Wireguard Setup: Site to Site or behind Mikrotik?

RouterOS General
1

Hello everyone,
Im currently planning a new private cloud server backup. For this setup, we want to send our data over a wireguard tunnel to the backup location. Uplinks on both sites: 10gbit. One site with static ipv4, other site dynamic ipv4. Static ipv6 would also be an option. Routers on both sites: Mikrotik CRS317. My question for the wireguard tunnel is, which setup might have the better performance: A) Wireguard tunnel between the 2 Mikrotik CRS317 and the servers are standard LAN Clients and nothing else. B) Wireguard tunnel between the servers directly, the server with the static IPv4 on its WAN acting as the server, the other server acting as a wireguard client.

I want to reduce the overhead for encryption as much as possible to max out our 10Gbit link as much as possible, especially in case of a restore.

Any suggestions?

Thanks in advance

2

The fastest setup would be between servers. Wireguard isn’t hardware accelerated, and the CRS317 has a very weak CPU.

3

Even if MT adds hardware ChaCha20 acceleration, you’re not going to push 10G with a dual-core 800 MHz CPU. Being a switch in spirit, this class of device is only good for 10G when doing mostly switching. VPN is almost pure CPU, dispatching to the target thru the switch chip as the very last step in the packet-processing operation.

I suspect you’ll see significant CPU power given to Wireguard even with a grunty server processor at those speeds. Even then, I wouldn’t bet on you getting more than 5-6 Gbit/sec with artificial benchmarks.