Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense hardware for home router - OpenVPN performance

    Scheduled Pinned Locked Moved Hardware
    110 Posts 30 Posters 63.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      VAMike
      last edited by

      @Pippin:

      Very much doubt these calculations or any….., to much variables to make a good estimate that will reflect reality.
      Cipher, digest, hash, compression, mtu, buffersizes, network, latency, etc. all play a role.
      And also the type of data that goes through the tunnel.

      Intel Celeron N3150 4x1.6GHz    -TDP 6W  -CPU Mark 1642 -Single Thread  456
      3200/27,5 = 116 Mbps OpenVPN performance (estimate)

      As argument, with N3150 (Gigabyte N3150N-D3V), I can tell you that in a client to client Iperf test, I was getting 160 Mbit/s throughput, I used:
      No crypto hardware selected (meaning AES-NI will be used automatically if it`s supported, N3150 does)
      no compression
      DH 2048
      AES-256-CBC
      SHA512
      prng SHA512 32 #(prng_hash = 'RSA-SHA512'/prng_nonce_secret_len = 32)
      cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384/2048 bit RSA

      As you can see, with these somewhat "heavier" settings it is higher then the calculated 116 Mbit/s.

      Furthermore, keep in mind that this was client to client, meaning there is an extra round of crypto happening at server…..

      I'd guess that the original benchmark was done with aesni.ko loaded, hence the low crypto performance. Without aesni.ko I benchmark just about exactly 160Mbps on that hardware…

      1 Reply Last reply Reply Quote 0
      • V
        VAMike
        last edited by

        @spon901:

        I made following tests.  I connect a i5 laptop and a RK3288 based linux box to a vlan switch.  The RK3288 is used as a vlan router. On Laptop I runned a speed test through this router. and I obtain 300M/150M which is what provider offer.
        Running the above test command I got :
        For RK3288  27 sec which mean 118.5Mbps
        For I5 Laptop 6 sec which mean 533 Mbps.

        So I expect a throughput of around 120Mbps .  However insialling openwrt on both RK3288 box and I5 laptop, performing same test I have only 32Mbps/43Mbps.  Why so big difference comparative with theoeretical speed of 120Mbps

        Do I understand correctly that you changed the OS after running the benchmark? Try running the benchmark on the OS you're using for the test.

        1 Reply Last reply Reply Quote 0
        • S
          spon901
          last edited by

          No,  was the same OS .  I did not change anything.  Just test  directly and the immediately run same test through openvpn. The again run same test directly just to be sure.  The results are :

          Directly 300/150, through vpn 32/43.

          1 Reply Last reply Reply Quote 0
          • ?
            Guest
            last edited by

            @spon901:

            The measurement above using command:
            time openvpn –test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc

            seem to be total innacurate.

            I made following tests.  I connect a i5 laptop and a RK3288 based linux box to a vlan switch.  The RK3288 is used as a vlan router. On Laptop I runned a speed test through this router. and I obtain 300M/150M which is what provider offer.
            Running the above test command I got :
            For RK3288  27 sec which mean 118.5Mbps
            For I5 Laptop 6 sec which mean 533 Mbps.

            So I expect a throughput of around 120Mbps .  However insialling openwrt on both RK3288 box and I5 laptop, performing same test I have only 32Mbps/43Mbps.  Why so big difference comparative with theoeretical speed of 120Mbps

            OpenWRT is Linux based and not BSD based! This at first. But you will be also getting total
            other results if you take on both sides Intel Core i5 CPUs and or i7 CPUs. And theoretical
            you could do a test on the same devices for OpenSSL likes many others are doing, but
            what you get then out as a result in the real life you should know, is totally another thing!

            This numbers even can be and will be different pending on the;
            used hardware (horse power), devices it self and topology of the network or done test.

            And pease don´t forget that you will need more horse power such OpenWRT is needing,
            but on the other side you get then not only a small router, you might be able to set up until
            a fully UTM device if needed.

            1 Reply Last reply Reply Quote 0
            • D
              Dalsland
              last edited by

              Here is my benchmark for

              Intel J1900 Quad Core 4x2GHz
              Network 4*Intel WG82583
              Eglobal Fanless Mini PC

              [2.3.2-RELEASE][admin@pfSense.localdomain]/root: time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
              30.309u 0.023s 0:30.35 99.9%    742+177k 0+0io 0pf+0w
              
              

              30s = 106 Mbps according to the calculation.

              "Real world"  performance:
              I have a 100/100 connection

              No VPN

              VPN

              1 Reply Last reply Reply Quote 0
              • M
                mauroman33
                last edited by

                @spon901:

                No,  was the same OS .  I did not change anything.  Just test  directly and the immediately run same test through openvpn. The again run same test directly just to be sure.  The results are :

                Directly 300/150, through vpn 32/43.

                Don't you have doubt that it could be related to your VPN provider?

