PfSense hardware for home router - OpenVPN performance
-
Hi,
Here is my results:
Intel i5-6400 4x2.7GHz -TDP 65W -CPU Mark 6530 -Single Thread 1827
3200/9,89 = 323 Mbps OpenVPN performance (estimate) -
Intel E8400 - 3200 / 15.68 (real) => 201 Mbps OpenVPN performance (estimate)
Intel E8500 - 3200 / 15.17 (real) => 210 Mbps OpenVPN performance (estimate)New system tested:
Intel Xeon E5320 - 3200 / 27.41 (real) => 116 Mbps OpenVPN performance (estimate)
-
If it helps someone…
Intel(R) Atom(TM) CPU C2558 @ 2.40GHz
(timings averaged over 3 runs, but they never varied more than .1 sec)
(with aesni.ko loaded): 3200/24.03 = 133.17
(with aesni.ko unloaded): 3200 / 23.58 = 135.71The reason for doing it with and without aesni.ko is Pippin's observation in this thread: https://forum.pfsense.org/index.php?topic=115627.msg646399#msg646399
(Not sure what kind of influence RAM might have in this test, so I guess I should include that my memory is PC3-12800 ECC CL11)
-
Thanks to CiscoX, n3by and garyd9 for sharing their test results! ;)
As one of the reasons I started this thread was also to find a device capable of adapting to a future growth speed of my home connection from 100Mbs to 250Mbs, I want to share the possibility to combine in a Gateway Group two or more VPN client connections, as highlighted here by M_Devil:
https://forum.pfsense.org/index.php?topic=115992.msg647068#msg647068Because OpenVPN it is not scalable
https://www.clearos.com/resources/documentation/clearos/content:en_us:kb_o_openvpn_performance
this kind of configuration, used to improve the connection speed, depends on how many cores are in the CPU.If anyone else has a chance to try this configuration, please let us know!
-
Wanted to chime in with my real world results and my theoretical results. Running an AMD Sempron 2650. This is a dual core 1.45GHz Kabini part with AES-NI. My theoretical results are about 92Mbps. Real world gets me about 80Mbps give or take. This is with AES-256-CBC on PIA tunnels. FWIW.
-
Hi whosmatt, what is the speed of your line?
Because you're using PIA that allows five concurrent connections, maybe you could try to use two VPN client in the same time to improve your speed connection, as highlighted in the previous message. -
Hi whosmatt, what is the speed of your line?
Because you're using PIA that allows five concurrent connections, maybe you could try to use two VPN client in the same time to improve your speed connection, as highlighted in the previous message.My line is nominally 150Mbps, tests at about 160Mbps. I can try multiple connections for sure. Will post the results. I'm thinking of upgrading my setup anyway; didn't buy it originally for pfSense; just kind of worked out that way. I can either drop in an Athlon 5350 (4 cores 2.05 GHz) or 5370 (4 cores 2.2GHz) or bring the AMD setup back to my HTPC (where it started) and buy something entirely different for pfSense. Oh, the possibilities (and the $$)
-
My line is nominally 150Mbps, tests at about 160Mbps. I can try multiple connections for sure. Will post the results. I'm thinking of upgrading my setup anyway; didn't buy it originally for pfSense; just kind of worked out that way. I can either drop in an Athlon 5350 (4 cores 2.05 GHz) or 5370 (4 cores 2.2GHz) or bring the AMD setup back to my HTPC (where it started) and buy something entirely different for pfSense. Oh, the possibilities (and the $$)
Yes please, let us know the results.
About these two Athlon I would expect results not far from what I got with my A10-7300, that was 256Mbs.
I believe this can be an excellent value for money choice. -
In this group only the Celeron J1900 does not support the AES-NI instructions to improve the speed of applications performing encryption and decryption.
Here are the results:
Intel Celeron J1900 4x2GHz -TDP 10W -CPU Mark 1881 -Single Thread 528
3200/36,5 = 88 Mbps OpenVPN performance (estimate)I'd love to get close to these results. With my J1900 based 2.3.2 box I only pull 5Mbps in real world tests. Surely it must be a setup issue. I'm using 256 aes cbc with ip vanish. I could be an issue with ip vanish, too.
I was going to start a new thread about this, but since this is a benchmark thread, I figured I would ask if there are any generic settings to optimize the openvnc client? I don't want to hijack this thread but was curious if I'm missing something you pfsense veterans are doing since I'm quite new to it.
-
I don't have any problems to get close to the full speed of my 100Mbps line with IPVanish. Later I'll post my configuration
-
I'd love to get close to these results. With my J1900 based 2.3.2 box I only pull 5Mbps in real world tests. Surely it must be a setup issue. I'm using 256 aes cbc with ip vanish. I could be an issue with ip vanish, too.
I was going to start a new thread about this, but since this is a benchmark thread, I figured I would ask if there are any generic settings to optimize the openvnc client? I don't want to hijack this thread but was curious if I'm missing something you pfsense veterans are doing since I'm quite new to it.
Here are the print screens of the settings and the custom options:
explicit-exit-notify 2;
ifconfig-nowarn;
tls-client;
persist-key;
persist-tun;
remote-cert-tls server;
reneg-sec 0;
auth-nocache;
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384;
fast-io;
sndbuf 524288;
rcvbuf 524288
-
Thank you so much! I had a few different settings. LZO Compression on and:
fast-io;
tun-mtu 1500;
persist-key;
persist-tun;
persist-remote-ip;
auth SHA256;
keysize 256;
tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
AES256-SHAWith your advanced settings, I'm getting line speed (100Mbps)! Cheers!
