Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    PfSense hardware for home router - OpenVPN performance

    Hardware
    30
    110
    49199
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mauroman33 last edited by

      I read several questions about what hardware to build an home router and many people here seem to be interested in surfing through an OpenVPN client, so I performed that simple OpenVPN benchmark on different hardware:
      https://forum.pfsense.org/index.php?topic=105238.msg616743#msg616743 (Reply #9 message)

      The features of all these CPUs come from www.cpubenchmark.net

      Only the Celeron J1900, in this group, does not support the AES-NI instructions to improve the speed in encryption and decryption.

      Here the results:

      Intel Celeron N3150 4x1.6GHz -TDP 6W  -CPU Mark 1642 -Single Thread  456
      3200/27,5 = 116 Mbps OpenVPN performance (estimate)

      Intel Celeron J1900 4x2GHz     -TDP 10W -CPU Mark 1881 -Single Thread  528
      3200/36,5 =  88 Mbps OpenVPN performance (estimate)

      AMD A10-7300 APU 4x1.9GHz -TDP 19W -CPU Mark 3032 -Single Thread 1017
      3200/12,5 = 256 Mbps OpenVPN performance (estimate)

      Intel i7-4500U 2x1.8GHz         -TDP 15W -CPU Mark 3795 -Single Thread 1578
      3200/10,7 = 299 Mbps OpenVPN performance (estimate)

      Intel i7-4790S 4x3.2GHz         -TDP 65W -CPU Mark 9631 -Single Thread 2261
      3200/9,6 =  333 Mbps OpenVPN performance (estimate)

      Intel Celeron J3355 2x2GHz     -TDP 10W -CPU Mark 1333 -Single Thread  884
      3200/10,9 =  293 Mbps OpenVPN performance (estimate)

      Test about i7-4500U was taken from Paint in his tread:
      https://forum.pfsense.org/index.php?topic=113610.30

      Test about Celeron J3355 was taken from pfBasic here:
      https://forum.pfsense.org/index.php?topic=105238.msg709164#msg709164

      In the real world, I found the same test values either through some speed test websites either in the download of some large files.

      Feel free to add your hardware's score.

      1 Reply Last reply Reply Quote 0
      • Pippin
        Pippin last edited by

        Very much doubt these calculations or any….., to much variables to make a good estimate that will reflect reality.
        Cipher, digest, hash, compression, mtu, buffersizes, network, latency, etc. all play a role.
        And also the type of data that goes through the tunnel.

        Intel Celeron N3150 4x1.6GHz    -TDP 6W  -CPU Mark 1642 -Single Thread  456
        3200/27,5 = 116 Mbps OpenVPN performance (estimate)

        As argument, with N3150 (Gigabyte N3150N-D3V), I can tell you that in a client to client Iperf test, I was getting 160 Mbit/s throughput, I used:
        No crypto hardware selected (meaning AES-NI will be used automatically if it`s supported, N3150 does)
        no compression
        DH 2048
        AES-256-CBC
        SHA512
        prng SHA512 32 #(prng_hash = 'RSA-SHA512'/prng_nonce_secret_len = 32)
        cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384/2048 bit RSA

        As you can see, with these somewhat "heavier" settings it is higher then the calculated 116 Mbit/s.

        Furthermore, keep in mind that this was client to client, meaning there is an extra round of crypto happening at server…..

        I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
        Halton Arp

        1 Reply Last reply Reply Quote 0
        • P
          Paint last edited by

          @mauroman33:

          Since I read many information requests about the hardware to build an home router and several people seem interested in surfing through an OpenVPN client, I have performed on different hardware the simple OpenVPN benchmark referenced here:
          https://forum.pfsense.org/index.php?topic=105238.msg616743#msg616743 (Reply #9 message)

          The features of these CPUs come from www.cpubenchmark.net

          The only CPU in the group that does not support AESNI instructions is the Celeron J1900.

          These are the results:

          Intel Celeron N3150 4x1.6GHz -TDP 6W  -CPU Mark 1642 -Single Thread  456
          3200/27,5 = 116 Mbps OpenVPN performance (estimate)

          Intel Celeron J1900 4x2GHz     -TDP 10W -CPU Mark 1881 -Single Thread  528
          3200/36,5 =  88 Mbps OpenVPN performance (estimate)

          AMD A10-7300 APU 4x1.9GHz -TDP 19W -CPU Mark 3032 -Single Thread 1017
          3200/12,5 = 256 Mbps OpenVPN performance (estimate)

          Intel i7-4500U 2x1.8GHz         -TDP 15W -CPU Mark 3795 -Single Thread 1578
          3200/10,7 = 299 Mbps OpenVPN performance (estimate)

          Intel i7-4790S 4x3.2GHz         -TDP 65W -CPU Mark 9631 -Single Thread 2261
          3200/9,6 =  333 Mbps OpenVPN performance (estimate)

          The test about i7-4500U was taken from Paint in its tread:
          https://forum.pfsense.org/index.php?topic=113610.30

          Jumping from theory to practice, with my router (Celeron N3150) I found the same values in speed test websites or in downloading large files.

