.com>
Am 28.08.2019 um 21:08 schrieb Alex Davies:
> This is great news. We have been using wireguard on OPNSense (mostly
> as servers, but also as a client in a few places) in production for
> some time now, without drama (we found one bug with a trivial
> workaround, see email chain "Table=off behavior (not adding any route
> *at all*)" to this list). We can now upgrade to something formally
> "supported" ;-)
>
> If anybody else tries to use the hardware appliances provided by the
> founders of OPNSense (Deciso[1]) as a wireguard server or client, we
> found the performance on the non-x86 CPUs (A10, etc.) was not great
> (they have all sorts of ipsec type offloads, but not for WG). IIRC we
> struggled to get more than a few gigabits per second in aggregate. The
> Intel E3 models are able to run as close to line rate on 10G as makes
> no odds for us.
>
> [1]
> https://www.deciso.com/wp-content/uploads/2015/11/Brochure-OPNsense-appliances_ordered-rev201603.pdf
>
The gateway code in OPNsense 19.7 changed, so it was only possible to do
PBR with 19.1.X.
With the last update of 19.7.3 I updated the plugin to add gateway
support so it works with PostUp and PostDown. As usual in Open Source it
lacks documentation yet. :)
https://github.com/opnsense/plugins/pull/1443
I did some quick iperf tests in a 10G lab last year (old Xeon E3):
https://www.routerperformance.net/comparing-opnsense-vpn-performance/
Best,
Michael
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
next prev parent reply other threads:[~2019-08-29 4:47 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-18 12:05 [ANNOUNCE] OPNsense 19.7 supports WireGuard Muenz, Michael
2019-08-25 15:45 ` Jason A. Donenfeld
2019-08-26 8:09 ` Varun Priolkar
2019-08-28 19:08 ` Alex Davies
2019-08-29 4:47 ` Muenz, Michael [this message]
2019-08-26 9:37 ` Muenz, Michael
[not found] <mailman.1.1566813601.6235.wireguard@lists.zx2c4.com>
2019-08-26 11:44 ` Vincent
2019-08-26 12:50 ` Chriztoffer Hansen
2019-08-26 14:25 ` Muenz, Michael
2019-08-27 4:28 Vincent
2019-08-27 5:15 ` Muenz, Michael
2019-08-27 7:35 ` Vincent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c87496a2-b47b-c15c-763c-3b01d0b039cb@spam-fetish.org \
--to=m.muenz@spam-fetish.org \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).