Nostr VPN
Nostr VPN · WireGuard · Tailscale
VPN performance.
Three VPNs measured on the same Linux setup, with the same CPU allocation and direct network path.
The comparison
| Measurement | Nostr VPN | WireGuard | Tailscale |
|---|---|---|---|
| TCP throughput (Gbit/s) | 6.36 / 6.42 | 2.27 / 2.22 | 10.11 / 9.60 |
| Idle ping (ms) | 0.53 | 0.21 | 0.30 |
| Ping under TCP load, p95 (ms) | 6.55 / 6.54 | 1.81 / 1.75 | 3.38 / 3.10 |
| UDP received at 1 Gbit/s (Mbit/s) | 1000 / 1000 | 998 / 996 | 809 / 834 |
| UDP packet loss (%) | <0.01 / 0.02 | 0.20 / 0.37 | 18.98 / 16.45 |
| Tunnel MTU (bytes) | 1150 | 1420 | 1280 |
Tests ran between containers within one Linux VM. Internet connections, other hardware, and other operating systems can produce different results. UDP loss is measured end to end, including the operating system and test application.
How we tested
AMD Ryzen 7 7700 8-Core Processor, eight virtual CPUs, Ubuntu 24.04 containers. Each endpoint had four assigned virtual CPUs. All products used the same 1,500-byte Docker bridge network, with their usual tunnel MTUs shown above.
Products ran separately. We rotated their order across three rounds. Each transfer had a two-second TCP warmup. TCP used one stream for 30 seconds in each direction. UDP used a 1 Gbit/s target for 10 seconds with 1,000-byte payloads, small enough for every tunnel.
Ping ran every 50 milliseconds. Idle latency is the median round-trip time; loaded latency is the median of each run’s 95th percentile during TCP transfer. Throughput comes from the receiver’s measurements. All runs, including packet loss, are included in the download.
Software and reproducibility
Nostr VPN 4.1.17 and Tailscale 1.102.4 used their official Linux release binaries. WireGuard used the Linux 7.0.0-34-generic kernel implementation, with wireguard-tools 1.0.20210914. The traffic generator was iperf3 3.16.
Nostr VPN used configured direct peers with discovery disabled. Tailscale used Headscale 0.29.4 for test-only coordination; its direct connection was verified before measurement. No relay or Internet exit was involved. Other VPN endpoints were paused while each product was measured.
The scripts require an x86_64 Linux machine with at least eight logical CPUs, Docker, Python 3, and access to /dev/net/tun. Extract the scripts into a new directory, then run:
bash prepare.sh
python3 benchmark.pyResults go into results/. Binary checksums, exact versions, receiver throughput, ping samples, CPU time, and VM steal time are included in the measurements. The test creates its own containers and removes them when it finishes.