          Feel free to add the results of your hardware and grow this database.

          please note that test for the Intel i7-4500U test, I was running at cMAX locked - therefore my processor was running in Turbo mode at 3.0ghz and with hyperthreading.

          pfSense i5-4590
          940/880 mbit Fiber Internet from FiOS
          BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
          Netgear R8000 AP (DD-WRT)

          1 Reply Last reply Reply Quote 0
          • M
            mauroman33 last edited by

            I agree with Pippin that this is not a gospel.

            My intention is to have a rough estimate for a connection via OpenVPN.

            In my city, most areas are connected to 50mbs, only a few come to 100Mbs, from this point of view can be useful to know what is the minimum hardware to fully exploit this connection speed.

            In my case (fiber 100) Celeron N3150 meets all requirements.

            I tried in another city with a fiber connection 250 and I found that the maximum download speed of 125Mbs download is fairly consistent with the test results, so in this case I would have to buy a CPU as that used by Paint.

            I used PIA and this is the connection log:

            Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
            Data Channel Encrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
            Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
            Data Channel Decrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
            Control Channel: TLSv1.2, cipher TLSv1 / SSLv3 DHE-RSA-AES256-SHA, RSA 4096 bit

            1 Reply Last reply Reply Quote 0
            • Pippin
              Pippin last edited by

              Thanks for this info, it has more value then theoretical calculation in my eyes ;)
              Since I have no fast ISP connection available here this practical info is very helpful.

              @mauroman33:

              In my city, most areas are connected to 50mbs, only a few come to 100Mbs, from this point of view can be useful to know what is the minimum hardware to fully exploit this connection speed.
              In my case (fiber 100) Celeron N3150 meets all requirements.

              Yes, that is a good thinking, one could also think about the future when upgrading to faster line speed, needing more overhead on your pfS box.

              I tried in another city with a fiber connection 250 and I found that the maximum download speed of 125Mbs download is fairly consistent with the test results, so in this case I would have to buy a CPU as that used by Paint.

              You mean you put pfS box as client to PIA?
              Then maybe PIA is not giving you more? Or you have tested with a PC too and get more then 125 Mbit/s on that 250 Mbit/s line?
              Also running more packages can decrease speed.

              I used PIA and this is the connection log:

              Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
              Data Channel Encrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
              Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
              Data Channel Decrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
              Control Channel: TLSv1.2, cipher TLSv1 / SSLv3 DHE-RSA-AES256-SHA, RSA 4096 bit

              What compression does PIA use and what type of data was being downloaded?

              I find online speedtests somewhat unreliable/inconsistent. Before you know it the speed to PIA is being measured instead of to you.
              Some time ago I used speedtest.net and found my download/upload speed being higher then my line speed  :)

              My writing is no gospel either, I found the following from trying and asking questions as why?
              A better/more reliable way I found is to download a incompressible binary/zip/rar file from a fixed location/server near me.

              Why incompressible?
              Attached images show how compression can "mislead" measurements.
              I connect through OpenVPN to my NAS in another country and then download from fixed locations.
              My line speed (to NAS) is a practical whopping 9,5 Mbit/s down and 2,1 Mbit/s up  :)
              The line speed of NAS location is 50 Mbit/s symmetric, so NAS pulls in data more quickly.
              Yet, you can see in four cases I`m getting down speed above 9,5 Mbit/s.
              The reason is because those four files are compressible and the one giving 8,56 Mbit/s is not.

              Sorry for the long post and if my questions are too much just tell  ;D




              I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
              Halton Arp

              1 Reply Last reply Reply Quote 0
              • M
                mauroman33 last edited by

                Hello Pippin,
                thanks for the reply. More info make more useful a tread.  ;)
                I brought the mini PC with the pfSense installation in a different city.
                The available speed was about 280Mbs without VPN and about 125Mbps connected to the PIA server.
                In the PIA connection I kept the compression disabled and I downloaded some big ISO files and several torrent files.

