☰

使用 RPi 4 和 Wireguard 时连接速度太慢

tag-icon • tag-icon linux networking vpn raspberry-pi wireguard
使用 RPi 4 和 Wireguard 时连接速度太慢

我在Raspberry Pi 4 Model B 2019 四核（4GB RAM）跑步Ubuntu 20.04使用连接到我的家庭路由器以太网。 我用了PiVPN使用 Pihole 进行设置。我在 iPhone 和 Mac 上设置了客户端，可以连接，但与我家的速度相比，连接速度非常慢。我的 ISP 计划是千兆速度的 AT&T 光纤，所以我的 RPi4 的上传/下载速度与此非常接近：speedtest cli

        ISP: AT&T U-verse
    Latency:     3.32 ms   (0.83 ms jitter)
   Download:   913.95 Mbps (data used: 887.2 MB )                               
     Upload:   921.47 Mbps (data used: 1.1 GB )                               
Packet Loss:     0.0%

对于我的客户（iPhone 和 Mac，均通过 Wifi 连接），我使用 speedtest.net 来收集他们的速度，无需 VPN（直接连接到家庭网络）

Mac: 397mbps/486mbps (download/upload)
iPhone: 377mbps (download)

一旦连接到 VPN，连接速度就会低得多（使用相同的测试）：

Mac: 15.65mbps/15.11mbps (download/upload)
iPhone: 8.45mbps (download)

我开始查看遇到同样问题的其他用户的帖子，并尝试了以下操作：

  1. 将默认监听端口 (51820) 更改为其他不同端口 (尝试过 51821、81、443)，以防我的 ISP (AT&T) 限制任何这些端口。但没成功。
  2. 重新安装了没有 PiHole 集成的 PiVPN（以防万一出现问题）。没运气。
  3. 将服务器和客户端 MTU 更改为不同的值（最初为 1420）：1400、1300、1200。没有运气。（我执行了 ifconfig，似乎我的网络 mtu 是 1500，因此默认值应该没问题）
  4. 使用我的 Mac 执行了 iperf3 测试，看看是否可以通过该测试找到一些东西：

无需 VPN 即可进行 iperf 测试

iperf3 -c 192.168.1.93
 Connecting to host 192.168.1.93, port 5201
[ 5] local 192.168.1.64 port 57206 connected to 192.168.1.93 port 5201
[ ID] Interval  Transfer  Bitrate
[ 5]  0.00-1.00  sec 76.2 MBytes  639 Mbits/sec  
[ 5]  1.00-2.01  sec 72.2 MBytes  598 Mbits/sec  
[ 5]  2.01-3.00  sec 62.8 MBytes  533 Mbits/sec  
[ 5]  3.00-4.00  sec 55.2 MBytes  465 Mbits/sec  
[ 5]  4.00-5.00  sec 72.9 MBytes  612 Mbits/sec  
[ 5]  5.00-6.00  sec 72.4 MBytes  608 Mbits/sec  
[ 5]  6.00-7.00  sec 68.0 MBytes  569 Mbits/sec  
[ 5]  7.00-8.00  sec 61.4 MBytes  516 Mbits/sec  
[ 5]  8.00-9.00  sec 70.4 MBytes  591 Mbits/sec  
[ 5]  9.00-10.00 sec 70.6 MBytes  592 Mbits/sec  
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval  Transfer  Bitrate
[ 5]  0.00-10.00 sec  682 MBytes  572 Mbits/sec sender
[ 5]  0.00-10.01 sec  681 MBytes  571 Mbits/sec receiver

使用 vpn 进行 iperf 测试

iperf3 -c 10.6.0.1
Connecting to host 10.6.0.1, port 5201
[ 5] local 10.6.0.2 port 59800 connected to 10.6.0.1 port 5201
[ ID] Interval  Transfer  Bitrate
[ 5]  0.00-1.00  sec 3.16 MBytes 26.3 Mbits/sec  
[ 5]  1.00-2.00  sec 0.00 Bytes 0.00 bits/sec  
[ 5]  2.00-3.00  sec 0.00 Bytes 0.00 bits/sec  
[ 5]  3.00-4.00  sec 1.21 MBytes 10.2 Mbits/sec  
[ 5]  4.00-5.00  sec 1.72 MBytes 14.4 Mbits/sec  
[ 5]  5.00-6.00  sec 1.58 MBytes 13.2 Mbits/sec  
[ 5]  6.00-7.00  sec 1.91 MBytes 16.1 Mbits/sec  
[ 5]  7.00-8.00  sec 1.72 MBytes 14.4 Mbits/sec  
[ 5]  8.00-9.00  sec 0.00 Bytes 0.00 bits/sec  
[ 5]  9.00-10.00 sec 0.00 Bytes 0.00 bits/sec  
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval  Transfer  Bitrate
[ 5]  0.00-10.00 sec 11.3 MBytes 9.48 Mbits/sec sender
[ 5]  0.00-15.52 sec 11.3 MBytes 6.11 Mbits/sec receiver

