I’ve set up a WireGuard site-to-site connection between my house and my relatives. The connection has been established successfully; however, the bandwidth performance is quite poor. When I run an iperf test over the WireGuard connection, I’m getting the following results:
This performance is surprisingly low when compared to the results I get when I run iperf tests over the WAN IPs, as shown here:
The WireGuard firewall rules on both of my pfSense routers are configured as follows:
I’m not sure if this is relevant to the issue, but I also have an existing Mullvad WireGuard setup, as visible in the screenshots above. (Just providing this information for your reference.)
On my side (Site A) my wireguard config looks like this:
I just adjusted the MSS and didn’t make any changes to the MTU. Once I set the MSS to 1380, I noticed that my iperf results improved to 5-10MB/s, which works well for what I need. I’m curious, though, about what the MSS does and whether a different value might be more suitable.
I’ve been delving into the MSS/MTU issue and made some headway. By utilizing the command ping -D -s <packet_size> <destination_ip> in the PFsense router shells on both ends, I successfully determined the correct MTU value for this WireGuard site-to-site connection, which turned out to be 1390. To fine-tune it, I subtracted 40 (IPv4 header size) from the MTU value.
After implementing these adjustments, I reran my iperf tests, yielding significantly improved results.
To better contextualize the WireGuard performance, here are the internet speed test results for each site:
Site A (based in the Netherlands)
Site B (based in the Caribbean)
However, there remains an unanswered question. Although the iperf speed test indicates some retries, a ping from site to site shows no timeouts. Noteworthy is that both locations are equipped with fiber internet. Any insights into this discrepancy would be greatly appreciated.
Found an answer to the retry count in the iperf3 results. TL:DR answer is if the resulting transfer/bitrate is good/consistent. ignore the retry count.