                1 Reply Last reply Reply Quote 0
                • M
                  MoonKnight last edited by

                  Hi,

                  Here is my results:

                  Intel i5-6400 4x2.7GHz            -TDP 65W -CPU Mark 6530 -Single Thread 1827
                  3200/9,89 =  323 Mbps OpenVPN performance (estimate)

                  --- 23.01 ---
                  Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                  Kingston DDR4 2666MHz 16GB ECC
                  2 x HyperX Fury SSD 120GB (ZFS-mirror)
                  2 x Intel i210 (ports)
                  4 x Intel i350 (ports)

                  1 Reply Last reply Reply Quote 0
                  • N
                    n3by last edited by

                    Intel E8400 -  3200 / 15.68 (real) => 201 Mbps OpenVPN performance (estimate)
                    Intel E8500 -  3200 / 15.17 (real) => 210 Mbps OpenVPN performance (estimate)

                    New system tested:

                    Intel Xeon E5320 -  3200 / 27.41 (real) => 116 Mbps OpenVPN performance (estimate)

                    1 Reply Last reply Reply Quote 0
                    • G
                      garyd9 last edited by

                      If it helps someone…

                      Intel(R) Atom(TM) CPU C2558 @ 2.40GHz

                      (timings averaged over 3 runs, but they never varied more than .1 sec)

                      (with aesni.ko loaded):  3200/24.03 = 133.17
                      (with aesni.ko unloaded):  3200 / 23.58 = 135.71

                      The reason for doing it with and without aesni.ko is Pippin's observation in this thread:  https://forum.pfsense.org/index.php?topic=115627.msg646399#msg646399

                      (Not sure what kind of influence RAM might have in this test, so I guess I should include that my memory is PC3-12800 ECC CL11)

                      1 Reply Last reply Reply Quote 0
                      • M
                        mauroman33 last edited by

                        Thanks to CiscoX, n3by and garyd9 for sharing their test results!  ;)

                        As one of the reasons I started this thread was also to find a device capable of adapting to a future growth speed of my home connection from 100Mbs to 250Mbs, I want to share the possibility to combine in a Gateway Group two or more VPN client connections, as highlighted here by M_Devil:
                        https://forum.pfsense.org/index.php?topic=115992.msg647068#msg647068

                        Because OpenVPN it is not scalable
                        https://www.clearos.com/resources/documentation/clearos/content:en_us:kb_o_openvpn_performance
                        this kind of configuration, used to improve the connection speed, depends on how many cores are in the CPU.

                        If anyone else has a chance to try this configuration, please let us know!

                        1 Reply Last reply Reply Quote 0
                        • W
                          whosmatt last edited by

                          Wanted to chime in with my real world results and my theoretical results.  Running an AMD Sempron 2650. This is a dual core 1.45GHz Kabini part with AES-NI.  My theoretical results are about 92Mbps.  Real world gets me about 80Mbps give or take.  This is with AES-256-CBC on PIA tunnels.  FWIW.

                          1 Reply Last reply Reply Quote 0
                          • M
                            mauroman33 last edited by

                            Hi whosmatt, what is the speed of your line?
                            Because you're using PIA that allows five concurrent connections, maybe you could try to use two VPN client in the same time to improve your speed connection, as highlighted in the previous message.

                            1 Reply Last reply Reply Quote 0
                            • W
                              whosmatt last edited by

                              @mauroman33:

                              Hi whosmatt, what is the speed of your line?
                              Because you're using PIA that allows five concurrent connections, maybe you could try to use two VPN client in the same time to improve your speed connection, as highlighted in the previous message.

                              My line is nominally 150Mbps, tests at about 160Mbps.  I can try multiple connections for sure.  Will post the results.  I'm thinking of upgrading my setup anyway; didn't buy it originally for pfSense; just kind of worked out that way.  I can either drop in an Athlon 5350 (4 cores 2.05 GHz) or 5370 (4 cores 2.2GHz) or bring the AMD setup back to my HTPC (where it started) and buy something entirely different for pfSense.  Oh, the possibilities (and the $$)

                              1 Reply Last reply Reply Quote 0
                              • M
                                mauroman33 last edited by

                                @whosmatt:

                                My line is nominally 150Mbps, tests at about 160Mbps.  I can try multiple connections for sure.  Will post the results.  I'm thinking of upgrading my setup anyway; didn't buy it originally for pfSense; just kind of worked out that way.  I can either drop in an Athlon 5350 (4 cores 2.05 GHz) or 5370 (4 cores 2.2GHz) or bring the AMD setup back to my HTPC (where it started) and buy something entirely different for pfSense.  Oh, the possibilities (and the $$)

                                Yes please, let us know the results.
                                About these two Athlon I would expect results not far from what I got with my A10-7300, that was 256Mbs.
                                I believe this can be an excellent value for money choice.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  DestructionIce last edited by

                                  @mauroman33:

                                  In this group only the Celeron J1900 does not support the AES-NI instructions to improve the speed of applications performing encryption and decryption.

