I am wondering about VPN performance on MikroTik routers (e.g. RB5009, but also CRS series). Is there any major difference between IPSec and Wireguard? Are both using hardware accelerated encryption?

You don’t need congestion algorithms like BBR applied to forwarded traffic. Only the source that is generating the traffic can apply congestion protocol algorithms which determine the rate at which it sends the traffic. So you want that on your servers and possibly clients depending on workload. Eve…

WireGuard at home works great and is honestly a lot easier to set up than IPsec if you're not a networking veteran. But HW acceleration is absolutely a show-stopper with simultaneous IPSec sessions at scale. It's not about single-tunnel throughput, it's the aggregate CPU load across 20, 50, or 100+…

You're doing the same thing. Real hardware offloading where the entire processing is offloaded is absolutely needed for massive scale. The technique used by Mikrotiks (and other networking-embedded platforms) only unloads the encryption/auth operation. Conflating the two absolutely is cheap market…

As for complete versus partial hardware offload: partial offload is what hardware acceleration means on virtually all SoCs used by vendors like MikroTik. Complete pipeline offload is used exclusively in dedicated VPN appliances (ie dedicated high scale VPN concentrators). Bringing that comparison in…

My point was mostly that people coming to the forum asking about hw offload expect the magic that these "dedicated VPN appliances (ie dedicated high scale VPN concentrators)" bring. (I happened to refer to them as "hardware data-plane firewalls and routers.") Well, this partial offloading doesn't ge…

Actually my point was not to mourn theoretical performance loss but to understand what is possible, what is expectable and what the influencing/limiting factors are. I build my test VPN between a CRS2216 and a bunch of RB5009 with Wireguard. That achieves about 800-900MBit throughput with the bandw…

[image] infabo: Wireguard uses ChaCha20. Don't know if any Mikrotik device has ChaCha20 hardware acceleration capable hardware. And if: has it ROS support? Yes, a few firmware updates ago, for example, for the IPQ-5010, IPsec was added with Chacha20 Poly1305, which works almost identically to…

It's still semantics. Whether you call it "hardware data-plane" or something else, the IPSec performance figures listed on product pages reflect what HW acceleration actually delivers. When enabled on a model with a SoC that supports HW acceleration, it can provide line-speed VPN that barely registe…

For recent version of Windows, to enable BBR2, run these with UAC elevation: netsh int tcp set supplemental Template=Internet CongestionProvider=bbr2 netsh int tcp set supplemental Template=InternetCustom CongestionProvider=bbr2 netsh int ipv4 set global LoopbackLargeMTU=disabled The 3rd command i…

VPN performance

RouterOS General

Larsa March 5, 2026, 4:14pm 22

Regarding possible WireGuard HW acceleration, newer ARMv8.6-A specs bring the "FEAT_CHACHA20" option for hardware acceleration of ChaCha20, but you need a Linux kernel v6.2 or newer and of course chip support.