-
Thank you so much! I had a few different settings. LZO Compression on and:
fast-io;
tun-mtu 1500;
persist-key;
persist-tun;
persist-remote-ip;
auth SHA256;
keysize 256;
tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
AES256-SHAWith your advanced settings, I'm getting line speed (100Mbps)! Cheers!
Can you report on exactly what you changed? Is the config you just posted your current config? Thanks!
-
Thank you so much! I had a few different settings. LZO Compression on and:
fast-io;
tun-mtu 1500;
persist-key;
persist-tun;
persist-remote-ip;
auth SHA256;
keysize 256;
tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
AES256-SHAWith your advanced settings, I'm getting line speed (100Mbps)! Cheers!
Glad to help you.
I do not see big differences in the custom options, except for the tls-cipher line … I have some doubts if its syntax is correct because I always used it with "WITH" like here
https://community.openvpn.net/openvpn/ticket/304
I also used compression, but I had not noticed any change in the connection speed. -
If it helps someone…
Intel(R) Atom(TM) CPU C2558 @ 2.40GHz
(timings averaged over 3 runs, but they never varied more than .1 sec)
(with aesni.ko loaded): 3200/24.03 = 133.17
(with aesni.ko unloaded): 3200 / 23.58 = 135.71Dear garyd9,
thanks for your tests!
Just to get it right: This means C2558 gets a OpenVPN throughput of around 130 Mbit/s?
Right now I'm trying to make a decision between C2358, C2558, C2758, Xeon D-1518…
Basically, all I need is 500 Mbit/s WAN throughput and around 100 Mbit/s OpenVPN throughput. I would like to use snort.
But the most important point to me right now is to have a stable OpenVPN throughput of 100 Mbit/s...I'm wondering if a C2358 will accomplish this performance as well?
Since OpenVPN is single-threaded, afaik, a C2358 may have nearly the same openvpn performance as the c2558?EDIT: Well, I just see, there is a big difference in base clock rate... 1,7 GHz vs. 2,4 GHz... So I think the C2358 won't be able to run 100 Mbit/s OpenVPN throughput? According to other threads the OpenVPN throughput of C2358 is somewhere at 70 Mbit/s. Is that correct?
-
Just to get it right: This means C2558 gets a OpenVPN throughput of around 130 Mbit/s?
Theoretically. Real world performance would vary.
I'm wondering if a C2358 will accomplish this performance as well?
Since OpenVPN is single-threaded, afaik, a C2358 may have nearly the same openvpn performance as the c2558?EDIT: Well, I just see, there is a big difference in base clock rate… 1,7 GHz vs. 2,4 GHz... So I think the C2358 won't be able to run 100 Mbit/s OpenVPN throughput? According to other threads the OpenVPN throughput of C2358 is somewhere at 70 Mbit/s. Is that correct?
I don't run openvpn. I just ran the test proposed by the OP and posted the results. However, based on the differences between the C2358 and C2558, I'd guess that the 2358 would have a difficult time getting to 100 megabit/sec openvpn performance.
-
Can you report on exactly what you changed? Is the config you just posted your current config? Thanks!
The changes I made were to disable lzo compression and use mauroman33's custom options. Like he mentioned the main difference in that is the "tls-cipher" line it would seem.
I also made sure to turn off any crypto hardware "assistance" options I may have fiddled with. Most were already disabled, but I did play around with using "RDRAND", so I had to disable that again.
My overall config isn't exactly like his screen shots, though. I tick the boxes to disable addition of routes to the route table and handle those with AON.
-
Can you report on exactly what you changed? Is the config you just posted your current config? Thanks!
The changes I made were to disable lzo compression and use mauroman33's custom options. Like he mentioned the main difference in that is the "tls-cipher" line it would seem.
I also made sure to turn off any crypto hardware "assistance" options I may have fiddled with. Most were already disabled, but I did play around with using "RDRAND", so I had to disable that again.
My overall config isn't exactly like his screen shots, though. I tick the boxes to disable addition of routes to the route table and handle those with AON.
The suggestion to disable the Cryptographic Hardware comes by Pippin's messages in this thread:
https://forum.pfsense.org/index.php?topic=115627.30 -
here are my advanced server settings:
fast-io;sndbuf 0;rcvbuf 0;push "sndbuf 524288";push "rcvbuf 524288";keepalive 10 120;push "redirect-gateway def1";push "redirect-gateway-ipv6 def1";push "route-ipv6 2000::/3";
Here are my advanced client settings:
fast-io fragment 0 mssfix 0 sndbuf 524288 rcvbuf 524288 lport 0 remote-random remote-cert-tls server resolv-retry 4 key-method 2 mute 10 mute-replay-warnings keepalive 10 120 auth-retry nointeract setenv FORWARD_COMPATIBLE 1 verb 3 reneg-sec 0 script-security 2Ultimately, i think we should push to change to Softether as the VPN client. It supports backwards compatibility to OpenVPN and is much faster than OpenVPN for the same hardware.
Here is a feature list: https://www.softether.org/1-features
-
What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.
