Estimate WireGuard tunnel throughput from link rate, packet size and per-core crypto performance.
WireGuard adds a fixed 60 bytes over IPv4 (80 over IPv6), so goodput is the payload fraction of the frame. Because ChaCha20-Poly1305 runs per packet on a single core per peer flow, the CPU ceiling — cores multiplied by per-core rate — often binds before the link does. Knowing which ceiling binds tells you whether to buy more bandwidth or more cores; on a 10G link a 4-core box will usually cap around 6 Gbps regardless of circuit size.
WireGuard Throughput
throughput = min(link rate × payload ÷ (payload + 60), cores × per-core crypto rate).
throughput = min(link rate × payload ÷ (payload + 60), cores × per-core crypto rate). WireGuard adds a fixed 60 bytes over IPv4 (80 over IPv6), so goodput is the payload fraction of the frame. Because ChaCha20-Poly1305 runs per packet on a single core per peer flow, the CPU ceiling — cores multiplied by per-core rate — often binds before the link does.
Knowing which ceiling binds tells you whether to buy more bandwidth or more cores; on a 10G link a 4-core box will usually cap around 6 Gbps regardless of circuit size.
This calculator takes 5 inputs: Link rate, Inner packet size, CPU cores handling crypto, Crypto throughput per core, Outer IP version. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.