Am 28.08.2019 um 21:08 schrieb Alex Davies:
This is great news. We have been using wireguard on OPNSense (mostly
as servers, but also as a client in a few places) in production for
some time now, without drama (we found one bug with a trivial
workaround, see email chain "Table=off behavior (not adding any route
*at all*)" to this list). We can now upgrade to something formally
"supported" ;-)
If anybody else tries to use the hardware appliances provided by the
founders of OPNSense (Deciso[1]) as a wireguard server or client, we
found the performance on the non-x86 CPUs (A10, etc.) was not great
(they have all sorts of ipsec type offloads, but not for WG). IIRC we
struggled to get more than a few gigabits per second in aggregate. The
Intel E3 models are able to run as close to line rate on 10G as makes
no odds for us.
[1]
https://www.deciso.com/wp-content/uploads/2015/11/Brochure-OPNsense-appliances_ordered-rev201603.pdf
The gateway code in OPNsense 19.7 changed, so it was only possible to do
PBR with 19.1.X.
With the last update of 19.7.3 I updated the plugin to add gateway
support so it works with PostUp and PostDown. As usual in Open Source it
lacks documentation yet. :)
https://github.com/opnsense/plugins/pull/1443
I did some quick iperf tests in a 10G lab last year (old Xeon E3):
https://www.routerperformance.net/comparing-opnsense-vpn-performance/
Best,
Michael
_______________________________________________
WireGuard mailing list
[email protected]
https://lists.zx2c4.com/mailman/listinfo/wireguard
