Unlock 10GbE WireGuard VPN Performance with FPGA Hardware Acceleration

Secure networking has become a fundamental requirement for modern enterprise networks, industrial systems, cloud infrastructure, and remote-access applications. Among today’s VPN technologies, WireGuard has gained widespread adoption due to its simplicity, modern cryptography, and excellent performance.

However, as network bandwidth increases to 10 Gigabit Ethernet and beyond, software-based WireGuard implementations are often limited by CPU processing power. Encryption and decryption consume significant CPU resources, making it difficult to fully utilize the available network bandwidth while maintaining low latency.

To overcome this limitation, Design Gateway developed the WireGuard10G-IP Core, a complete FPGA-based implementation of the WireGuard protocol. By offloading the entire VPN processing workload—including handshakes, keepalive messages, packet encryption, and packet decryption—to dedicated hardware, the IP core enables secure WireGuard tunnels to operate at near-10GbE line-rate performance while significantly reducing CPU utilization.

This article introduces the WireGuard10G-IP architecture, explains how hardware offloading improves VPN performance, and demonstrates its real-world throughput through live file-transfer tests and iperf3 benchmark results.

🎥 Watch the Full Demonstration

See the full WireGuard10G-IP

▶ WireGuard10G-IP: Secure 10GbE Networking with FPGA Acceleration

🔍 What is WireGuard?

WireGuard is a modern, open-source VPN protocol designed around three key principles:

Unlike traditional VPN protocols that support numerous configurable cryptographic options, WireGuard uses a fixed set of modern cryptographic algorithms. This helps reduce the risk of misconfiguration and prevents downgrade attacks involving the negotiation of weaker algorithms.

Because of its lightweight design and efficient packet processing, WireGuard is widely recognized as a practical solution for secure VPN communications. However, when implemented entirely in software, high-speed encrypted networking can still consume significant CPU resources, especially in 10GbE environments.

🔧 Design Gateway WireGuard10G-IP

Design Gateway’s WireGuard10G-IP implements the WireGuard protocol entirely in FPGA hardware. The IP core handles all WireGuard operation, including:

WireGuard handshake processing
Keepalive packet handling
Transport packet encryption
Transport packet decryption
High-speed packet forwarding over 10 Gigabit Ethernet

By moving these functions from software to FPGA logic, the host CPU no longer needs to handle the intensive cryptographic workload. This enables secure VPN communication with high throughput and significantly lower CPU utilization.

⚙️ Demo Network Architecture

In the demonstration setup, the User PC connects directly to the FPGA board through a 10 Gigabit Ethernet link. The User PC uses a single network interface configured with two IP addresses:

First, IP address for normal network communication

Second, IP address for the WireGuard tunnel

The FPGA uses the same IP and MAC addresses as the User PC, allowing it to transparently intercept and process network traffic. On the other side, encrypted WireGuard packets are routed through the gateway and delivered to the Endpoint PC.

The Endpoint is reachable through its WireGuard tunnel IP, just like a peer inside a private secure network.

🧩 Demo Hardware Setup

The demo uses a ZCU106 FPGA board with two network connections. One 10Gb SFP+ link connects the FPGA board to the User PC, while the other network connection links the FPGA board to the Gateway side.

UART is used for serial console access, and JTAG is used to program the FPGA. This setup allows the FPGA to operate as a hardware-accelerated WireGuard processing engine between the User PC and the external network.

🖥️ Easy Configuration with WireGuard Demo GUI

To simplify configuration and monitoring, Design Gateway provides the WireGuard Demo GUI. Users can import an existing .conf file and click Activate. The GUI automatically configures both the FPGA and the User PC.

1. Import tunDemo.Config file.

2. Click Activate.

Once the WireGuard handshake is completed, the GUI displays live connection status, including transfer speed, transferred bytes, and handshake status. This makes it easy to verify that the tunnel is active and operating correctly.

📁 Verifying the Tunnel with Samba File Transfer

After the tunnel is configured, real-world traffic is tested using a Samba file transfer. On the Endpoint PC, a Samba share is exposed over the WireGuard tunnel IP.

The User PC accesses this Samba share through the secure WireGuard tunnel, confirming that normal application traffic can pass through the encrypted FPGA-accelerated VPN connection.

🚀 Performance Result: Full-Duplex 10G Test

To evaluate throughput performance, iperf3 is executed in full-duplex mode with four parallel streams to fully stress the link.

The demo result shows:

Transmit Throughput	Receive throughput	Combined bidirectional throughput
9.2 Gbps	8.3 Gbps	approximately 17.5 Gbps

This result demonstrates that WireGuard10G-IP can deliver high-speed encrypted communication close to the practical performance range of a 10G Ethernet environment.

📊 Hardware Offload vs Software WireGuard

When compared with software WireGuard running on a modern Intel Ultra 5 CPU, software throughput reaches around 5 Gbps, while CPU usage rises to approximately 35%.

With WireGuard10G-IP, the FPGA offloads the cryptographic processing from the User PC. As a result, throughput increases to more than 9 Gbps, while CPU usage on the User PC is reduced to approximately 15%.

This comparison highlights the key advantage of FPGA-based WireGuard acceleration: higher encrypted throughput with lower CPU load.

Hardware	Throughput	CPU Usage
CPU (Intel Ultra 5 CPU)	5Gbps	35%
CPU (Intel Ultra 5 CPU) + FPGA (ZCU106 FPGA board)	9Gbps	15%

💡 Final Takeaway

WireGuard10G-IP demonstrates how FPGA hardware acceleration can unlock the true performance of 10G Ethernet without compromising network security.

By implementing WireGuard processing directly in FPGA hardware, the IP core enables secure VPN tunneling with high throughput, low CPU usage, and reliable real-time performance for high-speed networking applications.

For systems that require secure communication between sites, gateways, servers, or private networks, WireGuard10G-IP provides a practical FPGA-based solution for combining encryption and 10G-class performance.

📩 Contact Us

If you are developing an FPGA-based secure networking system and would like to discuss how WireGuard10G-IP can fit your application, please contact Design Gateway for more information.

Contact Design Gateway today