Performance and Security Analysis of MQTT Communication over WireGuard, TLS, and Plain TCP on Resource-Constrained IoT Devices

This preprint presents a comparative performance and security analysis of MQTT communication over three transport configurations: Plain TCP, TLS, and WireGuard-based VPN tunneling, with a focus on resource-constrained IoT devices such as the ESP32. The study evaluates each approach in terms of confidentiality, attack surface exposure, deployment complexity, and practical performance overhead in real-world IoT scenarios. Through controlled experiments and traffic analysis, the work demonstrates how unencrypted MQTT over TCP exposes sensitive payload data, while TLS provides application-layer encryption with associated computational overhead. WireGuard is analyzed as a lightweight network-layer security alternative, highlighting its effectiveness in isolating MQTT traffic within a private tunnel and reducing public exposure of brokers. The findings aim to guide researchers, developers, and system designers in selecting appropriate security mechanisms for IoT deployments where performance, scalability, and security must be carefully balanced. This work is shared as a preprint to encourage academic discussion and feedback prior to formal peer review.