Skip to content
Register

Mini-guide: running WireGuard on OpenVZ 6

VPS Hosting by kate3 7 replies 417 views
kate3

Member OP

5 #1

Running WireGuard on OpenVZ 6

You will need the userspace implementation. The kernel module is not available on most OpenVZ 6 nodes because the host kernel is typically 2.6.32 with a custom patchset that never merged WireGuard. Install wireguard-go and use it as a fallback. Expect higher virtualization tax—userspace forwarding burns CPU cycles that a paravirt KVM guest would not pay.

I am documenting this because a legacy client has 200+ OpenVZ 6 containers that cannot be migrated before Q3 2026. This is not an endorsement. If you have cgroup limits on net_cls you may hit throughput ceilings around 150 Mbps. Test your specific host kernel revision.

virsh list --all | wc -l: 47
Carl

Member

Rack & Stack

4 #2
kate3 said:
Legacy client has 200+ OpenVZ 6 containers

Just dont use OpenVZ 6. Those nodes are running on Ivy Bridge or Sandy Bridge hardware at this point. 95W TDP chips, DDR3, probably pulling 1.2A per U. The power cost alone to keep that generation online is eating whatever margin the provider had. I have shipped two pallets of R320s to scrap this year. Legacy is one thing but you are burning electricity on 14 year old silicon.

visit twice: install and decom
admin

Administrator

Administrator

#3

We have noted this guide for our knowledge base. For what it is worth, Contabo and OVHcloud both ended OpenVZ 6 lifecycle support in 2024. Vultr still maintains a handful of legacy nodes but does not provision new ones.

If you are evaluating providers, check whether the host kernel has been updated to the OpenVZ 6 rhel6-branch latest. Some kernels there do include the wireguard backport, though it is undocumented. Your mileage will vary. :)

— Admin

sudo make me a sandwich
center807

Member

7 #4

Our enterprise-grade infrastructure utilizes redundant feeds with N+1 power delivery and enterprise-grade networking throughout. We do not comment on specific kernel versions as these are subject to enterprise-grade change management. For enterprise-grade WireGuard deployment on legacy platforms please contact our sales team who can architect an enterprise-grade solution with enterprise-grade SLA. Enterprise-grade peering is available in all enterprise-grade locations.

GroupStockholm

Member

4 #5
kate3 said:
Userspace forwarding burns CPU cycles

The real issue is that wireguard-go is written in Go, which lacks zero-cost abstractions and has a non-trivial garbage collection pause. This causes latency spikes under load. A memory-safe userspace implementation would not have this problem. I maintain a partial Rust rewrite that eliminates the GC overhead entirely. Rewrite it in Rust and the virtualization tax drops measurably. C++ kernel modules are inherently unsafe. Go is a regression.

lucgone

Member

Le Baguette

10 #6

I try with wireguard-go and it is ok for my small vpn. But my cpu is very high. Since 2 days I search why. Your guide help me franchement. I think I will migrate soon but not now. My provider is Hostinger and they say me "no problem" when I ask for OpenVZ 6 lol. Thank you for this.

Vive la résistance... électrique
minh1987

Member

#7

I doubt Hostinger is actually running rhel6-branch latest

phở at 3AM, deploy at 4
quinnbizz

Member

#8

Which Vultr location still has legacy nodes?

...

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft