Hardware encryption on Netgate 3100 with pfSense Plus 23.01, using OpenVPN

sgw

Yesterday I upgraded a Netgate 3100 at a customer. Had to apply that one fix with the modules, and upgrade packages, otherwise it went OK.

Now I wanted to check for crypto. Did the setting for crypto disappear with this upgrade?

The dashboard tells me: "Hardware crypto AES-CBC,SHA1,SHA256"

The main OpenVPN server we run looks like this:

Data Ciphers: AES-256-GCM
Digest: SHA256
D-H Params: 2048 bits

Does that mean we don't use hardware crypto currently? To me it looks like that.

Ah, and even inside the ovpn-server config I have "No Hardware Crypto Acceleration". And only three AES-xxx-CBC ciphers to choose with hw crypto.
I was quite sure to have enabled hw crypto when setting this up. Maybe something changed, maybe I was wrong.

gandalf33

Have you enabled DCO ? DCO requires GCM which your hardware crypto doesn't handle.

mcury

@sgw It seems that openvpn is no longer accelerated by the SG-3100 crypto engine.

You can read more about it at:
https://forum.netgate.com/topic/171261/openvpn-and-sg-3100-crypto-support/7
https://www.mail-archive.com/freebsd-stable@freebsd.org/msg136970.html

sgw

@gandalf33 No DCO enabled yet, no.

sgw

@mcury Oh, interesting (and sad).

I was able to enable CBC ciphers in the OpenVPN server and choose hw crypto for that as well. Can't tell if it works though. We will test and monitor CPU load etc for a check.