WireGuard generally offers better VPN throughput than OpenVPN on UniFi Dream Machines, but there is no published universal speed ratio. Ubiquiti says OpenVPN provides lower throughput and recommends Teleport or WireGuard over OpenVPN for desktop and laptop clients. One user-reported UDM-Pro test found WireGuard in the 1 Gbps class and OpenVPN around 220–300 Mbps; those figures describe that setup, not a guaranteed result for every gateway.
What the performance evidence actually shows
Ubiquiti’s UniFi Gateway OpenVPN Server documentation states: “OpenVPN provides lower throughput than Wireguard.” The statement establishes the direction of the comparison, not a fixed multiplier, model-by-model rating, or expected speed.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Ubiquiti Networks Dream Router Wi-Fi 7 (UDR7) | $298.99 | Buy on Amazon |
| 2 |
|
Dream Router 7 UDR7 | $325.95 | Buy on Amazon |
| 3 |
|
Ubiquiti UniFi Dream Machine dual_band | $345.00 | Buy on Amazon |
| 4 |
|
Ubiquiti UDR7 Dual-Band 10Gbps Ethernet Wi-Fi 7 Router | $303.00 | Buy on Amazon |
| 5 |
|
Ubiquiti Dream Wi-Fi 6 IEEE 802.11ax Ethernet Wireless Router | $349.99 | Buy on Amazon |
A community iPerf3 report for a UDM-Pro provides a numerical example. Its author tested a Mullvad endpoint in Seattle from a location approximately 1,300 km away. Results below are reported as download/upload Mbps; they are not Ubiquiti product ratings.
| Test mode | WireGuard (Mbps, download/upload) | OpenVPN (Mbps, download/upload) |
|---|---|---|
| Single stream | 1024 / 1250 | 222 / 297 |
| Four parallel streams | 913 / 1054 | 221 / 290 |
| Bidirectional | 800 / 746 | 204 / 3 |
These are the report author’s results from the described UDM-Pro setup, not a controlled manufacturer benchmark. The report’s original publication date is not stated in the page extract. Different gateway models, firmware, Network application versions, VPN endpoints, client hardware, routes, WAN capacity, and enabled features can produce different results. The unusually low OpenVPN bidirectional upload figure is specific to that test and should not be treated as a typical outcome.
#1 Best Overall
- Desktop 10G Cloud Gateway with integrated WiFi 7, PoE switch, microSD storage, and full UniFi application support.
- Processor: Quad-core ARM Cortex-A53 at 1.5 GHz
- UniFi Application Suite: Network, Protect, Access, Talk, Connect
- Default WAN Ports: (1) 10G SFP+, (1) 2.5 GbE RJ45
- LAN Ports: (3) 2.5 GbE RJ45 including (1) PoE
Ubiquiti lists UDM-Pro and UDM-SE routing performance at 3.5 Gbps in its Control Plane Overview. That is general gateway routing performance, not a VPN throughput figure, and it cannot be used to predict a WireGuard or OpenVPN speed.
First identify which VPN job you mean
UniFi supports VPN server, VPN client, and site-to-site roles. Their throughput figures describe different traffic paths, so comparisons are useful only when the role is clear. Ubiquiti documents WireGuard and OpenVPN as gateway VPN client types, and its overview also lists them as VPN server options. It says up to eight VPN clients are supported.
Rank #2
- Management Capabilities - Utilizing the Network app for iOS and Android devices, you can manage and analyze your network through the Machine. As a network controller, you can use it to view network topology, manage system traffic, engage a Deep Packet Inspection (DPI) to see what's using the most bandwidth, and much more.
- Network Overview - View network topology and configuration, real-time statistics, and debugging metrics. Monitor the network's vitals and make on-the-fly adjustments.
- Deep Packet Inspection - The proprietary Deep packet Inspection (DPI) engine includes the latest application identification signatures to track which applications (and IP addresses) are using the most bandwidth.
- Guest Portal/Hotspot - Configure custom settings, including authentication, Hotspot setup, and the option to use your own external portal server.
- Wireless Uplink - This functionality enables wireless connectivity between access points for extended range, wireless adoption of access points in their default state, and real-time changes to network topology.
- VPN server: A remote user connects to the gateway to reach a local network. For remote downloads from that network, the gateway’s WAN upload capacity can be the limiting link.
- VPN client: The gateway sends selected local-device traffic through an externally hosted VPN provider. Establishing the tunnel does not automatically route every device; a Traffic Route is needed.
- Site-to-site VPN: Separate networks are joined. Results depend on the links and configuration at both ends.
The UDM-Pro numbers above concern traffic routed through a VPN endpoint, so they should not be read as a server-speed guarantee for remote users connecting into a home or office network.