                                  Here are the results:

                                  Intel Celeron J1900 4x2GHz     -TDP 10W -CPU Mark 1881 -Single Thread  528
                                  3200/36,5 =  88 Mbps OpenVPN performance (estimate)

                                  I'd love to get close to these results. With my J1900 based 2.3.2 box I only pull 5Mbps in real world tests. Surely it must be a setup issue. I'm using 256 aes cbc with ip vanish. I could be an issue with ip vanish, too.

                                  I was going to start a new thread about this, but since this is a benchmark thread, I figured I would ask if there are any generic settings to optimize the openvnc client? I don't want to hijack this thread but was curious if I'm missing something you pfsense veterans are doing since I'm quite new to it.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mauroman33 last edited by

                                    I don't have any problems to get close to the full speed of my 100Mbps line with IPVanish. Later I'll post my configuration

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mauroman33 last edited by

                                      @DestructionIce:

                                      I'd love to get close to these results. With my J1900 based 2.3.2 box I only pull 5Mbps in real world tests. Surely it must be a setup issue. I'm using 256 aes cbc with ip vanish. I could be an issue with ip vanish, too.

                                      I was going to start a new thread about this, but since this is a benchmark thread, I figured I would ask if there are any generic settings to optimize the openvnc client? I don't want to hijack this thread but was curious if I'm missing something you pfsense veterans are doing since I'm quite new to it.

                                      Here are the print screens of the settings and the custom options:

                                      explicit-exit-notify 2;
                                      ifconfig-nowarn;
                                      tls-client;
                                      persist-key;
                                      persist-tun;
                                      remote-cert-tls server;
                                      reneg-sec 0;
                                      auth-nocache;
                                      tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384;
                                      fast-io;
                                      sndbuf 524288;
                                      rcvbuf 524288




                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        DestructionIce last edited by

                                        Thank you so much!  I had a few different settings.  LZO Compression on and:

                                        fast-io;
                                        tun-mtu 1500;
                                        persist-key;
                                        persist-tun;
                                        persist-remote-ip;
                                        auth SHA256;
                                        keysize 256;
                                        tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
                                        AES256-SHA

                                        With your advanced settings, I'm getting line speed (100Mbps)! Cheers!

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          whosmatt last edited by

                                          @DestructionIce:

                                          Thank you so much!  I had a few different settings.  LZO Compression on and:

                                          fast-io;
                                          tun-mtu 1500;
                                          persist-key;
                                          persist-tun;
                                          persist-remote-ip;
                                          auth SHA256;
                                          keysize 256;
                                          tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
                                          AES256-SHA

                                          With your advanced settings, I'm getting line speed (100Mbps)! Cheers!

                                          Can you report on exactly what you changed?  Is the config you just posted your current config?  Thanks!

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mauroman33 last edited by

                                            @DestructionIce:

                                            Thank you so much!  I had a few different settings.  LZO Compression on and:

                                            fast-io;
                                            tun-mtu 1500;
                                            persist-key;
                                            persist-tun;
                                            persist-remote-ip;
                                            auth SHA256;
                                            keysize 256;
                                            tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
                                            AES256-SHA

                                            With your advanced settings, I'm getting line speed (100Mbps)! Cheers!

                                            Glad to help you.
                                            I do not see big differences in the custom options, except for the tls-cipher line … I have some doubts if its syntax is correct because I always used it with "WITH" like here
                                            https://community.openvpn.net/openvpn/ticket/304
                                            I also used compression, but I had not noticed any change in the connection speed.

                                            1 Reply Last reply Reply Quote 0
                                            • S
                                              Scampicfx last edited by

                                              @garyd9:

                                              If it helps someone…

                                              Intel(R) Atom(TM) CPU C2558 @ 2.40GHz

                                              (timings averaged over 3 runs, but they never varied more than .1 sec)

                                              (with aesni.ko loaded):  3200/24.03 = 133.17
                                              (with aesni.ko unloaded):  3200 / 23.58 = 135.71

                                              Dear garyd9,

                                              thanks for your tests!

