[hultner]

Is there by any chance a speed comparison against IPSec (IKEv2) i.e. strongSwan with AES-NI?

I haven’t used OpenVPN in many years, so such a comparison would be much more interesting.

[chrisper]

From experience I can tell you that IPSec is much faster than OpenVPN.

I have no issues getting Gbit over IPSec (Strongswan), but with OpenVPN I always maxed out around ~400Mbit.

EDIT: Looks like I misunderstood your comment and it seems like you want a comparison to Wireguard... oops

[hultner]

Yeah that’s my experience as well. That’s why I wanted a comparison. My router at home easily handles gigabit over IPSec even though the CPU is at least 8 years old.

[nopcode]

It's extremely fast, the benchmarks I've seen show that it's even faster than the IPSec config you describe.

[jsjohnst]

> the benchmarks I've seen

I think GP was asking for links to that, able to share?

[ludde]

There are some benchmarks here https://www.wireguard.com/performance/

[aaronmdjones]

Preliminary benchmarks are available on the website.

https://www.wireguard.com/performance/

EDIT: Note these are obviously for the reference implementation, not TunSafe.

[hultner]

Interesting, haven’t run IPSec under Linux, is this expected performance?

Seems rather low compared to what I’ve experienced under FreeBSD. An i7 Ivy Bride & Broadwell and should be aleast comparable to my almost decade old Nehalem-EP Xeon, shouldn’t it?

[aaronmdjones]

Well, there are a few mitigating factors.

First, these are the mobile variants of the CPUs, which are usually slower than their desktop counterparts out of the box, and clock lower more often due to thermal management kicking in a lot, too.

Secondly, a gigabit network card was used, which sets a low ceiling for the benchmark.

Thirdly, these were results averaged over 30 minutes (which again may cause heat issues in some laptops), not burst performance; I doubt OpenVPN would even register on a graph of burst performance of, say, 3 seconds.

Lastly, from what I hear, the Linux IPsec stack is a lot more complicated than is typical. Granted, they're all complicated, but still ...