Tailscale vs Wireguard performance

GavinGreenwalt · August 10, 2021, 5:23pm

Any reason I should expect iperf3 speeds to be much slower on Tailscale than Wireguard? Windows runs tailscale in userspace same as Wireguard right? CPU isn’t maxed out on any test.

On a gigabit 1ms local connection with packet size small enough to fit within each application’s packet window size:

Wireguard: 317mbps

PS C:\Program Files\iperf-3.1.3-win64> .\iperf3.exe -c 192.168.99.2 -l 1200
[  4] local 192.168.99.1 port 52674 connected to 192.168.99.2 port 5201


[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.00   sec  38.4 MBytes   322 Mbits/sec
[  4]   1.00-2.01   sec  36.1 MBytes   300 Mbits/sec
[  4]   2.01-3.00   sec  39.9 MBytes   338 Mbits/sec
[  4]   3.00-4.00   sec  36.9 MBytes   309 Mbits/sec
[  4]   4.00-5.00   sec  38.8 MBytes   325 Mbits/sec
[  4]   5.00-6.00   sec  38.2 MBytes   320 Mbits/sec
[  4]   6.00-7.00   sec  37.3 MBytes   312 Mbits/sec
[  4]   7.00-8.00   sec  39.0 MBytes   328 Mbits/sec
[  4]   8.00-9.00   sec  36.3 MBytes   304 Mbits/sec
[  4]   9.00-10.00  sec  37.3 MBytes   313 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   378 MBytes   317 Mbits/sec                  sender
[  4]   0.00-10.00  sec   378 MBytes   317 Mbits/sec                  receiver

Tailscale (Direct): 275mbps

PS C:\Program Files\iperf-3.1.3-win64> .\iperf3.exe -c 100.96.118.106 -l 1200
[  4] local 100.118.125.44 port 52722 connected to 100.96.118.106 port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.00   sec  36.5 MBytes   306 Mbits/sec
[  4]   1.00-2.00   sec  34.9 MBytes   293 Mbits/sec
[  4]   2.00-3.00   sec  35.5 MBytes   297 Mbits/sec
[  4]   3.00-4.00   sec  37.7 MBytes   316 Mbits/sec
[  4]   4.00-5.01   sec  29.0 MBytes   242 Mbits/sec
[  4]   5.01-6.00   sec  30.2 MBytes   255 Mbits/sec
[  4]   6.00-7.00   sec  31.1 MBytes   260 Mbits/sec
[  4]   7.00-8.00   sec  30.4 MBytes   256 Mbits/sec
[  4]   8.00-9.00   sec  28.7 MBytes   241 Mbits/sec
[  4]   9.00-10.00  sec  34.9 MBytes   293 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   329 MBytes   276 Mbits/sec                  sender
[  4]   0.00-10.00  sec   328 MBytes   275 Mbits/sec                  receiver

Native: 352

PS C:\Program Files\iperf-3.1.3-win64> .\iperf3.exe -c 192.168.24.24 -l 1200
[  4] local 192.168.24.167 port 57833 connected to 192.168.24.24 port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.01   sec  43.4 MBytes   359 Mbits/sec
[  4]   1.01-2.00   sec  40.9 MBytes   348 Mbits/sec
[  4]   2.00-3.00   sec  41.5 MBytes   347 Mbits/sec
[  4]   3.00-4.00   sec  41.6 MBytes   350 Mbits/sec
[  4]   4.00-5.00   sec  42.3 MBytes   354 Mbits/sec
[  4]   5.00-6.00   sec  44.7 MBytes   376 Mbits/sec
[  4]   6.00-7.00   sec  43.2 MBytes   361 Mbits/sec
[  4]   7.00-8.00   sec  40.4 MBytes   339 Mbits/sec
[  4]   8.00-9.01   sec  39.7 MBytes   329 Mbits/sec
[  4]   9.01-10.00  sec  42.7 MBytes   363 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   420 MBytes   353 Mbits/sec                  sender
[  4]   0.00-10.00  sec   420 MBytes   352 Mbits/sec                  receiver

Allowing an unlimited window grows the difference even more:

Tailscale

[  4] local 100.118.125.44 port 60113 connected to 100.96.118.106 port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.00   sec  37.0 MBytes   310 Mbits/sec
[  4]   1.00-2.01   sec  30.9 MBytes   257 Mbits/sec
[  4]   2.01-3.00   sec  32.2 MBytes   273 Mbits/sec
[  4]   3.00-4.00   sec  29.1 MBytes   244 Mbits/sec
[  4]   4.00-5.00   sec  29.5 MBytes   248 Mbits/sec
[  4]   5.00-6.00   sec  24.0 MBytes   202 Mbits/sec
[  4]   6.00-7.00   sec  33.4 MBytes   280 Mbits/sec
[  4]   7.00-8.00   sec  20.0 MBytes   168 Mbits/sec
[  4]   8.00-9.00   sec  14.8 MBytes   124 Mbits/sec << high variability too here.
[  4]   9.00-10.01  sec  13.4 MBytes   111 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.01  sec   264 MBytes   221 Mbits/sec                  sender
[  4]   0.00-10.01  sec   264 MBytes   221 Mbits/sec                  receiver

Wireguard

[  4] local 192.168.99.1 port 60174 connected to 192.168.99.2 port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.00   sec  62.2 MBytes   521 Mbits/sec
[  4]   1.00-2.00   sec  60.6 MBytes   509 Mbits/sec
[  4]   2.00-3.00   sec  64.4 MBytes   540 Mbits/sec
[  4]   3.00-4.00   sec  65.1 MBytes   546 Mbits/sec
[  4]   4.00-5.00   sec  65.5 MBytes   550 Mbits/sec
[  4]   5.00-6.00   sec  62.4 MBytes   523 Mbits/sec
[  4]   6.00-7.00   sec  63.9 MBytes   536 Mbits/sec
[  4]   7.00-8.00   sec  60.4 MBytes   506 Mbits/sec
[  4]   8.00-9.00   sec  63.4 MBytes   532 Mbits/sec
[  4]   9.00-10.00  sec  61.9 MBytes   519 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   630 MBytes   528 Mbits/sec                  sender
[  4]   0.00-10.00  sec   630 MBytes   528 Mbits/sec                  receiver

Wireguard with standard window size is more than twice as fast.

