One interesting observation, the all mighty RB5009 that ain’t that cheap or low end, by MikroTik published results here: https://mikrotik.com/product/rb5009ug_s_in#fndtn-testresults we can see single tunnel IPsec 1400byte test reaching 1354.1Mbps, yet in a test I’ve posted here http://forum.mikrotik.com/t/rb5009-wireguard-only-150-mbps/155060/11 you can see in the 3rd screenshot over 1600Mbps in total throughput over wireguard, so why would I bother with IPsec ?
WireGuard pushes impressive single-tunnel speeds on an RB5009UG, but it also comes with high CPU utilization. IPsec with hardware offload is built for a different use case, with hundreds of simultaneous tunnels and barely any load on the CPU.
Bottom line: pick the right tool for the job.
I’m curious, would WireGuard performance change in any meaningful way if many tunnels were used? The test published by @Znevna shows ~150,000 pps. Official test results for IPSec show ~120,000 pps. Also, I’m pretty sure the 256 IPSec result is combined for all tunnels.
Why would multiple WG tunnels give worse performance vs single if the total pps is split evenly across (as I assume it does for IPSec)? I just want to understand.
I don’t know, seems to have some fixation on hardware acceleration.
As previously stated, hardware IPsec DOES have a CPU hit, obviously that usage isn’t reflected in the the CPU usage shown to the OS, so while you barely see any CPU load that doesn’t mean that it is actually true and that the CPU is sitting there whistling.
I remember observing on my RB750Gr3 that an active IPsec tunnel with only 4Mbps sent through it from an IP camera (yes with barely any CPU load visible in RouterOS) scalps off somewhere under 100Mbps in routing performance, I don’t remember the exact number since it was over 2 years ago but it was sure noticeable and for sure it proved that it is NOT without a performance hit, test repeatable.
Anyone is free to try this.
Are there any tests somewhere to support those hundreds of tunnels without any CPU load posted somewhere and to see that indeed the CPU can do something else just as it did without any tunnels active, and that any other load put on the CPU doesn’t affect the tunnels performance? Just curious to see some actual proof of those claims.
How did you achieve this? I made 2 sperate WG interfaces between 2 routers, each individually works and pulls about 300mbit, and i have set same distance route to different WG IPS and it says ECMP on route, but no matter what test i run it always uses only one interface .
I’m pretty sure you’re fully capable of making informed decisions yourself about what to use and when.
WireGuard is just a tunnel protocol where encryption is handled entirely in software. It’s like using a switch as a router and if the CPU is strong enough, it works up to a point, but once you hit that ceiling, throughput caps out. Any additional load on the router will obviously suffer when this happens.
IPsec, on the other hand, is a complete ecosystem that supports capabilities like various authentication and encryption methods. It can leverage AES-NI for hardware encryption, which significantly reduces the load on the main CPU. IPsec’s modular design and widespread support for hardware acceleration are the key reasons why it continues to be the de facto-standard for enterprise-grade scenarios with high tunnel density and tight performance constraints.
You do the math.
So no proof. Ok!
This isn’t proof. This is a statement - and without facts behind it.
I’m with Zvena on this one: hardware acceleration is great to have - but it’s in no way miraculous, neither it works without CPU load.
This is particularly true when the CPUs speeds are wildly different one from another.
No one has “proof” of anything. Just arguing about nothing.
MikroTik hopeful will expand there “Test Results” to include VPNs. Lot of conjecture everywhere, and no controlled apples-to-apples tests anywhere.
ECMP balances traffic based on some kind of hash policy. You set the ipv4 or ipv6 hash policy in the /ip/settings path. For right now L3-inner and L4 don’t seem to work properly, if you set it to L3 then it will balance connections between the two. The more connections you have the closer to 50/50 balance you’ll see.
It was already set to l3, did not work.
Now i switched to l4 now i see its balancing 2 connections, but speed difference is from 300mbit to around 380mbit in total.
MikroTik have never changed anything in their tests or test results, not even when the entire environment changed. So I would not hope for that.
(“routing performance” does not specify what is being routed, presumably it is IPv4. there are no results for IPv6. also, there is no specification of RouterOS version, and that can result in wrong results when comparing older devices that were tested with RouterOS v6 with newer devises that presumably are being tested with RouterOS v7. but we do not know, it is not specified)
While it is a good thing that tests are a constant (they apparently are what their test equipment does), I think it is not good that the information of test environment is absent.
What matters is the WORK LOAD and WireGuard does an excellent job of balancing the LOAD when concurrency hits hard …
I do have many clients using IPsec and that works extremely well for them … I also have many clients using WireGuard and for those Clients THEY ALL are extremely pleased with WireGuard.
Znevna/Paternot: Alright, so we’re at the “pics or it didn’t happen” stage now. 
No one is claiming that hardware acceleration breaks the laws of thermodynamics. Of course it uses CPU resources, just not the main cores in the same way software-based encryption does. That is actually the whole point. It is not magic, it is just architecture.
WireGuard is great for what it is, within its limited scope. But comparing it directly to hardware accelerated IPsec on routing platforms built for scale is like comparing a scalpel to a multitool. Different jobs, different tools.
And just like @Ammo pointed out, there is not much to compare right now anyway. So unless you are planning to publish your own peer-reviewed paper, a little logic should do just fine. Since I am not your babysitter, and there is nothing meaningful to compare, you do the math yourself. 
Can you elaborate on details pls ?
- what device is used as client, what as central hub ?
- how many concurrent connections in parallel ?
- how much is single and accumulated bandwidth ?
@Larsa, we are still talking about MikroTik devices and not Fortigate or others that have custom ASICs just for that, yes?
LE: And you don’t need to write a paper to submit some numbers and tests into a forum post (or several) but we can all say what we want and claim miraculous results without doing/posting any tests because why not.
We are comparing between Mikrotik devices (ok, ok, CHR and x86 too), are we not?
I can provide one example that I did for a Law Firm of 20 lawyers, 20 girl fridays, and partners :
The Router is CCR1009-7G-1C-1S+ ; Cisco Small Business 300 Series Managed Switches; 8 vlans; Microsoft Windows Server 2022 hosting Exchange and NAS
Symmetrical bandwidth of 1GB for office; Bandwidth for outside the office varies based on venue [work at home; Coffee shop; Courthouse; Airport; various boardrooms in and out of the country etc]
WireGuard at the busiest times had 15 concurrent connections where bulk of the traffic was collaboration between Document server and Teams from all over the continent.
Key point is at no time has anyone complained that they could not get what they needed without delay of any kind. Most docs where either Powerpoint Presentations excel Spreadsheets, Word documents - upload/download file sized varies between 50 - 300 MB … very typical office stuff …
For Clients – majority is Windows 10/11 and some Macs, iPads, and a lot of iPhones …
@mozerd, sorry for the off-topic, but I’m curious how WireGuard is used in a business setting like that. Did you just distribute (securely) static WG configuration to all laptops and other devices to use with the official WG client? So, there is no password prompt to connect to VPN (let alone MFA)?
That’s what I use in a personal setting and was just wondering how people use it on a larger scale in a professional environment.
This particular Law Firm has its own IT department … I was just the contractor that was hired to design the system and oversee its implementation and deal with any issues that developed [no issues have developed over the past 2 yrs] … They have security protocols in place that controls each and every device that has network access … Once a resource gets access to their device via login the security protocols take over … WireGuard is only used to remotely access the document server where all the action is — they used to be a IPsec shope but found access/retrieval/updates to their briefs etc very slow … with WireGuard access/retrieval/updates pleased them enormously … sorry but I cannot talk about the security protocols …