Hardware Configuration for Optimal VPN Connection Speeds
-
pfBasic, thank you for you help and guidance it truly is invaluable.
The box is expensive but I chose it as I'm concerned about going and buying the wrong hardware combinations, I'm not confident enough to individually purchase the CPU, RAM, hard drive, case, power supply etc as I simply don't have the knowledge… I've visited several sites and looked at various motherboards etc and then I'm completely lost.... :-[
I've read in several forums that OpenVPN cannot use multiple cores so I guess the i7 won't be used to it's full potential.
I've got a Asus RT3200 that I'll use for my wireless AP.I'm embarrassed to say that I need hand holding through buying the 'perfect' setup.
I'd like to draw upon your your past experience and ask you if you were to start again but with the knowledge that you now have what setup would you go for? (sorry to sound cheeky but can you provide links too please?) :) -
pfBasic, thank you for you help and guidance it truly is invaluable.
The box is expensive but I chose it as I'm concerned about going and buying the wrong hardware combinations, I'm not confident enough to individually purchase the CPU, RAM, hard drive, case, power supply etc as I simply don't have the knowledge… I've visited several sites and looked at various motherboards etc and then I'm completely lost.... :-[
I've read in several forums that OpenVPN cannot use multiple cores so I guess the i7 won't be used to it's full potential.
I've got a Asus RT3200 that I'll use for my wireless AP.I'm embarrassed to say that I need hand holding through buying the 'perfect' setup.
I'd like to draw upon your your past experience and ask you if you were to start again but with the knowledge that you now have what setup would you go for? (sorry to sound cheeky but can you provide links too please?) :)
[/quote]I'm happy to help, I'm no IT pro at all and am a pfsense newbie myself. Everything you read from me will be regurgitated from something I've read elsewhere.
That being said building your own box is really not difficult, and if you ask questions here about component choices you can end up with a very solid system for a great price.
Building PCs is like Legos for adults. Pick a motherboard, is recommend mini-ITX as they are very compact, then pick a case that fits mini-itx. The board you pick will have sieve for what hardware you can use with it, so if it says ddr4 get that, of it says sodimm then get a so funny. As far as actually putting the parts together it's pretty much just plug and play then install pfsense the same as you would on a pre built box.The box you picked is overall probably going to work for you, but your paying a lot of money due things you'll literally never use, and it doesn't specify the types of NICs it has, and NICs are probably the most important component in a pfsense box.
-
I'm embarrassed to say that I need hand holding through buying the 'perfect' setup.
I'd like to draw upon your your past experience and ask you if you were to start again but with the knowledge that you now have what setup would you go for? (sorry to sound cheeky but can you provide links too please?) :)For what you described I would go with something along these lines:
Buy a used non-working SFF desktop off eBay, looking for something that has a working PSU. This gets you a Case & PSU for really cheap. Some examples of what I'm generally talking about (I'm linking eBay but if you can't find what you need for free/cheap shipping then craigslist/garage sale/your local computer shop probably have something for you).:
http://www.ebay.com/itm/PARTS-REPAIR-Gateway-E-4300-SFF-Slim-Desktop-E-Series-PC-Computer-NO-HD-OS-RAM-/331568199492?hash=item4d33013744:g:MgYAAOSwKrhVZ5Sc#viTabs_0
http://www.ebay.com/itm/Dell-Optiplex-790-SFF-Desktop-for-Parts-Repair-NO-RAM-CPU-HDD-/311775026711?hash=item48973d5e17:g:XksAAOSw5cNYcB2IBuy a used intel NIC off eBay. Pretty much all of the cheap ones are manufacturers version and/or chinese knockoffs, but there are tons of threads on here testifying that these work just as well as the real deal. The PRO/1000's are cheapest but you can find i340 or i350 for very cheap, they are more advanced and lower power. Here's an example of a two port model, if you need more ports you can get up to a four port. You'll want the SFF bracket, but you can get those seperately for as cheap as a dollar if you find a great deal on a NIC with a tall bracket.
http://www.ebay.com/itm/IBM-I340-T2-Dual-Port-Ethernet-Adapter-Card-49Y4232-/332093948632?hash=item4d525782d8:g:cykAAOSwjDZYfPtFRAM that fits the board you buy:
https://smile.amazon.com/Crucial-1600MHz-PC3-12800-DDR3L-SDRAM-CT51264BF160BJ/dp/B009RBN6I6/ref=sr_1_11?s=pc&ie=UTF8&qid=1485672045&sr=1-11&keywords=ddr3l&refinements=p_n_feature_twenty_browse-bin%3A9729697011%2Cp_n_feature_four_browse-bin%3A2253866011%2Cp_n_feature_five_browse-bin%3A673263011Motherboard & CPU, again I would recommend you get the J3355B as I believe it will exceed you current needs and it gets you fanless embedded CPU for $55:
https://www.newegg.com/Product/Product.aspx?Item=N82E16813157726Assuming you have absolutely nothing laying around that you can pull parts from, then you could buy this for about $155. Put pfsense on it, push it behind a desk and it'll be the most advanced, stable router you've probably ever owned. In a few years if your needs exceed this CPU, there will proably be something with a new architecture that's cheap, low power, and fast enough for you. Just buy one of those and swap it with the J3355B and plug everything else back in (except maybe the RAM if you get a DDR4 [or 5] board).
