[ANNOUNCE] OPNsense 19.7 supports WireGuard

[Muenz, Michael]

Am 28.08.2019 um 21:08 schrieb Alex Davies:
> This is great news. We have been using wireguard on OPNSense (mostly 
> as servers, but also as a client in a few places) in production for 
> some time now, without drama (we found one bug with a trivial 
> workaround, see email chain "Table=off behavior (not adding any route 
> *at all*)" to this list). We can now upgrade to something formally 
> "supported" ;-)
>
> If anybody else tries to use the hardware appliances provided by the 
> founders of OPNSense (Deciso[1]) as a wireguard server or client, we 
> found the performance on the non-x86 CPUs (A10, etc.) was not great 
> (they have all sorts of ipsec type offloads, but not for WG). IIRC we 
> struggled to get more than a few gigabits per second in aggregate. The 
> Intel E3 models are able to run as close to line rate on 10G as makes 
> no odds for us.
>
> [1] 
> https://www.deciso.com/wp-content/uploads/2015/11/Brochure-OPNsense-appliances_ordered-rev201603.pdf
>
The gateway code in OPNsense 19.7 changed, so it was only possible to do 
PBR with 19.1.X.

With the last update of 19.7.3 I updated the plugin to add gateway 
support so it works with PostUp and PostDown. As usual in Open Source it 
lacks documentation yet. :)

https://github.com/opnsense/plugins/pull/1443


I did some quick iperf tests in a 10G lab last year (old Xeon E3):

https://www.routerperformance.net/comparing-opnsense-vpn-performance/


Best,

Michael