这次测试只是证实了我在 speedtest.net 测试中看到的结果。我没有其他东西可以尝试，所以如果你们能帮我的话我有几个问题：

  1. AT&T 会限制 Wireguard 数据包吗？这可能是我卡在 10mbps 的原因吗？
  2. 使用 Wireguard 后速度从 400mbps 降至 10mbps 正常吗？
  3. 我该如何解决这个问题？你有什么建议来加快我的连接速度？ 还有几点需要注意：
  • 我正在使用 AT&T 网关路由器佩斯 5268AC（端口转发似乎工作正常）
  • 这是我当前的 pivpn -d 调试日志：
=============================================
::::  Latest commit   ::::
Branch: master
Commit: f80b0a7962d91862132c0a4abd65c1e67bd37bd7
Author: 4s3ti
Date: Fri Dec 3 21:41:13 2021 +0100
Summary: Update Changelog
=============================================
::::  Installation settings    ::::
PLAT=Ubuntu
OSCN=focal
USING_UFW=1
IPv4dev=eth0
install_user=ubuntu
install_home=/home/ubuntu
VPN=wireguard
pivpnPORT=443
pivpnDNS1=1.1.1.1
pivpnDNS2=1.0.0.1
pivpnHOST=REDACTED
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.6.0.0
subnetClass=24
ALLOWED_IPS="0.0.0.0/0, ::0/0"
UNATTUPG=0
INSTALLED_PACKAGES=()
=============================================
:::: Server configuration shown below  ::::
[Interface]
PrivateKey = server_priv
Address = 10.6.0.1/24
MTU = 1420
ListenPort = 443
### begin user ###
[Peer]
PublicKey = user_pub
PresharedKey = user_psk
AllowedIPs = 10.6.0.2/32
### end user ###
### begin Phone ###
[Peer]
PublicKey = Phone_pub
PresharedKey = Phone_psk
AllowedIPs = 10.6.0.3/32
### end Phone ###
=============================================
:::: Client configuration shown below  ::::
[Interface]
PrivateKey = user_priv
Address = 10.6.0.2/24
DNS = 1.1.1.1, 1.0.0.1
[Peer]
PublicKey = server_pub
PresharedKey = user_psk
Endpoint = REDACTED:443
AllowedIPs = 0.0.0.0/0, ::0/0
=============================================
::::  Recursive list of files in  ::::
:::: [4m/etc/wireguard shown below  ::::
/etc/wireguard:
configs
keys
wg0.conf
/etc/wireguard/configs:
Phone.conf
clients.txt
user.conf
/etc/wireguard/keys:
Phone_priv
Phone_psk
Phone_pub
user_priv
user_psk
user_pub
server_priv
server_pub
=============================================
::::  Self check   ::::
:: [OK] IP forwarding is enabled
:: [OK] Ufw is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] Ufw input rule set
:: [OK] Ufw forwarding rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled (it will automatically start on reboot)
:: [OK] WireGuard is listening on port 443/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
:::: WARNING: This script should have automatically masked sensitive  ::::
:::: information, however, still make sure that PrivateKey, PublicKey ::::
:::: and PresharedKey are masked before reporting an issue. An example key ::::
:::: that you should NOT see in this log looks like this: ::::
:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe ::::
=============================================
::::  Debug complete   ::::
::: 
::: Debug output completed above.
::: Copy saved to /tmp/debug.log

编辑 这是 htop 在运行 speedtest 时的样子 在此处输入图片描述

答案1

我可以通过将 MTU 降低到 1432（MTU = 1432在您的 wireguard 配置中）来改善这种情况。以下是 MBP 和 Raspi 4 之间在我的 LAN（wifi）上的前后对比：

默认 MTU：

$ iperf3 -c 172.16.42.1 -p 5201
Connecting to host 172.16.42.1, port 5201
[  5] local 172.16.42.2 port 60457 connected to 172.16.42.1 port 5201
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec   148 KBytes  1.21 Mbits/sec
[  5]   1.00-2.00   sec  30.7 KBytes   251 Kbits/sec
[  5]   2.00-3.00   sec  54.5 KBytes   448 Kbits/sec
[  5]   3.00-4.00   sec  5.34 KBytes  43.8 Kbits/sec
[  5]   4.00-5.00   sec  33.4 KBytes   273 Kbits/sec
[  5]   5.00-6.00   sec  86.9 KBytes   712 Kbits/sec
[  5]   6.00-7.01   sec  28.1 KBytes   229 Kbits/sec
[  5]   7.01-8.00   sec  45.4 KBytes   374 Kbits/sec
[  5]   8.00-9.00   sec  33.4 KBytes   273 Kbits/sec
[  5]   9.00-10.00  sec  45.4 KBytes   372 Kbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-10.00  sec   511 KBytes   419 Kbits/sec                  sender
[  5]   0.00-10.69  sec   411 KBytes   315 Kbits/sec                  receiver

iperf Done.

较低的 MTU：

$ iperf3 -c 172.16.42.1 -p 5201
Connecting to host 172.16.42.1, port 5201
[  5] local 172.16.42.2 port 60683 connected to 172.16.42.1 port 5201
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec  12.9 MBytes   108 Mbits/sec
[  5]   1.00-2.00   sec  14.0 MBytes   117 Mbits/sec
[  5]   2.00-3.00   sec  13.7 MBytes   115 Mbits/sec
[  5]   3.00-4.00   sec  14.4 MBytes   121 Mbits/sec
[  5]   4.00-5.00   sec  15.2 MBytes   127 Mbits/sec
[  5]   5.00-6.00   sec  15.4 MBytes   129 Mbits/sec
[  5]   6.00-7.00   sec  15.4 MBytes   129 Mbits/sec
[  5]   7.00-8.00   sec  17.1 MBytes   143 Mbits/sec
[  5]   8.00-9.00   sec  16.0 MBytes   134 Mbits/sec
[  5]   9.00-10.00  sec  16.0 MBytes   134 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-10.00  sec   150 MBytes   126 Mbits/sec                  sender
[  5]   0.00-10.03  sec   149 MBytes   125 Mbits/sec                  receiver

iperf Done.

这个要点包含有关为您的网络找到最佳服务器/客户端 MTU 组合的更多信息：https://gist.github.com/nitred/f16850ca48c48c79bf422e90ee5b9d95

相关内容