Highly Available Distributed VPN Architecture in Cloud-Native Environments: 5G Edge Integration Through API-Driven Orchestration

This paper presents and experimentally validates a cloud-native VPN platform for edge-cloud environments. The implemented system is built on K3s and combines a self-hosted WireGuard overlay, automated TLS exposure, and a stack for management and observability. The deployment was evaluated under real-world constraints, including cellular access paths behind carrier-grade NAT, geographically separated peers, and a restrictive enterprise firewall scenario. A comparative evaluation against OpenVPN was performed using the same MTU setting (1280 bytes) for a stable comparison. WireGuard, relative to the no-VPN scenario, showed throughput reductions of 10–15% for downlink and 18–22% for uplink, while Open- VPN had reductions of 21–24% for downlink and 29–32% for uplink. The results showed consistently higher throughput for WireGuard, although the measured latency was higher than expected. Additional tests with a Palo Alto firewall confirmed tunnel establishment but also revealed performance degradation in restricted conditions (up to 99.6% uplink reduction). Future extensions target 5G edge integration through a simulated 5G core and API-driven orchestration.