                                              Just to get it right: This means C2558 gets a OpenVPN throughput of around 130 Mbit/s?

                                              Right now I'm trying to make a decision between C2358, C2558, C2758, Xeon D-1518…
                                              Basically, all I need is 500 Mbit/s WAN throughput and around 100 Mbit/s OpenVPN throughput. I would like to use snort.
                                              But the most important point to me right now is to have a stable OpenVPN throughput of 100 Mbit/s...

                                              I'm wondering if a C2358 will accomplish this performance as well?
                                              Since OpenVPN is single-threaded, afaik, a C2358 may have nearly the same openvpn performance as the c2558?

                                              EDIT: Well, I just see, there is a big difference in base clock rate... 1,7 GHz vs. 2,4 GHz... So I think the C2358 won't be able to run 100 Mbit/s OpenVPN throughput? According to other threads the OpenVPN throughput of C2358 is somewhere at 70 Mbit/s. Is that correct?

                                              1 Reply Last reply Reply Quote 0
                                              • G
                                                garyd9 last edited by

                                                @Scampicfx:

                                                Just to get it right: This means C2558 gets a OpenVPN throughput of around 130 Mbit/s?

                                                Theoretically.  Real world performance would vary.

                                                @Scampicfx:

                                                I'm wondering if a C2358 will accomplish this performance as well?
                                                Since OpenVPN is single-threaded, afaik, a C2358 may have nearly the same openvpn performance as the c2558?

                                                EDIT: Well, I just see, there is a big difference in base clock rate… 1,7 GHz vs. 2,4 GHz... So I think the C2358 won't be able to run 100 Mbit/s OpenVPN throughput? According to other threads the OpenVPN throughput of C2358 is somewhere at 70 Mbit/s. Is that correct?

                                                I don't run openvpn.  I just ran the test proposed by the OP and posted the results.  However, based on the differences between the C2358 and C2558, I'd guess that the 2358 would have a difficult time getting to 100 megabit/sec openvpn performance.

                                                1 Reply Last reply Reply Quote 0
                                                • D
                                                  DestructionIce last edited by

                                                  @whosmatt:

                                                  Can you report on exactly what you changed?  Is the config you just posted your current config?  Thanks!

                                                  The changes I made were to disable lzo compression and use mauroman33's custom options. Like he mentioned the main difference in that is the "tls-cipher" line it would seem.

                                                  I also made sure to turn off any crypto hardware "assistance" options I may have fiddled with. Most were already disabled, but I did play around with using "RDRAND", so I had to disable that again.

                                                  My overall config isn't exactly like his screen shots, though.  I tick the boxes to disable addition of routes to the route table and handle those with AON.

                                                  1 Reply Last reply Reply Quote 0
                                                  • M
                                                    mauroman33 last edited by

                                                    @DestructionIce:

                                                    @whosmatt:

                                                    Can you report on exactly what you changed?  Is the config you just posted your current config?  Thanks!

                                                    The changes I made were to disable lzo compression and use mauroman33's custom options. Like he mentioned the main difference in that is the "tls-cipher" line it would seem.

                                                    I also made sure to turn off any crypto hardware "assistance" options I may have fiddled with. Most were already disabled, but I did play around with using "RDRAND", so I had to disable that again.

                                                    My overall config isn't exactly like his screen shots, though.  I tick the boxes to disable addition of routes to the route table and handle those with AON.

                                                    The suggestion to disable the Cryptographic Hardware comes by Pippin's messages in this thread:
                                                    https://forum.pfsense.org/index.php?topic=115627.30

                                                    1 Reply Last reply Reply Quote 0
                                                    • P
                                                      Paint last edited by

                                                      here are my advanced server settings:

                                                      fast-io;sndbuf 0;rcvbuf 0;push "sndbuf 524288";push "rcvbuf 524288";keepalive 10 120;push "redirect-gateway def1";push "redirect-gateway-ipv6 def1";push "route-ipv6 2000::/3";

                                                      Here are my advanced client settings:

                                                      fast-io
                                                      fragment 0
                                                      mssfix 0
                                                      sndbuf 524288
                                                      rcvbuf 524288
                                                      lport 0
                                                      remote-random
                                                      remote-cert-tls server
                                                      resolv-retry 4
                                                      key-method 2
                                                      mute 10
                                                      mute-replay-warnings
                                                      keepalive 10 120
                                                      auth-retry nointeract
                                                      setenv FORWARD_COMPATIBLE 1
                                                      verb 3
                                                      reneg-sec 0
                                                      script-security 2
                                                      

                                                      Ultimately, i think we should push to change to Softether as the VPN client.  It supports backwards compatibility to OpenVPN and is much faster than OpenVPN for the same hardware.

