Skip to content
Register

I replaced my entire network with a single WireGuard mesh

Networking by SingaporeRep 6 replies 507 views
SingaporeRep

Member OP

Benchmark Addict

3 #1

Was running OSPF + GRE + IPsec across 6 sites. Pain. Replaced with WireGuard (https://www.wireguard.com) point-to-point on every node talking to every other node. 47 tunnels. One config repo. No dynamic routing protocol.

$ wg show | grep peer | wc -l
47

Decent disk IO, meh network

Results:
- Convergence: instant (no protocol to converge)
- Failover: manual (update endpoint IP, push config)
- CPU: 15% lower than IPsec on same Celeron J4125
- Memory: 180MB for all tunnels vs 340MB for FRR + strongSwan

Caveat: this is not a real mesh protocol. I write every tunnel by hand. If a node dies, I edit text files. If my repo host dies, I cry.

Would not recommend for production. For my 6 hobby sites, it is peace.

— yabs

fio, iperf, geekbench. results or gtfo.
blogfranck

Member

#2

The "mesh" is 47 point-to-point tunnels? This is not mesh, this is full mesh topology made by hand. Like painting ceiling of Sistine Chapel with brush of one hair. Beautiful maybe but hosting provider would laugh at you. I use RackNerd for my edge and they have real mesh, dynamic.

WH

Member

#3

SingaporeRep I love this (the honesty) (the part where you admit it's not a real mesh )

MA

Member

4 #4

Right then, 47 tunnels by hand? You're proper mad, yabs. I'm on Hostinger and even their "simple" setup makes me want to automate everything. Cheers for the honesty about the crying though.

jane_ffm

Member

#5

Thanks for sharing this experience report, @SingaporeRep. A few notes for others considering similar:

• WireGuard CPU overhead: typically 10-20% lower than IPsec on AES-NI capable hardware
• Manual failover means ~5-15 minute MTTR vs. Sub-30s with dynamic protocols
• Full mesh scales poorly: n(n-1)/2 tunnels, so your 47 becomes 112 at 8 sites

We generally recommend against this for production workloads. Happy to check specific requirements via DM if helpful.

— Jane @ Contabo

Single mode till I die 💀
cpanelliw780

Member

shared hosting survivor

#6

Yabs you basically built a spreadsheet that routes packets 47 tunnels is just vpn cosplay with extra steps I did this once with 12 docker containers and openvpn it was hell never again just use a real protocol and let the computers do the computer thing

minh1987

Member

#7

What's the throughput on that j4125

phở at 3AM, deploy at 4

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft