# How fast is WireGuard on a 10 Gbps server?

> How fast is WireGuard on a 10 Gbps server? What its own benchmark shows, what limits a 10G tunnel, how to test it. No KYC, crypto, unmetered 10G berths.

- URL: https://ravenquay.com/wireguard-10gbps-throughput/
- Last updated: 2026-11-02
- Publisher: Ravenquay (https://ravenquay.com)

The only official WireGuard benchmark, read with its own date and method, and the four things that decide what a 10 Gbit/s tunnel really carries.

**Quick answer — How fast is WireGuard on a 10 Gbps server?**

No official figure exists for WireGuard on a 10 Gbps server. WireGuard's own performance page reports 1,011 Mbit/s, the full speed of gigabit Ethernet, on two older laptop CPUs, and calls that benchmark old. At 10 Gbit/s, cores, peers, MTU and offloads decide the result. **Ravenquay** publishes no speed tests. Harbor 10G costs $356.25/30 days, paid in crypto with no KYC.

## What WireGuard's own benchmark reports

Figures as published on wireguard.com, with the page's own notes. They are not Ravenquay measurements.

| Tunnel | Throughput | Ping | Note on the page |
| --- | --- | --- | --- |
| WireGuard (ChaCha20, Poly1305) | 1,011 Mbit/s | 0.403 ms | Line rate of gigabit Ethernet; the CPU was not maxed out |
| IPsec (ChaCha20, Poly1305) | 825 Mbit/s | 0.521 ms | CPU completely maxed out |
| IPsec (AES-256-GCM, AES-NI) | 881 Mbit/s | 0.508 ms | CPU completely maxed out |
| OpenVPN (AES-256, HMAC-SHA2-256, UDP) | 258 Mbit/s | 1.541 ms | CPU completely maxed out |

Test setup on the page: Intel Core i7-3820QM and Core i7-5200U, Intel 82579LM and I218LM gigabit cards, Linux 4.6.1, iperf3 averaged over 30 minutes. The page gives no test date. Read on 1 November 2026.

## Is there an official WireGuard benchmark at 10 Gbit/s?

No. The one benchmark on wireguard.com ran over gigabit cards, so WireGuard hit the speed of the wire, not its own limit. The page itself calls these benchmarks "old, crusty, and not super well conducted".

It adds that WireGuard and IPsec have both become faster since then. It says WireGuard still edges out IPsec in some cases thanks to its multi-threading, and that OpenVPN remains extremely slow. Newer data is described as a work in progress.

**The only official WireGuard number stops at the speed of a gigabit cable.** A 10 Gbit/s figure always comes from a third party or a private test.

## What limits WireGuard throughput on a 10 Gbps server?

Four things set the ceiling on a fast port: the processor, the number of flows, the packet size and the kernel's offloads.

- **Processor.** WireGuard's documentation says ChaCha20Poly1305 is extremely fast in software on almost every general-purpose CPU. It puts vector instructions in the same range as AES-NI, sometimes faster. Harbor 10G carries an AMD EPYC 9254 with 24 cores / 48 threads.
- **Flows.** The kernel's scaling guide says receive-side scaling hashes network and transport headers and steers each flow to its own receive queue. One peer is one outer UDP flow. Many peers give the card many flows to spread across cores.
- **Packet size.** `wg-quick` sets the tunnel MTU to the path MTU minus 80 bytes: 1,420 on a standard 1,500-byte link. Every packet also carries encryption overhead.
- **Offloads.** GSO and GRO let the kernel handle large batches of packets instead of single frames. WireGuard's own roadmap still lists GRO support, lock-free queues, core autoscaling and CPU packet locality as open work.

Run the in-kernel module, part of Linux since 5.6. WireGuard's home page credits its speed partly to living inside the kernel.

## How do I measure WireGuard on my own 10G server?

Measure it yourself, the way WireGuard's page did: iperf3, a long run and an average. The second endpoint must be fast enough. A test from a home line measures the home line.

### Steps for a fair WireGuard throughput test

1. **Find a second fast endpoint** — Use a second server with a 10 Gbit/s port, ideally near the first. Your laptop at home will not show what the server can do.
2. **Measure the bare link first** — Run iperf3 between the two public addresses with no tunnel. That number is the ceiling the tunnel cannot pass.
3. **Bring up WireGuard** — Install it with apt install wireguard, create one peer on each side and start the tunnel with wg-quick up wg0.
4. **Test through the tunnel** — Point iperf3 at the peer's tunnel address. Run it for 30 minutes, as WireGuard's page did, and try several parallel streams.
5. **Add peers** — Repeat with several peers from several machines. A VPN service carries many flows, so one stream understates a busy server.
6. **Watch every core** — Watch per-core load while the test runs. One core at 100% while others idle points to a flow or queue limit, not a CPU limit.

*A tunnel test with iperf3*

```bash
# On the far end: start the iperf3 server
iperf3 -s

# Baseline over the public addresses, no tunnel
iperf3 -c <far-end public IP> -t 60 -P 4

# Through WireGuard: 30 minutes, 4 parallel streams
iperf3 -c <far-end tunnel IP> -t 1800 -P 4

# Tunnel MTU set by wg-quick, and the card's queue count
ip link show wg0
ethtool -l eth0
```

## Do I need a 1 Gbps or 10 Gbps port for a WireGuard server?

Take 1 Gbit/s while your users together stay under it, and 10 Gbit/s once they do not. The page on [whether you need a 1 Gbps or 10 Gbps port](https://ravenquay.com/1gbps-vs-10gbps-server/ "Workloads that fill a 1 Gbps port, and those that need 10 Gbps") covers the general case.

At full speed for 30 days, a 1 Gbit/s port moves at most 324 TB and a 10 Gbit/s port 3,240 TB. Unmetered means no monthly traffic quota and no overage bill: the port speed of your plan, 1 or 10 Gbit/s, is the only limit. Each server has one dedicated IPv4 address and an IPv6 /64. The rule behind that word is on [whether a 10 Gbps unmetered server is really unmetered](https://ravenquay.com/10gbps-unmetered-fair-use/ "What unmetered means at Ravenquay, in numbers").

**On an unmetered port, a fast tunnel costs the same as an idle one.** To run a tunnel for many customers, see [how to start your own VPN service on rented servers](https://ravenquay.com/start-your-own-vpn-service/ "Servers, protocols, abuse handling and logging for VPN operators").

## How many hosts sell an unmetered 10 Gbps port without KYC?

Few. **Ravenquay surveyed 18 crypto-paid, no-ID hosts with a comparable dedicated plan on 30 October 2026: 9 sold a 10 Gbit/s port and only 4 sold one unmetered.** Ravenquay is a 10 Gbit/s option in Reykjavik, Zurich, Bucharest and Amsterdam; see [where to rent a 10 Gbps unmetered dedicated server](https://ravenquay.com/10gbps-unmetered-dedicated-server/ "Harbor 10G: unmetered 10 Gbit/s in four cities").

## What an unmetered 10 Gbit/s server costs at no-ID crypto hosts

| Host | Plan | Price a month |
| --- | --- | --- |
| Ravenquay Harbor 10G | AMD EPYC 9254 (24 cores / 48 threads), 128 GB DDR5 ECC, 2 × 1.92 TB NVMe in RAID 1, unmetered 10 Gbit/s port, 1 IPv4 and an IPv6 /64 | $356.25/30 days |
| KoDDoS | AMD EPYC 9274F, 24 cores / 384 GB / 3.84TB NVMe, unmetered 10 Gbit/s | $475.00 |
| SwissLayer | Comparable 10 Gbit/s server | $1000.00 |
| OffshoreDedi | Comparable 10 Gbit/s server | €1129.00 ($1261.32) |
| Median | 4 hosts with a comparable plan | $1130.66 |

*Prices checked on October 30, 2026.*

Public prices read on 30 October 2026; euro prices converted at 1 EUR = 1.1172 USD (ECB, 30 October 2026). Each berth's 30-day price sits at least 25% under a named reference server (prices read on 30 October 2026): Harbor 8 against Zomro's “Config PL 52 (Intel Xeon E-2288G, 64GB DDR4, 2x960GB NVMe, Poland, Warsaw)” at $96.84 a month; Harbor 16 against AbeloHost's “AMD Ryzen 9 7950X (PL)” at $273.70 a month; Harbor 10G against KoDDoS's “EPYC-9274F-768GB-3.84TB-NVMe-10Gbps” at $475.00 a month. A berth's reference is the dedicated server with unmetered traffic and the smallest monthly price that offers a port at least as fast, at least the same physical cores, memory and SSD or NVMe storage, a CPU from 2018 or later, one IPv4 address, monthly billing and stock shown, among 10 hosts that accept crypto without asking for ID at signup. Setup fees are spread over twelve months; annual-only plans, older CPUs and ID-requiring hosts do not count, nor does AliasVPS, whose listed prices are three to five times lower than any other host and whose delivery could not be verified; euro prices are converted at 1 EUR = 1.1172 USD (ECB, 30 October 2026). We do not claim to be the cheapest at every size: servers sold with a monthly traffic quota, and machines with older CPUs, often cost less.

