Wireguard way slower than expected on AX1800 Flint

jdub · 2022-12-14T11:52:35.675Z

I’m still not clear exactly what you’re doing.

Are you saying that if you have an ethernet connection to the router, enable WG on router, do a speedtest from computer (to ookla or similar), you’re getting 100/30? Then disable WG on router, enable WG on computer (or phone), do a speedtest to the same server and you’re getting 275/60? What happens if you download/run speedtest-cli on the router itself while WG is connected?

(Speedtest CLI: Internet speed test for the command line) armhf is what you’ll need…

caesarsalad · 2022-12-14T11:57:25.581Z

router + ethernet to pc + wifi disabled + wireguard = 100/30 (bad)

router + 5Ghz wifi + wireguard = 100/30 (bad)

router + no wireguard = 275/60 (good)

router + wireguard installed on iPhone + 5Ghz WiFi = 250/50 (good)

router + wireguard installed on PC + ethernet = 250/50 (good)

That’s the simplest way I can explain it. Hopefully you see the problem, if I do a speedtest on CLI, similar results. Same thing with fast.com or any variants. It simply is just very slow on the router for seemingly no reason. I may attempt a downgrade in firmware if it’s worthwhile and safe.

jdub · 2022-12-14T12:04:37.837Z

I doubt that is your issue, but it might be worth a try. What does top show on the router while you’re doing a speed test?

Have you actually run speedtest-cli on the router itself (which would eliminate firewalling/NAT related slowdowns?)

I’m unfamiliar with pivpn, so can’t comment much there. What is the top output on the server as well when doing speedtests?

Even hardware from 2016 can get 100mpbs on WG pretty easily. There have been … let’s say peculiarities with the Flint’s software over it’s lifetime, and the qsdk kernel support is not inspiring. But again, running the same kernel and same processor I’ve never had problems clearing 500mbps, even across the internet.

caesarsalad · 2022-12-14T12:11:41.496Z

Well now it seems I’m having even more trouble with the VPN setup. It’s behaving extremely strange. I can’t load webpages, but I can still run an ookla speed test through the windows app. I tried the CLI speedtest and it won’t run with the router wireguard vpn, but it will without it.

Strangely enough, if I turn on wireguard on the router, plug it into my pc with ethernet, and then turn on another VPN on my computer, then I can access the internet and it gives me like 200/40. I’m just so confused.

jdub · 2022-12-14T12:19:11.780Z

I know this suggestion will be frustrating, but I might take a step back and start over with the router configuration. You’ll have to do that anyway if you downgrade, so I would try it on the latest firmware first. Do a full reset, readd the Wireguard profile and see what happens then.

I say that realizing that a full reset is never the solution, and that this is probably your main router, so there’s a lot of headache involved (whereas for me these are mostly travel routers and toys). But when I’ve been in cases where I can’t figure out what’s going wrong, sometimes it has been easier to start from scratch and break the problem down than to methodically try to fix the plane while it’s flying. I’m happy to try to think through the current install with you, but if it’s relatively easy for you to reset, that’s something I would consider if I were in your spot.

caesarsalad · 2022-12-14T12:21:20.331Z

Not a frustrating suggestion at all. This is currently a secondary router I want to be my main. But I should mention, I’ve already done this 3 or 4 times. I even completely deleted my cloud vps and reinstalled everything, got new configurations, uploaded that to the router multiple times. I just have no idea.

I suppose I’ll try to downgrade with Uboot, although not looking forward to it, I just bricked a TP-Link a week ago using TFTP.

jdub · 2022-12-14T12:24:15.651Z

Depending on your desire to use the actual GL.iNet firmware, you might also consider trying a more stock OpenWrt build, which can be made from the gl-infra-builder. I’ve found it to be considerably more stable on my AXT1800 than the stock firmware. Happy to help you through building or send you a build privately if you’re interested.

caesarsalad · 2022-12-14T12:27:35.147Z

This post would’ve been an essay if I included all the context. I’ve been through a nightmare in the past 2 weeks trying to get any Wireguard VPN working on any router. I’ve tried a Raspberry Pi 4b with OpenWRT and RaspAP. Didn’t work. I tried a TP-Link Aracher A7, didn’t work and I bricked the router. So now here I am with the flint.

