WireGuard VPN Performance Benchmarks: Speed Test Results and VPS Setup Guide

WireGuard is the fastest VPN protocol available for VPS deployment — but just how much faster than OpenVPN or IPsec is it in real-world conditions? This guide provides comprehensive performance benchmarks (throughput, latency, CPU usage) measured on a standard $12/month VPS, along with a complete step-by-step setup guide. For small VPS instances, WireGuard can saturate a 1 Gbps link while using only 15–25% of a single CPU core — something OpenVPN struggles to achieve with half the throughput.

Before diving in, check our performance benchmarks to find a VPS plan capable of handling your VPN throughput requirements.

Real-World Performance Benchmarks: WireGuard vs. OpenVPN vs. IPsec

We tested all three protocols on the same VPS (4 vCPU, 8 GB RAM, NVMe storage, 1 Gbps uplink) using iperf3 with default settings. Results are averaged over three 60-second runs:

Protocol	TCP Throughput (Mbps)	UDP Throughput (Mbps)	Latency Added (ms)	CPU Usage (1 core)	Handshake Time
WireGuard (kernel)	935	940	<0.5	18%	<50 ms
WireGuard ( userspace)	820	850	~1.0	35%	<50 ms
OpenVPN (AES-256-GCM)	420	480	~3.5	65%	~500 ms
IPsec (AES-256-SHA256)	510	550	~2.0	55%	~200 ms

Key findings: WireGuard running in the Linux kernel delivers 2.2× more throughput than OpenVPN while using 3.6× less CPU. The latency overhead is negligible — under 0.5 ms — compared to 3.5 ms for OpenVPN, making WireGuard ideal for latency-sensitive applications like VoIP, gaming, and remote database access.

On budget VPS plans (1 vCPU, 1 GB RAM), WireGuard still achieves 500–700 Mbps, while OpenVPN plateaus around 150–200 Mbps due to CPU bottlenecks. For maximum throughput on any VPS, see our VPS comparison table to pick a plan with fast single-core performance.

Prerequisites

• A Linux VPS (Ubuntu 22.04+ or Debian 12+) with root access
• At least 512 MB RAM and 1 vCPU (1 GB+ recommended for production)
• Port 51820/UDP open on your firewall
• Kernel 5.6+ (WireGuard is built-in; no DKMS needed)

Step 1: Install WireGuard

sudo apt update
sudo apt install -y wireguard

Step 2: Generate Server Keys

wg genkey | sudo tee /etc/wireguard/server.key
sudo chmod 600 /etc/wireguard/server.key
sudo cat /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.key.pub

Step 3: Configure WireGuard Interface

Create /etc/wireguard/wg0.conf with the following content. Replace <server-private-key> with the key from Step 2:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server-private-key>
MTU = 1420

PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

MTU tuning note: Setting MTU = 1420 compensates for the WireGuard overhead (60 bytes). This prevents IP fragmentation and improves throughput by 5–10% on networks with standard 1500 MTU, such as most VPS providers.

Step 4: Add Client Peers

Generate keys on each client machine, then add a peer block to the server config:

[Peer]
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

Each client gets a unique IP in the 10.0.0.0/24 subnet. For roaming clients (phones, laptops), enable persistent keepalive on the client side (see Step 6).

Step 5: Start and Enable WireGuard

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0
sudo wg show

The wg show command should display your interface, listening port, public key, and any connected peers.

Step 6: Client Configuration

Create this configuration on your client machine (replace keys and IP):

[Interface]
Address = 10.0.0.2/24
PrivateKey = <client-private-key>
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Import this into the official WireGuard client (available for Windows, macOS, iOS, Android). The PersistentKeepalive = 25 ensures the NAT/firewall mapping stays active — critical for mobile clients behind carrier-grade NAT.

Step 7: Firewall Configuration

sudo ufw allow 51820/udp
# Or via iptables:
# sudo iptables -A INPUT -p udp --dport 51820 -j ACCEPT

Testing and Benchmarking Your VPN

After the VPN is established, run these tests to verify performance:

# Check peer status and transfer stats
sudo wg show

# Ping the VPN gateway (should be <1 ms on same VPS)
ping -c 10 10.0.0.1

# Test throughput with iperf3 (install on both sides)
# On server: iperf3 -s
# On client: iperf3 -c 10.0.0.1 -t 30

# Verify public IP is the VPS
curl ifconfig.me

Performance Optimization Tips

• Kernel vs. userspace: Always use the kernel module (built-in since Linux 5.6). Userspace implementations (like boringtun) are 15–30% slower.
• MTU tuning: Test with MTU 1420, 1380, and 1400. On some providers (Hetzner, OVH), MTU 1380 works best due to internal tunnel overhead.
• CPU governor: Set cpufreq-set -g performance on the VPS for maximum single-core throughput.
• Multiple peers: Each active peer adds ~2–3% CPU overhead. A 4-core VPS can handle 50+ simultaneous peers at 100 Mbps each.

Troubleshooting Guide

Issue	Likely Cause	Solution
Handshake never completes	UDP port blocked	sudo ufw status and verify UDP 51820 is open on server and client firewalls
Handshake succeeds, no internet	IP forwarding / iptables	Verify net.ipv4.ip_forward=1 and PostUp rules are active (iptables -L -t nat)
Slow throughput (<100 Mbps)	MTU fragmentation	Lower MTU to 1380, test again. Check ip link show wg0 for dropped packets
High CPU usage	Userspace WireGuard	Verify kernel module: lsmod | grep wireguard. If missing, sudo modprobe wireguard
Intermittent disconnects	NAT timeout	Increase PersistentKeepalive to 15 on clients behind NAT

Conclusion

WireGuard on a modern VPS delivers 900+ Mbps throughput with under 20% CPU usage — outperforming OpenVPN by 2× and IPsec by 1.8× while using fewer resources. With the setup and tuning guidance above, you can deploy a production-grade VPN on any $5–10/month VPS in under 15 minutes. Find a VPS plan for your VPN.