                1 Reply Last reply Reply Quote 0
                • S
                  spon901
                  last edited by

                  Both i5 laptop and RK3288 box are in my location connected through a gigabit network.  There is no VPN provider involved, only normal ISP that provide connection with 300Mbit/150Mbit. On laptop I have Windows 7 installed and on RK3288 Ubuntu 14.10.  As I said the RK3288 act like a VLAN router and connected directly , on laptop I can successfully reach maximum speed provider offer (300/150). Now maing the same speed but through openvpn (I simulate laptop using openvpn client tried to conect to RK3288 openvpn server that connect to internet.  In this case the speed was just 32/43.  he issue here is not why the speed is so low.  It maybe because RK3288 cannot do more (however this is also strange becasue is a capable processor having crypto hardware accelerated).  The issue is why testing openvpn speed (and not openssl) gives a so big difference.  And all those tests were repeated several times, just to be sure.  The results were consistent.  Is there any way to be sure that openvpn use hardware accelerated crypto or not.  Because maybe this is the reason of so big difference.

                  1 Reply Last reply Reply Quote 0
                  • M
                    mauroman33
                    last edited by

                    Sorry mate, but I didn't understand how pfSense is involved in your test.

                    1 Reply Last reply Reply Quote 0
                    • S
                      spon901
                      last edited by

                      It is not yet.  I intend to install it.  ut what I wrote has nothing to do with pfsense, or to any operating system.  It has to do with theoretical speed calculation cs real speed.

                      1 Reply Last reply Reply Quote 0
                      • M
                        mauroman33
                        last edited by

                        You should consider this thread is about the theoretical speed and the real speed obtained through a device running pfSense.

                        1 Reply Last reply Reply Quote 0
                        • S
                          spon901
                          last edited by

                          Ok, so on a non pFsense device there is no correlation between theoretical and real sped ?

                          1 Reply Last reply Reply Quote 0
                          • V
                            VAMike
                            last edited by

                            @spon901:

                            Ok, so on a non pFsense device there is no correlation between theoretical and real sped ?

                            The test is a heuristic, and it remains to be seen how accurate it is across a wide variety of machines. In this case I'd specifically wonder whether the abnormally large blocks used to pad the test runtime give wildly inaccurate results for off-board crypto processors. (On the RK3288, IIRC, the crypto is handled by a specific module, as in the old via padlock stuff, and those generally do much better for large blocks than small blocks because of a high fixed setup cost. On systems with onboard crypto like AES-NI for which the heuristic was initially developed, there's a much lower penalty for small blocks.) I doubt that linux vs fbsd has much to do with it.

                            1 Reply Last reply Reply Quote 0
                            • M
                              mauroman33
                              last edited by

                              @spon901:

                              Ok, so on a non pFsense device there is no correlation between theoretical and real sped ?

                              I think there is also correlation for not pfSense devices, but I don't think you could be sure to get a definitive answer on the pfSense forum.

                              1 Reply Last reply Reply Quote 0
                              • T
                                teh g
                                last edited by

                                Figured I'd show my J3455 results:

                                Intel Celeron J3455 4x1.5GHz        -TDP 10W -CPU Mark 2134 -Single Thread  782

                                AES-256-CBC : 267.9 Mbps
                                AES-256-GCM: 282.4 Mbps

                                AES-128-CBC: 270.0 Mbps
                                AES-128-GCM: 284.9Mbps

                                1 Reply Last reply Reply Quote 0
                                • D
                                  denova
                                  last edited by

                                  I know it's a bit of an old topic but I'm currently looking at some pfsense hardware with openvpn capabilities as well..

                                  As I have a 1000/1000 fiber connection, I was wondering if a kaby lake celeron 3865u (1.8 GHz, dual core) would do similar or better than a j3355 for pfsense+openvpn purposes?

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pfBasic Banned
                                    last edited by

                                    Probably pretty similar to j3355, but that's a mobile part.

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      chrcoluk
                                      last edited by

                                      aes256 is just needlessly throwing away performance especially on CBC, I suggest sticking to aes128-gcm guys.

                                      pfSense CE 2.8.0

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        denova
                                        last edited by

                                        @teh:

                                        Figured I'd show my J3455 results:

                                        Intel Celeron J3455 4x1.5GHz        -TDP 10W -CPU Mark 2134 -Single Thread  782

                                        AES-256-CBC : 267.9 Mbps
                                        AES-256-GCM: 282.4 Mbps

                                        AES-128-CBC: 270.0 Mbps
                                        AES-128-GCM: 284.9Mbps

                                        Ended up with a G4400 build myself, speed with PIA using OpenVPN and AES-128-CBC is near 500 Mbps. I never see the CPU taxed above 30% though with AES-NI enabled.

                                        Also, the idle power consumption for the total system is about 13 watts, which is still fine for me.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Nice result. I would assume one core is at 100% in those conditions?

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            denova
                                            last edited by

                                            While using some of the tips and tricks in this topic: https://forum.pfsense.org/index.php?topic=112877.15 I was able to increase my speed to 700-800 Mbps with a Speedtest.net test using a nearby 1000 mbit server (see attached).

                                            That's actually a lot better than I had expected. While testing, the OpenVPN WCPU goes up to a about 50% and the max one core is used is also about 50%. Is this normal? I thought OpenVPN would be harder on my processor? (3.3 Ghz G4400 Skylake processor with AES-NI enabled) I'm quite sure my VPN is working fine as the OpenVPN process is spiking and both speedtest.net and privateinternetaccess.com report my PIA ip address. The cipher used is AES-256-CBC.

                                            speedtest.PNG_thumb
                                            speedtest.PNG

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.