                                                      Here is a feature list: https://www.softether.org/1-features

                                                      pfSense i5-4590
                                                      940/880 mbit Fiber Internet from FiOS
                                                      BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                                      Netgear R8000 AP (DD-WRT)

                                                      1 Reply Last reply Reply Quote 0
                                                      • S
                                                        sirozha Banned last edited by

                                                        What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

                                                        1 Reply Last reply Reply Quote 0
                                                        • P
                                                          Paint last edited by

                                                          @sirozha:

                                                          What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

                                                          While softether can be used for obsfcation, softether actually supports more corporate features than OpenVPN. It supports IPSec, VLANs, OpenVPN, etc. In addition, the code is more modern and supports  multithreaded VPN. I get comparable speeds from my Raspberry Pi running Softether VPN versus my i7 pfsense box running pfSense.

                                                          Anyway, not trying to hijack the thread. Just adding my .02

                                                          pfSense i5-4590
                                                          940/880 mbit Fiber Internet from FiOS
                                                          BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                                          Netgear R8000 AP (DD-WRT)

                                                          1 Reply Last reply Reply Quote 0
                                                          • G
                                                            garyd9 last edited by

                                                            @Paint:

                                                            Ultimately, i think we should push to change to Softether as the VPN client.

                                                            Well, it's already in freeBSD ports…

                                                            1 Reply Last reply Reply Quote 0
                                                            • W
                                                              whosmatt last edited by

                                                              @sirozha:

                                                              What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

                                                              And that doesn't have any bearing on the performance numbers, which is what we're discussing here.  We're talking about the technology and performance on given hardware, not the reasons we're using it.  This discussion is directly relevant to anyone using OpenVPN, regardless of the use case.

                                                              1 Reply Last reply Reply Quote 0
                                                              • M
                                                                mauroman33 last edited by

                                                                @sirozha:

                                                                What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

                                                                Sorry mate, I don't understand. How do you know what is the reason why people are using a VPN here?
                                                                Are you maybe speaking of your personal experience?
                                                                Personally I have some good reasons to use it, starting from the systematic throttling performed by the ISP in my area if you don't use the services directly purchased from it …
                                                                But maybe, as rightly said whosmatt, this is not the forum for this kind of discussion.

                                                                1 Reply Last reply Reply Quote 0
                                                                • S
                                                                  sirozha Banned last edited by

                                                                  Test VPN from the gear you own (and whose specs you know) to your pfSense box across a reliable internet connection. That will give you the performance indication of your hardware. Better yet, test the VPN throughput in the lab to see the maximum throughput your hardware is capable of.

                                                                  Stating the VPN throughput of 5 Mbps to some third-party VPN service is hardly an indication that something is wrong with your hardware or software.

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • P
                                                                    Paint last edited by

                                                                    @Paint:

                                                                    here are my advanced server settings:

                                                                    fast-io;sndbuf 0;rcvbuf 0;push "sndbuf 524288";push "rcvbuf 524288";keepalive 10 120;push "redirect-gateway def1";push "redirect-gateway-ipv6 def1";push "route-ipv6 2000::/3";

                                                                    Here are my advanced client settings:

                                                                    fast-io
                                                                    fragment 0
                                                                    mssfix 0
                                                                    sndbuf 524288
                                                                    rcvbuf 524288
                                                                    lport 0
                                                                    remote-random
                                                                    remote-cert-tls server
                                                                    resolv-retry 4
                                                                    key-method 2
                                                                    mute 10
                                                                    mute-replay-warnings
                                                                    keepalive 10 120
                                                                    auth-retry nointeract
                                                                    setenv FORWARD_COMPATIBLE 1
                                                                    verb 3
                                                                    reneg-sec 0
                                                                    script-security 2
                                                                    

                                                                    Ultimately, I think we should push to change to Softether as the VPN client.  It supports backwards compatibility to OpenVPN and is much faster than OpenVPN for the same hardware.

                                                                    Here is a feature list: https://www.softether.org/1-features

                                                                    I started a thread in the package sub-forum regarding my SoftEther FreeBSD package port and performance. My initial tests show I can easily push 150/150 mbps (maximum of my WAN speed) through SoftEther with very low load on my pfSense machine!

                                                                    https://forum.pfsense.org/index.php?topic=117626

                                                                    I will post some benchmarks and run some theoretical maximum tests to see how fast SoftEther is compared to OpenVPN on my machine (my theoretical OpenVPN max is 299 mbps).