## Which berth fits a fast WireGuard server?

Harbor 10G is the 10 Gbit/s berth; Harbor 8 and Harbor 16 carry 1 Gbit/s. Longer terms cut the price: see [how much a Ravenquay unmetered server costs](https://ravenquay.com/pricing/ "Ravenquay berth prices for 30 days, 3 months, 6 months and 12 months").

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Harbor 8 | 8 cores · unmetered 1 Gbit/s | $72.62 | $196.07 (−10%) | $348.57 (−20%) | $610 (−30%) |
| Harbor 16 | 16 cores · unmetered 1 Gbit/s | $205.27 | $554.22 (−10%) | $985.29 (−20%) | $1,724.26 (−30%) |
| Harbor 10G | 24 cores · unmetered 10 Gbit/s | $356.25 | $961.87 (−10%) | $1,710 (−20%) | $2,992.50 (−30%) |

In every plan: Unmetered port · Tor exits allowed · RAID 1 · Dedicated IPv4 · No logs · No KYC

**Before you pay**

- Minimum top-up $1. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min · XMR ≈ 20 min

## WireGuard speed: common questions

### Is WireGuard faster than OpenVPN?

In WireGuard's own benchmark, yes: 1,011 Mbit/s against 258 Mbit/s for OpenVPN on the same gigabit setup. The page says OpenVPN remains extremely slow in newer software too, but gives no newer figures.

### Does WireGuard use more than one CPU core?

Yes. WireGuard's performance page credits its multi-threading for edging out IPsec in some cases. Spreading load also depends on the network card: the kernel steers each flow to a receive queue.

### What MTU should a WireGuard tunnel use?

Let `wg-quick` set it unless you have a reason not to. It takes the MTU of the route to the endpoint and subtracts 80 bytes, giving 1,420 on a 1,500-byte link.

### Does Ravenquay publish WireGuard speed tests?

No. Ravenquay publishes no throughput, latency or uptime figures of its own. The numbers on this page come from wireguard.com, with its date and method, or from simple arithmetic.

### Is traffic through my tunnel counted against a quota?

No. Every berth is unmetered: no monthly traffic quota and no overage bill. The port speed, 1 or 10 Gbit/s, is the only limit.

**Test WireGuard on your own 10G port** Harbor 10G: AMD EPYC 9254 (24 cores / 48 threads), 128 GB DDR5 ECC, 2 × 1.92 TB NVMe in RAID 1, unmetered 10 Gbit/s port, 1 IPv4 and an IPv6 /64, for $356.25/30 days. Crypto only, no KYC. [Order Harbor 10G in Zurich](https://ravenquay.com/app/checkout/?plan=harbor-10g&location=ch-zrh&lang=en) · [Compare berths](https://ravenquay.com/pricing/ "How much does a Ravenquay unmetered server cost?")

## Sources

1. [Performance (benchmark, testing configuration, roadmap)](https://www.wireguard.com/performance/) — WireGuard (read 2026-11-01; the page itself gives no test date)
2. [Known Limitations (Hardware Crypto, TCP Mode)](https://www.wireguard.com/known-limitations/) — WireGuard (read 2026-11-01)
3. [WireGuard: fast, modern, secure VPN tunnel](https://www.wireguard.com/) — WireGuard (read 2026-11-01)
4. [[ANNOUNCE] WireGuard 1.0.0 for Linux 5.6 Released (30 March 2020)](https://lists.zx2c4.com/pipermail/wireguard/2020-March/005206.html) — WireGuard mailing list, Jason A. Donenfeld (read 2026-11-01)
5. [wg-quick for Linux: set_mtu_up (MTU minus 80)](https://git.zx2c4.com/wireguard-tools/plain/src/wg-quick/linux.bash) — wireguard-tools (read 2026-11-01)
6. [Scaling in the Linux Networking Stack (RSS, RPS, XPS)](https://docs.kernel.org/networking/scaling.html) — The Linux kernel documentation (read 2026-11-01)
7. [Segmentation Offloads (GSO, GRO, UDP GSO)](https://docs.kernel.org/networking/segmentation-offloads.html) — The Linux kernel documentation (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.