1Gb/s Site-to-Site VPN Throughput possible with right hardware?

robinjames

Hey gang,

Was just wondering if it's possible to have OpenVPN @ 1Gb/s? We have a 1Gb Virtual L2 connection between our two offices, and we would like to make sure it's secure by using OpenVPN on each end. I have a feeling that the restriction here would be software and not hardware?

Thanks!
-Robin

EDIT: Stumbled upon this while googling tonight: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
if these tweaks were possible in pfSense and I made sure I had an AES-NI capable CPU, I could be on my way?

Guest

AES-NI is not well-supported on FreeBSD yet. It's implemented,
http://www.freebsd.org/cgi/man.cgi?query=aesni&apropos=0&sektion=4&manpath=FreeBSD+8.3-RELEASE&arch=default&format=html
but due to the way it is implemented, it doesn't give much, if any, boost.

It's being addressed, but:

will likely only hit -HEAD and 10.x (thus pfSense 2.2)
will probably take 6-8 months

jasonlitka

@gonzopancho:

AES-NI is not well-supported on FreeBSD yet. It's implemented,
http://www.freebsd.org/cgi/man.cgi?query=aesni&apropos=0&sektion=4&manpath=FreeBSD+8.3-RELEASE&arch=default&format=html
but due to the way it is implemented, it doesn't give much, if any, boost.

It's being addressed, but:

will likely only hit -HEAD and 10.x (thus pfSense 2.2)

will probably take 6-8 months

Jump mentioned a while back that the AES-NI code in OpenVPN was much better than the cryptodev module and that it would likely be faster if you unloaded it and rebooted. Is that still the case?

Guest

@Jason:

Jump mentioned a while back that the AES-NI code in OpenVPN was much better than the cryptodev module and that it would likely be faster if you unloaded it and rebooted. Is that still the case?

It's not "much better", it's just the openssl port. If it doesn't go through the cryptdev interface, then yes, it's probably faster.

That being true, OpenVPN has it's own performance problems to deal with. (Read: context switch overhead.) One way to fix this would
be to put netmap under openvpn.

As I said, it's being addressed.