                                                                    pfSense i5-4590
                                                                    940/880 mbit Fiber Internet from FiOS
                                                                    BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                                                                    Netgear R8000 AP (DD-WRT)

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • I
                                                                      IggyB last edited by

                                                                      ci323 nano u

                                                                      Stats for you guys

                                                                      hw.model: Intel(R) Celeron(R) CPU  N3150  @ 1.60GHz
                                                                      (cryptodev) BSD cryptodev engine
                                                                      (rsax) RSAX engine support
                                                                      (rdrand) Intel RDRAND engine
                                                                      (dynamic) Dynamic engine loading support

                                                                      openssl speed aes-128-cbc aes-192-cbc aes-256-cbc
                                                                      OpenSSL 1.0.1s-freebsd  1 Mar 2016
                                                                      built on: date not available
                                                                      options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
                                                                      compiler: clang
                                                                      The 'numbers' are in 1000s of bytes per second processed.
                                                                      type            16 bytes    64 bytes    256 bytes  1024 bytes  8192 bytes
                                                                      aes-128 cbc      27446.63k    31065.88k    32203.01k    79808.59k    80497.95k
                                                                      aes-192 cbc      23419.20k    25885.49k    26810.11k    66946.05k    67553.96k
                                                                      aes-256 cbc      20250.74k    22164.16k    22912.07k    57832.11k    58552.27k

                                                                      openssl speed -engine cryptodev -multi 4 aes-128-cbc aes-192-cbc aes-256-cbc
                                                                      OpenSSL 1.0.1s-freebsd  1 Mar 2016
                                                                      built on: date not available
                                                                      options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
                                                                      compiler: clang
                                                                      aes-128 cbc    104805.14k  118668.96k  128936.14k  318822.11k  321327.26k
                                                                      aes-192 cbc      93729.09k  103600.58k  107154.76k  267119.27k  271302.66k
                                                                      aes-256 cbc      80937.83k    88656.43k    91726.42k  226115.54k  230708.57k

                                                                      openssl speed -multi 4 bf-cbc
                                                                      OpenSSL 1.0.1s-freebsd  1 Mar 2016
                                                                      built on: date not available
                                                                      options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
                                                                      compiler: clang
                                                                      blowfish cbc    164957.33k  185746.01k  191440.98k  193272.15k  193628.57k

                                                                      openssl speed bf-cbc
                                                                      OpenSSL 1.0.1s-freebsd  1 Mar 2016
                                                                      built on: date not available
                                                                      options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
                                                                      compiler: clang
                                                                      The 'numbers' are in 1000s of bytes per second processed.
                                                                      type            16 bytes    64 bytes    256 bytes  1024 bytes  8192 bytes
                                                                      blowfish cbc    41251.69k    46459.56k    47838.06k    48378.47k    48452.95k

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • S
                                                                        spon901 last edited by

                                                                        The measurement above using command:
                                                                        time openvpn –test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc

                                                                        seem to be total innacurate.

                                                                        I made following tests.  I connect a i5 laptop and a RK3288 based linux box to a vlan switch.  The RK3288 is used as a vlan router. On Laptop I runned a speed test through this router. and I obtain 300M/150M which is what provider offer.
                                                                        Running the above test command I got :
                                                                        For RK3288  27 sec which mean 118.5Mbps
                                                                        For I5 Laptop 6 sec which mean 533 Mbps.

                                                                        So I expect a throughput of around 120Mbps .  However insialling openwrt on both RK3288 box and I5 laptop, performing same test I have only 32Mbps/43Mbps.  Why so big difference comparative with theoeretical speed of 120Mbps

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • V
                                                                          VAMike last edited by

                                                                          @Pippin:

                                                                          Very much doubt these calculations or any….., to much variables to make a good estimate that will reflect reality.
                                                                          Cipher, digest, hash, compression, mtu, buffersizes, network, latency, etc. all play a role.
                                                                          And also the type of data that goes through the tunnel.

                                                                          Intel Celeron N3150 4x1.6GHz    -TDP 6W  -CPU Mark 1642 -Single Thread  456
                                                                          3200/27,5 = 116 Mbps OpenVPN performance (estimate)

                                                                          As argument, with N3150 (Gigabyte N3150N-D3V), I can tell you that in a client to client Iperf test, I was getting 160 Mbit/s throughput, I used:
                                                                          No crypto hardware selected (meaning AES-NI will be used automatically if it`s supported, N3150 does)
                                                                          no compression
                                                                          DH 2048
                                                                          AES-256-CBC
                                                                          SHA512
                                                                          prng SHA512 32 #(prng_hash = 'RSA-SHA512'/prng_nonce_secret_len = 32)
                                                                          cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384/2048 bit RSA

                                                                          As you can see, with these somewhat "heavier" settings it is higher then the calculated 116 Mbit/s.