The only moving part in this system would be the PSU fan, which you could replace with a pico PSU but it probably isn't worth it.
Another note along the lines of your described use. Unless you have a specific reason to use VPN all the time, it might not be the best choice to just route ALL of your traffic over a VPN. Not all websites play nice with VPN IPs because a lot of VPN traffic is malicious. You'll end up with a lot of captcha's that you wouldn't otherwise deal with and some websites will outright reject your traffic.
You might be better off only routing one LAN over VPN, or only sending a few of your static IPs over VPN. Not only will this increase your general usability but it could also greatly reduce your hardware needs.
I don't know what your specific needs are, but I mention it because I initially just blasted everything over a VPN but it was so annoying being blocked from websites and getting captcha's that I just put the few IPs on the VPN that actually needed it. -
I asked what people were using on my VPN providers forum and had this interesting piece of information…
'When I benchmarked my CPUs for OpenVPN with AirVPN parameters I was getting from 120Mb/s for a Intel N3105 to ~350MB/s for a i5 2500.
A modern fast i3 Xeon or otherwise might do 500Mb/s but I would check.'
I can confirm.
I'm using a N3150 and the speed is about 125Mbps when connected to a PIA server (the speed is about 280Mbs if not connected to a VPN).
As far as I know the CPU's OpenVPN performance are directly connected to AES-NI and to the single thread capabilities.
To get an idea you could take a look here:
https://forum.pfsense.org/index.php?topic=115673.0
so you should easily imagine the performance potentially reached by a Celeron J3455.
From my point of view the main reason to prefer a quad core to a dual core is that pfSense can use multiple VPN clients grouping them into a gateway group.
So activating two VPN clients (one per core) I can easily double the speed while the remaining cores are managing the other activities of the router.
And the situation can only improve with the advent of OpenVPN 2.4 that supports AES-GCM as rightly mentioned by VAMike. -
pfSense can use multiple VPN clients grouping them into a gateway group.
…
So activating two VPN clients (one per core) I can easily double the speed while the remaining cores are managing the other activities of the router.This is very interesting, I had read about doing this in other implementations but didn't know you could do it on pfSense. Do you know of a guide on here or elsewhere that would show how to do this?
Everywhere on this forum I always see the OpenVPN single core only issue mentioned as a reason to use high single core CPU's.
If it's simply a matter of configuration to effectively utilize multiple cores then that argument isn't really valid and we should all be using quad core+ CPU's as I don't know of any other CPU hogs that are single core only? -
Everywhere on this forum I always see the OpenVPN single core only issue mentioned as a reason to use high single core CPU's.
If it's simply a matter of configuration to effectively utilize multiple cores then that argument isn't really valid and we should all be using quad core+ CPU's as I don't know of any other CPU hogs that are single core only?Any single openvpn process can only use one core. You can run multiple processes on different ports (as a server) or connect to multiple vpn servers (as a client) and utilize multiple core. BUT this has limitations. No single connection will get more than one core worth of CPU, so if you're interested in downloading a file to your desktop you can be bottlenecked by the VPN even if there is unused capacity available to other openvpn processes. Similarly, as a server, no client will get more than a core even if you have idle server processes. It's somewhat more complicated to configure each client to run on a separate port or IP, or you can round-robin and potentially get an imbalanced load. At some point it's easier to just either use a different VPN solution, or spend the money and buy a faster CPU.
-
Any single openvpn process can only use one core. You can run multiple processes on different ports (as a server) or connect to multiple vpn servers (as a client) and utilize multiple core. BUT this has limitations. No single connection will get more than one core worth of CPU, so if you're interested in downloading a file to your desktop you can be bottlenecked by the VPN even if there is unused capacity available to other openvpn processes. Similarly, as a server, no client will get more than a core even if you have idle server processes. It's somewhat more complicated to configure each client to run on a separate port or IP, or you can round-robin and potentially get an imbalanced load. At some point it's easier to just either use a different VPN solution, or spend the money and buy a faster CPU.
That makes sense, still it sounds potentially worthwhile (if the configuration isn't a nightmare) until someday over the rainbow when OpenVPN supports multi-core ten pfsense adopts that version.
-
This is very interesting, I had read about doing this in other implementations but didn't know you could do it on pfSense. Do you know of a guide on here or elsewhere that would show how to do this?
Anyway it's worth to try.
I've followed the instructions from M_Devil here:
https://forum.pfsense.org/index.php?topic=115992.msg652957#msg652957 -
Thankyou!
-
This is very interesting, I had read about doing this in other implementations but didn't know you could do it on pfSense. Do you know of a guide on here or elsewhere that would show how to do this?
Anyway it's worth to try.
I've followed the instructions from M_Devil here:
https://forum.pfsense.org/index.php?topic=115992.msg652957#msg652957Thanks very much! I appreciate it, got it set up quick and it's working great, balancing load between two instances. My current CPU is already way overkill but if I move to a more sensible CPU or virtualization in the future I'm sure this will help!
-
Another worthwhile application of this is having continuous access to multiple servers. For example, I use PIA and I've found that every now and then the server I typically use will start to slow down noticeably with a significant increase in ping. In the past I've simply switched to a different server manually, then switch back a few days later.
With this I've set up the second client to connect to a different server. This way if one server starts to slow down (or goes down completely), I'm already connected to an alternative server.
For this reason it might even be worth considering a third client for some.
It really is crazy to me how effective of a tool pfSense is.