Over a higher latency internet connection between two nodes the differences seems to also remain.

Tailscale Subnet Router
Reverse mode, remote host VPNHost is sending

[  4] local 100.118.125.44 port 61180 connected to 192.168.###.### port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.00   sec  9.49 MBytes  79.6 Mbits/sec
[  4]   1.00-2.00   sec  8.49 MBytes  71.2 Mbits/sec
[  4]   2.00-3.00   sec  7.03 MBytes  58.8 Mbits/sec
[  4]   3.00-4.00   sec  6.86 MBytes  57.7 Mbits/sec
[  4]   4.00-5.00   sec  8.99 MBytes  75.4 Mbits/sec
[  4]   5.00-6.00   sec  6.40 MBytes  53.7 Mbits/sec
[  4]   6.00-7.00   sec  9.73 MBytes  81.4 Mbits/sec
[  4]   7.00-8.00   sec  8.63 MBytes  72.5 Mbits/sec
[  4]   8.00-9.00   sec  7.96 MBytes  66.8 Mbits/sec
[  4]   9.00-10.00  sec  6.82 MBytes  57.2 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec  80.6 MBytes  67.6 Mbits/sec                  sender
[  4]   0.00-10.00  sec  80.5 MBytes  67.6 Mbits/sec                  receiver

Wireguard & iptables

Reverse mode, remote host VPNHost is sending
[  4] local 192.168.###.### port 51546 connected to 192.168.###.### port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-1.01   sec  13.0 MBytes   108 Mbits/sec
[  4]   1.01-2.00   sec  13.3 MBytes   112 Mbits/sec
[  4]   2.00-3.00   sec  12.5 MBytes   104 Mbits/sec
[  4]   3.00-4.00   sec  12.7 MBytes   107 Mbits/sec
[  4]   4.00-5.00   sec  13.5 MBytes   113 Mbits/sec
[  4]   5.00-6.00   sec  11.8 MBytes  98.8 Mbits/sec
[  4]   6.00-7.00   sec  13.3 MBytes   111 Mbits/sec
[  4]   7.00-8.00   sec  13.4 MBytes   113 Mbits/sec
[  4]   8.00-9.00   sec  13.0 MBytes   109 Mbits/sec
[  4]   9.00-10.00  sec  12.8 MBytes   107 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   129 MBytes   109 Mbits/sec                  sender
[  4]   0.00-10.00  sec   129 MBytes   109 Mbits/sec                  receiver

Wireguard is >50% faster

With MTU size constraints:

Tailscale Subnet Router (Linux)

PS C:\Program Files\iperf-3.1.3-win64> .\iperf3.exe -c VPNHost -R -l 1200
[  4] local 100.118.125.44 port 57918 connected to 192.168.###.### port 5201
[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec  92.0 MBytes  77.2 Mbits/sec                  receiver

Wireguard & iptables

PS C:\Program Files\iperf-3.1.3-win64> .\iperf3.exe -c VPNHost -R -l 1200
[  4] local 192.168.###.### port 52597 connected to 192.168.###.### port 5201

[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   152 MBytes   128 Mbits/sec                  receiver

Wireguard is nearly twice as fast.

Gavin

secunit · September 23, 2022, 3:56am

Did you ever find an answer here? I too can get hundreds of Mbps with wireguard and yet barely break 50Mbps with Tailscale direct.

wavesound · September 29, 2022, 12:38am

My guess is that is has to do with the fact that Tailscale uses wireguard in Go rather than in assembly. The tradeoff is platform compatibility over performance.

github.com/tailscale/tailscale

Maximum throughput too low / CPU usage too high on some platforms

opened 06:14PM - 27 May 20 UTC

apenwarr

L3 Some users P2 Aggravating T3 Performance/Debugging

On some platforms, especially ARM CPUs, tailscale has trouble routing packets as… fast as other VPN products, including in some cases (eg. iOS/macOS) the native Wireguard app. This might be caused by some additional features in our data path, including magicsock and packet filtering/ACLs. On Linux, we probably need to use recvmmsg() and may need to get fancier by eg. using multiple file descriptors to inject into the tun device, or revive old patchsets like the IFF_MULTI_READ feature in the Linux kernel. <img src="https://frontapp.com/assets/img/favicons/favicon-32x32.png" height="16" width="16" alt="Front logo" /> [Front conversations](https://app.frontapp.com/open/top_2jf2p)

Topic		Replies	Views
Expected speeds? SUPPORT QUESTIONS	0	1175	November 2, 2022
Slow speed between two nodes in same network SUPPORT QUESTIONS	2	1339	March 17, 2022
Any stance on netmaker claiming to be 5x faster than tailscale?	6	5140	May 20, 2022
Dramatic decline in performance in direct connect	23	7234	April 27, 2021
Tailscale is a bit slow SUPPORT QUESTIONS	1	2921	March 14, 2021

Tailscale vs Wireguard performance

Related topics