Just throwing out more ideas:

Is there a CPU spike on the VPS?

Anything weird about Wireguard on either end? Using kernel mode WG everywhere and not a user mode version, right?

As a test I would be inclined to try a very small mtu to see if it makes a difference. 1280 is a failsafe that I use when on unknown networks and trying to wg out.

Maybe try with a smaller packet size, like 1KB which I think is -l 1K

Are you specifying bandwidth (-b) on the iperf UDP test? It defaults to 1M if I recall correctly, which would explain the result.

If not, try -b 10M or -b 0 for unlimited (the behavior used for TCP).

I’m doing this on a couple of machines. Only running NFS, Plex (looking at a Jellyfin migration soon), Home Assistant, LibreNMS and some really small other stuff. Not using VMs or LXC due to low-end hardware (pi and older tiny pc). Not using containers due to lack of experience with it and a little discomfort with the central daemon model of Docker, running containers built by people I don’t know.

The migration path I’m working on for myself is changing to Podman quadlets for rootless, more isolation between containers, and the benefits of management and updates via Systemd. So far my testing for that migration has been slow due to other projects. I’ll probably get it rolling on Debian 13 soon.

Erika’s Originals are EU made and great quality.

Maybe not as colorful as you want.

Oh my!

Just tried this on a recent Trixie amd64 install. locate isn’t installed by default, but there is a locate/stable 4.10.0-3 package and it installs just fine for me.

sudo apt update
sudo apt install locate

I’m using Mikrotik and Ruckus. Would recommend both. I like that they are both at the level of reliability that I don’t think about them at all for months at a time. I update quarterly or less and they require no other attention from me. They also work well with my centralized data collection and alerting via LibreNMS.

OPNSense would be high on my list of alternatives when I reevaluate next time. And all Mikrotik would be a good option for me as well. Their Wi-Fi gear is not as strong as Ruckus or Ubiquiti, but they are super solid.

The Unifi ecosystem is a bit too centralized for me. I don’t want to create an account in order to use the hardware.

Is it possible that you didn’t enable snapshots during installation of TW, and then turned it on later?

That seems to be a common explanation on the openSUSE forum when .snapshots is missing from fstab (found by searching for the error you are hitting). There are some threads with workarounds. Basically, mount the .snapshots subvol manually, re-try the rollback and then add .snapshots to fstab so it works in the future.