I notice that my CPU utilization goes quite high when I run traffic through Wireguard (RoadWarrior) VPN connections. Is there any configuration I can apply that will offload the cryptographic work to the dedicated silicon on the CPU (Intel J3060)?
I presume that you are referring to the AES-NI acceleration available on the J3060 and many other chips.
WireGuard will never use that as it uses the ChaCha20-Poly1305 encryption cipher and not any of the AES ciphers that can use the AES-NI acceleration.
Ah, thanks. That is what I was wondering. It looks like to get hardware acceleration of ChaCha20-Poly1305, I’d have to get something with Intel QAT, which appears to only be Xeon CPUs.
Hello Ted,
you should not hit any ceilings with WireGuard’s crypto unless you are transferring multiple Gigabit per second.
The question is, which is being used: Wireguard or OpenVPN (Roadwarior)?
Wireguard is the least CPU-intensive of the available solutions.
What comes to mind is whether there are interfaces with different speeds between the tunnel ends. If so, if data is sent over, for example, a 10G interface and received over a 1G interface, there might be a CPU problem on the 1G gateway.
I have been using it to watch my home jellyfin server on my lunch break at work via my Wireguard VPN connection. I am not seeing any problems per se, but Zabbix is reporting up to 70% CPU utilization during this time which seemed kind of high.
It is unlikely that this would be WireGuard alone then. Can you check what is happening with htop? It could be the IPS working very hard on that stream or something…
I’ll have to do that on Monday. I do not have the IPS enabled, so it isn’t that.