..::----::.. .:-++++++++++++++-:. :=+++-:.. ..:-+++=: :=++-. .-+-. .=++-. :::::: . .::. :++=. :+#@@@@@@@@#+: *@@@@= :++= -#@@%*+-::-+*%@@#- :@@@@@@ .++= .*@@#- -#@@*. .#@@@@* -++. .#@@= =@@#. -++: .++- *@@- :++: -@@* :++. .@@# -%@@@@%- #@@. .--: -++ .++: %@@@@@@% +@@: ++- -++ %@@@@@@% +@@: ++- :++. .=+-. -%@@@@%- #@@. .++: .++- :%@@@%: :++: -@@* -++. -++. =@@@@@= =@@#. .++- .++= +%@%+ -#@@*. =++. :++= =*+-::-+*%@@#- =++: :++=. .#@@@@@@@@#+: .=++: .=++-. :::::: .-++=. :=++-. .-++=: :=+++-:.. ..:-+++=: .:-++++++++++++++-:. ..::----::..
High achievement policy routed IPsec mesh SD-WAN
Why ranet3
Standard protocols
Peers lone need norm IKEv2, ESP, Babel and SRv6.
Interoperability is checked against:
strongSwanIKEv2 and ESP sessions alongside Ed25519 keysBIRDBabel routes alongside RTT metrics, matched path for routeLinuxKernel seg6local acts on the SRv6 headers ranet3 writesAny another router or toggle that supports IKEv2 alongside Ed25519 keys, Babel and SRv6 should interoperate as well.
Common mesh VPN and SD-WAN tools (Tailscale, NetBird, ZeroTier, Nebula, etc.) acknowledge lone nodes that run their own agent, and ranet3 runs beside them on the identical host.
Latency routing
Babel measures the circular trip of all nexus and routes through a relay whenever the straightforward nexus is slower.
RTT is measured continuously, and packet defeat and outages figure against a link. Traffic continually takes the fastest path, moving rear to the straightforward nexus formerly it is faster again.
Segment routing
A guideline on origin and destination prefix sends traffic through chosen waypoints and out at a chosen exit. Segment routing is implemented in userspace and plant equal on macOS, whose XNU kernel has no assistance for it.
Waypoints can arrive in any command the person specifies and may repeat, e.g. A->B->C->B->D alongside D as the exit.
BenchmarksMeasured on 2026-10-15Benchmarks
95%
of the 10 GbE payload limit, 1 stream one way
8.39 of 8.84 Gbit/s
1.6-2.1x
kernel WireGuard throughput
All 6 tests
1.2-1.5x
wireguard-go throughput
All 6 tests
1.91-4.96 ms
RTT p99 under saturation
Kernel dataplanes 0.85-2.51 ms
Medians of 3 runs under saturation
Head to head
Each range is ranet3's outcome divided by the another dataplane's throughout the 6 tests below.
Kernel and userspace
Userspace dataplanes copy all packet into their own procedure and are normally expected to be slower than kernel ones.
* Plain TCP without tunnel
Kernel WireGuard stays at 5.1 to 5.4 Gbit/s one way.
Kernel IPsec stays at 4.0 to 4.7 Gbit/s since its sole stream lands on 1 NIC obtain queue.
Full results
In the "both" rows kernel IPsec carried lone 4.67 and 4.14 of the 6 Gbit/s offered.