                                                                          Furthermore, keep in mind that this was client to client, meaning there is an extra round of crypto happening at server…..

                                                                          I'd guess that the original benchmark was done with aesni.ko loaded, hence the low crypto performance. Without aesni.ko I benchmark just about exactly 160Mbps on that hardware…

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • V
                                                                            VAMike last edited by

                                                                            @spon901:

                                                                            I made following tests.  I connect a i5 laptop and a RK3288 based linux box to a vlan switch.  The RK3288 is used as a vlan router. On Laptop I runned a speed test through this router. and I obtain 300M/150M which is what provider offer.
                                                                            Running the above test command I got :
                                                                            For RK3288  27 sec which mean 118.5Mbps
                                                                            For I5 Laptop 6 sec which mean 533 Mbps.

                                                                            So I expect a throughput of around 120Mbps .  However insialling openwrt on both RK3288 box and I5 laptop, performing same test I have only 32Mbps/43Mbps.  Why so big difference comparative with theoeretical speed of 120Mbps

                                                                            Do I understand correctly that you changed the OS after running the benchmark? Try running the benchmark on the OS you're using for the test.

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • S
                                                                              spon901 last edited by

                                                                              No,  was the same OS .  I did not change anything.  Just test  directly and the immediately run same test through openvpn. The again run same test directly just to be sure.  The results are :

                                                                              Directly 300/150, through vpn 32/43.

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • ?
                                                                                Guest last edited by

                                                                                @spon901:

                                                                                The measurement above using command:
                                                                                time openvpn –test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc

                                                                                seem to be total innacurate.

                                                                                I made following tests.  I connect a i5 laptop and a RK3288 based linux box to a vlan switch.  The RK3288 is used as a vlan router. On Laptop I runned a speed test through this router. and I obtain 300M/150M which is what provider offer.
                                                                                Running the above test command I got :
                                                                                For RK3288  27 sec which mean 118.5Mbps
                                                                                For I5 Laptop 6 sec which mean 533 Mbps.

                                                                                So I expect a throughput of around 120Mbps .  However insialling openwrt on both RK3288 box and I5 laptop, performing same test I have only 32Mbps/43Mbps.  Why so big difference comparative with theoeretical speed of 120Mbps

                                                                                OpenWRT is Linux based and not BSD based! This at first. But you will be also getting total
                                                                                other results if you take on both sides Intel Core i5 CPUs and or i7 CPUs. And theoretical
                                                                                you could do a test on the same devices for OpenSSL likes many others are doing, but
                                                                                what you get then out as a result in the real life you should know, is totally another thing!

                                                                                This numbers even can be and will be different pending on the;
                                                                                used hardware (horse power), devices it self and topology of the network or done test.

                                                                                And pease don´t forget that you will need more horse power such OpenWRT is needing,
                                                                                but on the other side you get then not only a small router, you might be able to set up until
                                                                                a fully UTM device if needed.

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • D
                                                                                  Dalsland last edited by

                                                                                  Here is my benchmark for

                                                                                  Intel J1900 Quad Core 4x2GHz
                                                                                  Network 4*Intel WG82583
                                                                                  Eglobal Fanless Mini PC

                                                                                  [2.3.2-RELEASE][admin@pfSense.localdomain]/root: time openvpn --test-crypto --secret /tmp/secret --verb 0 --tun-mtu 20000 --cipher aes-256-cbc
                                                                                  30.309u 0.023s 0:30.35 99.9%    742+177k 0+0io 0pf+0w
                                                                                  
                                                                                  

                                                                                  30s = 106 Mbps according to the calculation.

                                                                                  "Real world"  performance:
                                                                                  I have a 100/100 connection

                                                                                  No VPN

                                                                                  VPN

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • M
                                                                                    mauroman33 last edited by

                                                                                    @spon901:

                                                                                    No,  was the same OS .  I did not change anything.  Just test  directly and the immediately run same test through openvpn. The again run same test directly just to be sure.  The results are :

                                                                                    Directly 300/150, through vpn 32/43.

                                                                                    Don't you have doubt that it could be related to your VPN provider?

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post