What can limit speed on your Dream Machine
Protocol is only one part of the path. Physical link speeds, gateway resources, congestion, the remote client’s bandwidth, route distance, and configuration all affect measured throughput. Ubiquiti warns that resource-intensive features such as Threat Management and Smart Queues may reduce throughput by up to 30%; this is general guidance, not a VPN-specific benchmark.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- High-Performance Connectivity: Enjoy seamless, high-speed Wi-Fi with the Ubiquiti UniFi Dream Machine's dual-band, 4x4 Wave 2 AP, delivering up to 850 Mbps data transfer rate
- Versatile Networking Hub: This device serves as a router, switch, and security gateway, offering a 4-port Gigabit switch and advanced security features like IDS/IPS and DPI
- User-Friendly Management: The UniFi Network Controller provides an intuitive interface for easy setup and management of your network, scalable with additional UniFi devices
- Powerful Processing: Equipped with a fast 1.7 GHz Quad-Core processor, the Ubiquiti UniFi Dream Machine ensures smooth operation and efficient performance
- Sleek, Compact Design: With dimensions of 4.33 x 4.33 x 7.24 inches and a weight of 2 kg, this device offers a compact footprint, perfect for both home and small office use
- WAN capacity: A VPN server cannot send remote clients more data than the available upstream connection allows. On a VPN client setup, the provider endpoint and destination route also matter.
- Gateway workload and enabled features: Inspection, traffic management, and other active functions may consume resources or shape traffic.
- Endpoint and client: The VPN server’s location, congestion, client hardware, and the remote network can affect both directions differently.
- Protocol and configuration: OpenVPN can use UDP or TCP, and provider configuration and credentials differ. Keep those factors consistent when comparing results.
How to make a fair WireGuard-versus-OpenVPN test
Ubiquiti’s documentation does not prescribe a universal VPN benchmark. For a useful comparison, keep the traffic path and conditions as similar as possible, and record what changed.
- Confirm the role. Decide whether you are measuring a remote-access server, provider VPN client, or site-to-site link. Do not compare measurements from different roles as if they were equivalent.
- Hold the setup constant. Use the same gateway, firmware and Network application version, client device, destination VPN server, WAN connection, traffic route, and enabled security or queueing features.
- Measure both directions. Record download and upload separately. If possible, repeat each run and note whether traffic is single-stream, parallel-stream, or bidirectional.
- Record the route and method. Note the endpoint location, approximate distance, test tool, and any relevant network conditions. This makes a result interpretable rather than a bare Mbps figure.
- Compare against the bottleneck. Check the WAN upload for a VPN server, and the available bandwidth at the client and provider endpoint for a VPN client. A protocol cannot exceed a slower link in the path.
Configuration and remote-access requirements
Using WireGuard as a VPN client
Ubiquiti’s WireGuard VPN Client guide says you can upload a provider configuration or enter settings manually. Add a Traffic Route to send selected device traffic through the established tunnel; creating the tunnel alone does not direct all devices through it.
Rank #4
- Immediate replacement shipment; no need to wait for inspection results
- Priority processing applied throughout the entire RMA application process
- Prepaid return shipping fees are included
Using OpenVPN as a VPN client
The OpenVPN Client guide describes uploading a provider-supplied configuration and credentials, then adding a Traffic Route for the devices to be sent through the tunnel. The configuration can specify UDP or TCP, and credential requirements may depend on the provider.
Hosting an OpenVPN server
Ubiquiti’s OpenVPN server instructions require a Next-Gen UniFi gateway or Cloud Gateway and Network application version 7.4 or newer. The documented default port is 1194. If the gateway sits behind an upstream NAT router, forward the port on that router to the gateway.
Recommended Free Tools
Best Value
- Experience high-performance and reliable wireless connectivity to the Internet and other offices
- Gigabit Ethernet port for ultra-fast wired network speeds
- Electrical power and data are transmitted using a single cable to devices such as Access Points, IP cameras or IP phones
- Uses ISM Band to connect your computers, wireless printers, game consoles, and other Wi-Fi devices for a smooth network experience
Ubiquiti says most VPN setups other than Teleport require a public IP for connectivity. Public-IP availability, upstream NAT and router settings, ISP restrictions, and WAN capacity can therefore determine whether remote access works and how quickly it performs. See Ubiquiti’s OpenVPN Server guidance and VPN overview.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which should you choose?
For a desktop or laptop client, Ubiquiti recommends Teleport or WireGuard over OpenVPN; it recommends Teleport for mobile clients. If you need a provider client, check which protocols that provider supports and whether its configuration and authentication requirements suit your setup. For a remote-access server, compare client compatibility and your actual WAN upload as well as protocol throughput. WireGuard is the evidence-backed choice when throughput is the priority, but the available documentation does not establish exact speeds for every Dream Machine model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