I’ve honestly been through hell trying to fully figure out OpenWRT that I didn’t even want to spend the money on the flint, but for the simplicity, it was supposed to be worth it. Unless I have extermely straightforward directions, I’m not super confident about that. I’m just slightly irritated that it’s very, very close to working on stock, but just won’t.

jdub · 2022-12-14T12:50:26.830Z

Have you considered trying OpenVPN? With reasonable settings, it’s not too hard to get 160 plus megabits on that hardware.

If you already have the server set up, I don’t mind showing step by step directions for stock OpenWRT. Depending on your use case, the upcoming Tailscale update might also be worth looking into, though. I suspect you’ll only get about 100 megabits there based on my current testing.

caesarsalad · 2022-12-14T12:59:06.421Z

This would feel like a waste of money if it were just OpenVPN, could’ve just bought some cheap used tp-link and ran it like that. I don’t want to compromise a ton of my network.

I downgraded back to version 3. Same results, like 40/40. Again runs flawlessly on my phone, same config. Ugh.

I appreciate the suggestions but I’m feeling pretty defeated, 2 weeks straight of this is mind-numbing for me. All just to put a VPN on a router.

Edit: Speedtest CLI ran. Same results. Great.

Edit 2: I literally have the wireguard VPN installed on the router. If I run a speed test on my phone (connected on 5ghz) the speeds are terrible. But if I run Cloudflare Warp on my phone (so now a double-vpn) then the speeds are faster than if warp is off? What? I’m just mindblown at this point.

jdub · 2022-12-14T13:08:10.466Z

Again, are you running speedtest-cli on the router or are you running it on your computer?

People poopoo ovpn, but with the new routers that have cortex53’s, you can get performance that is on par with WG from older armv7 solutions. I doubt you’ll find a cheap TP-Link that will do 180mbps up/down on OpenVPN. But anyway.

Can you post your config file with keys redacted?

caesarsalad · 2022-12-14T13:20:44.539Z

You want me to SSH into the router and run it like that? Never done that, didn’t think that could be done.

Just redact the keys? Everything else is safe?

jdub · 2022-12-14T13:22:32.629Z

Yes, ssh into router, download / install speedtest (armhf) from link I sent way back, ungzip, run. The point is to answer whether the problem is the link itself or some sort of firewalling/NAT/something else.

I’d redact the endpoint IP too, but everything else is ok.

caesarsalad · 2022-12-14T13:23:33.063Z

Alright, I’ll try that. In the meantime…

[Interface]

PrivateKey = xxx

Address = 10.49.0.2

DNS = 172.21.63.94

[Peer]

PublicKey = xxx

PresharedKey = xxx

AllowedIPs = 0.0.0.0/0,::/0

Endpoint = xxx

jdub · 2022-12-14T13:27:19.515Z

Take out the DNS to see if that makes a difference, and add a /32 on the end of your address.

e.g. my current config:

[Interface]
Address = 10.75.50.50/32
ListenPort = 5320
PrivateKey = PK

[Peer]
AllowedIPs = 0.0.0.0/0
Endpoint = w.x.y.z:1234
PersistentKeepalive = 25
PublicKey = PK
PresharedKey = PK

caesarsalad · 2022-12-14T13:30:46.324Z

I actually sent the wrong config, but regardless I made those changes. Maybe a coincidence but it lowered ping by a little and now the download goes around 100 - 130. Still not great but better.

jdub · 2022-12-14T13:32:23.140Z

What is your output from

wg show

on the router? Basically, do we actually know that traffic is going through the tunnel?

(redact keys and endpoint)

caesarsalad · 2022-12-14T13:33:18.438Z

interface: wg0
public key: xxx
private key: xxx
listening port: 59585

peer: xxx
preshared key: xxx
endpoint: xxx
allowed ips: 0.0.0.0/0
latest handshake: 6 seconds ago
transfer: 789.91 MiB received, 85.33 MiB sent
persistent keepalive: every 25 seconds

jdub · 2022-12-14T13:35:34.242Z

Ok, that looks fine. If you run top on the router while a speedtest is running, what does the “idle” number at the top do?

alzhao · 2022-12-15T04:47:08.660Z

One parameter to manipulate is the mtu of wireguard interface.

You can find it in in UI. Try value between 1280 to 1380.