owenscott

If gaming/LAN devices need low RTT while Unraid containers stay on the VPN tunnel, keep the game PC off wg0 and only route the dockers that need it (extra wg interface or split allowIPs). Hairpin from LAN→VPN→LAN usually adds latency; A/B with the game host on clearnet first.

When Gluetun alone (no dependents) can kneecap the whole UniFi LAN, that usually means the container is doing something on br0/L2 that UniFi hates—not “VPN is slow.” Things I’d isolate before another full outage cycle: 1. Confirm Gluetun’s network mode: if it’s on br0/macvlan/ipvlan and pushing WireGuard with AllowedIPs=0.0.0.0/0, some UniFi setups treat the flood of encrypted UDP as a storm/anomaly. Prefer plain bridge and only route the containers that need the tunnel—not the host/LAN. 2. Disable UniFi IDS/IPS / Smart Queues for a short controlled test while Gluetun is up. If the slowdown vanishes, you’ve found the interaction (fairly common with WG UDP). 3. Watch the UniFi switch-port counters for the Unraid NIC while Gluetun connects: errors, multicasts, or a jump in PPS without matching useful throughput. 4. Keep DNS bound to the VPN interface inside Gluetun; avoid host network_mode / extra privileged networking unless you truly need it. 5. Reproduce with a minimal stack: Gluetun WG only, no port-forward scripts, no other containers—then add one dependent back. If you can catch diagnostics *while* the LAN is sick (before stopping Gluetun), the routing table + br0 stats at that moment are worth more than a healthy post-reboot dump.

When WireGuard between two sites is “very slow”, it’s usually path/MTU/CPU rather than Unraid disk speed. Useful split: 1. iperf3 through the tunnel both ways — if that’s slow, stop tuning SMB/NFS and fix the tunnel first. 2. Drop WG MTU (try 1420 → 1400) to kill silent fragmentation; one direction often looks worse than the other when MTU is wrong. 3. Watch CPU on both ends during transfer — WG is cheap but a weak Celeron still caps before the NIC does. 4. Compare RTT to the peer’s public IP vs through WG. If the underlay path is already long, a closer relay/exit won’t fix distance, but a bad mid-path ASN sometimes will. If you can paste iperf3 numbers (bare internet vs WG) plus approximate distance between sites, it’s usually obvious which bucket you’re in.