wg-easy 15.5.0: what a WireGuard tunnel costs in throughput

# wg-easy 15.5.0 with unattended setup (INIT_*). INIT_HOST is the container name, so the peer reaches it over the Docker network.
services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15.5.0
    container_name: wg-easy
    restart: unless-stopped
    environment:
      INSECURE: "true"
      INIT_ENABLED: "true"
      INIT_USERNAME: lab
      INIT_PASSWORD: lab-only-not-a-secret
      INIT_HOST: wg-easy
      INIT_PORT: "51820"
    ports:
      - "127.0.0.1:8080:51821/tcp"
    volumes:
      - etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    cap_add: [NET_ADMIN, SYS_MODULE]
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
volumes:
  etc_wireguard:

#!/usr/bin/env bash
# Runs inside the VM from ~/wg. Raw outputs go to ~/wg/raw.
set -u
cd "$HOME/wg"; mkdir -p raw
export COMPOSE_PROJECT_NAME=wg
log() { echo "== $* $(date -u +%T)"; }

log build tools image
docker build -q -t tools -f Dockerfile.tools . > raw/build.txt 2>&1
docker run --rm tools sh -c 'wg --version; iperf3 --version | head -1; cat /etc/alpine-release' > raw/tools-versions.txt 2>&1
docker pull -q ghcr.io/wg-easy/wg-easy:15.5.0 > /dev/null 2>&1

log throwaway start so the measured start does not pay for first-read page cache
docker compose up -d > /dev/null 2>&1; sleep 25; docker compose down -v > /dev/null 2>&1
log start wg-easy
T0=$(date +%s.%N)
docker compose up -d > raw/compose-up.txt 2>&1
for _ in $(seq 1 90); do
  code=$(curl -s -o /dev/null -w '%{http_code}' -m3 -u lab:lab-only-not-a-secret http://127.0.0.1:8080/api/client)
  [ "$code" = 200 ] && break; sleep 1
done
T1=$(date +%s.%N)
echo "ready_seconds $(python3 -c "print(round($T1 - $T0, 1))")  http=$code" > raw/wg-easy-ready.txt
sleep 30
for _ in $(seq 1 12); do docker stats --no-stream --format '{{.MemUsage}} {{.CPUPerc}}' wg-easy; done > raw/wg-easy-idle.txt
sleep 90
for _ in $(seq 1 12); do docker stats --no-stream --format '{{.MemUsage}} {{.CPUPerc}}' wg-easy; done > raw/wg-easy-idle-2min.txt
docker image inspect ghcr.io/wg-easy/wg-easy:15.5.0 --format '{{.Size}}' > raw/wg-easy-image-size.txt
docker compose logs --no-color --tail=30 wg-easy > raw/wg-easy-logs.txt 2>&1

log create client through the API
API="curl -s -m20 -u lab:lab-only-not-a-secret"
$API -XPOST http://127.0.0.1:8080/api/client -H 'content-type: application/json' -d '{"name":"peer1","expiresAt":null}' > raw/api-create-client.json
$API http://127.0.0.1:8080/api/client > raw/api-list-clients.json
CID=$(jq -r '.[0].id' raw/api-list-clients.json)
$API "http://127.0.0.1:8080/api/client/$CID/configuration" > raw/peer1.conf
sed -E 's/(PrivateKey|PresharedKey) = .*/\1 = <redacted>/' raw/peer1.conf > raw/peer1.conf.redacted
cp raw/peer1.conf peer1.conf
# alpine has no resolvconf, and a /24 route is enough for the test
sed -i -e '/^DNS/d' -e 's|^AllowedIPs.*|AllowedIPs = 10.8.0.0/24|' peer1.conf

log iperf server + baseline
docker run -d --name srv --network container:wg-easy tools iperf3 -s > /dev/null
docker run -d --name peer --network wg_default --cap-add NET_ADMIN --sysctl net.ipv4.conf.all.src_valid_mark=1 tools sleep infinity > /dev/null
SRVIP=$(docker inspect wg-easy --format '{{(index .NetworkSettings.Networks "wg_default").IPAddress}}')
echo "$SRVIP" > raw/server-docker-ip.txt
sleep 2
docker exec peer ping -c 20 -i 0.2 "$SRVIP" > raw/ping.direct.txt 2>&1

cpu_during() { # cpu_during <outfile> <command...>: run command while mpstat samples whole-VM CPU
  local f="$1"; shift
  mpstat 1 1000 > "$f" 2>&1 &
  local mp=$!
  "$@"; local rc=$?
  kill "$mp" 2>/dev/null; wait "$mp" 2>/dev/null
  return $rc
}
for i in 1 2 3; do
  cpu_during raw/direct.run$i.mpstat.txt sh -c "docker exec peer iperf3 -c $SRVIP -t 15 -J > raw/direct.run$i.json 2> raw/direct.run$i.err"
done

log bring the tunnel up
docker cp peer1.conf peer:/etc/wireguard/wg0.conf
docker exec peer wg-quick up wg0 > raw/wg-quick-up.txt 2>&1
sleep 3
docker exec peer wg show wg0 > raw/wg-show.peer.before.txt 2>&1
docker exec wg-easy wg show wg0 > raw/wg-show.server.before.txt 2>&1
docker exec peer ip link show wg0 > raw/wg0-link.txt 2>&1
docker exec peer ping -c 20 -i 0.2 10.8.0.1 > raw/ping.tunnel.txt 2>&1
for i in 1 2 3; do
  cpu_during raw/tunnel.run$i.mpstat.txt sh -c "docker exec peer iperf3 -c 10.8.0.1 -t 15 -J > raw/tunnel.run$i.json 2> raw/tunnel.run$i.err"
done
docker exec peer wg show wg0 > raw/wg-show.peer.after.txt 2>&1
docker exec wg-easy wg show wg0 > raw/wg-show.server.after.txt 2>&1
docker exec peer wg show wg0 latest-handshakes > raw/handshakes.txt 2>&1

log wg-easy RAM with the tunnel up and idle
sleep 10
for _ in $(seq 1 12); do docker stats --no-stream --format '{{.MemUsage}} {{.CPUPerc}}' wg-easy; done > raw/wg-easy-idle-with-peer.txt
docker compose down -v > /dev/null 2>&1; docker rm -f srv peer > /dev/null 2>&1
echo done > raw/DONE