Skip to content
The Gateway

Sizing & performance

This page answers two questions operators ask before committing hardware:

  1. Will my Pi 4 keep up? — and at what privacy levels.
  2. What VPS shape should I rent for a remote node or bridge.

Numbers below are rough envelopes from typical hardware; treat them as ceilings, not guarantees.

Throughput envelopes

Section titled “Throughput envelopes”

A single WireGuard tunnel, single client, line-rate iperf3:

Hardware Direct routing WG + level 0 WG + level 2 WG + level 4 WG + level 5
Raspberry Pi 4 (4 GB, 1 core) ~940 Mb/s ~300 Mb/s ~280 Mb/s ~20 Mb/s ~5 Mb/s
Raspberry Pi 5 (8 GB) ~940 Mb/s ~700 Mb/s ~650 Mb/s ~50 Mb/s ~5 Mb/s
Mini-PC, N100, 2 cores ~940 Mb/s ~900 Mb/s ~850 Mb/s ~150 Mb/s ~5 Mb/s
VPS, 1 vCPU, 2 GB ~1 Gb/s ~600 Mb/s ~550 Mb/s ~30 Mb/s ~5 Mb/s
VPS, 4 vCPU, 4 GB ~1 Gb/s ~900 Mb/s ~850 Mb/s ~200 Mb/s ~5 Mb/s

The numbers cap at the HTB shape rate at levels 3+:

Level HTB ceiling per tunnel
3 20 Mbit
4 10 Mbit
5 5 Mbit

Three pooled tunnels at level 4 give you 3 × 10 Mbit = 30 Mbit/s aggregate.

Memory & storage

Section titled “Memory & storage”
Component Memory footprint Notes
gatewayd baseline ~80 MB resident No matter how many policies
Per active tunnel ~5 MB WireGuard kernel module is shared
Per bridge ~10 MB (redsocks) Plus the bridge-node on the remote VPS
DNS cache (10k entries) ~20 MB Hard cap; LRU evicts past 10 000 entries
SQLite WAL under 100 MB typical Grows with audit retention
Cover-traffic generator (level 3+) ~50 MB per policy Allocates packet buffers up front

For a typical Pi 4 home gateway with 2 tunnels + 1 bridge + ~50 devices, expect 250–400 MB resident.

CPU budget

Section titled “CPU budget”

Per second, per 100 Mbit of egress, roughly:

  • Direct routing: ~0.05 cores
  • WireGuard encrypt + decrypt: ~0.30 cores
  • Splitting engine, level 2: +0.02 cores (kernel numgen)
  • Splitting engine, level 4: +0.40 cores (HTB + cover + 1400-byte padding)
  • Splitting engine, level 5: +0.80 cores

The Pi 4 has 4 cores. The reconciler, web UI, and DNS plane share the same cores as the dataplane.

When to scale up

Section titled “When to scale up”

You’re outgrowing the Pi 4 if any of these hold:

  • Throughput consistently below the HTB ceiling at your chosen level (CPU-bound, not shape-bound).
  • gatewayd resident memory above ~700 MB.
  • Reconciler tick exceeds its interval (visible as a drift-event spike in Reconciliation).
  • More than ~50 devices with per-device policies.

Options, in order of price:

  1. Raspberry Pi 5 — drop-in for Pi 4, roughly 2.5× WireGuard throughput.
  2. Used mini-PC (Intel N100 or similar) — 5–10× WireGuard throughput, x86 ecosystem, ~$150.
  3. Federate two gateways — split the device population across both. The federation keeps policy in sync; mesh handles routing between them. See the hybrid lab use case.
  4. Linux VPS — dedicated remote node. Pick a provider with a sane network policy; bandwidth caps matter.

Bridge-node sizing

Section titled “Bridge-node sizing”

A bridge-node on a VPS is mostly idle TLS + HTTP CONNECT. Per concurrent client:

  • ~50 KB resident
  • ~0.01 cores at 10 Mbit/s
  • One persistent QUIC / TLS connection

A $5/month VPS comfortably serves 100+ concurrent bridge clients. The bottleneck is the VPS provider’s monthly bandwidth allowance, not CPU.

Disk I/O

Section titled “Disk I/O”

gatewayd writes:

  • Audit log entries — a few KB per config change.
  • DNS query log — optional, ~1 MB per 10k queries.
  • Drift event log — only on drift, typically near-zero.
  • SQLite WAL checkpoints — periodic.

On an SD card on a Pi 4, mount /var/log/ as tmpfs (the rpi install profile does this for you) to avoid wearing out the card.

Section titled “Related”