Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense hardware for home router - OpenVPN performance

    Scheduled Pinned Locked Moved Hardware
    110 Posts 30 Posters 63.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      belt9
      last edited by

      @VAMike:

      @stephenw10:

      I guess it all depends on what your expected traffic is. Yeah if you're mostly using https and netflx then maybe not worth it. I've never actually tried to measure the overhead introduced though.

      If the bulk of your traffic isn't encrypted or already compressed, then you've got a very, very unusual traffic profile. If someone's transferring huge quantities of uncompressed text over http, then sure, they should enable link compression.

      This assumes you're just using the connection to do normal browsing and internet usage, i.e., an OpenVPN Client. What about the OpenVPN server. Where I connect to my home or work network from afar, often with a sub-optimal connection and transfer all kinds of files and data (much of it un-encrypted) from my home network to my laptop. This is where LZOv2 is useful.

      1 Reply Last reply Reply Quote 0
      • N
        n3by
        last edited by

        why not use adaptive compression and let OVPN to decide when to use it or not ?

        ovpn.png
        ovpn.png_thumb

        1 Reply Last reply Reply Quote 0
        • B
          belt9
          last edited by

          no real reason when it comes to actual day to day usage you would notice.

          1 Reply Last reply Reply Quote 0
          • V
            VAMike
            last edited by

            @belt9:

            @VAMike:

            @stephenw10:

            I guess it all depends on what your expected traffic is. Yeah if you're mostly using https and netflx then maybe not worth it. I've never actually tried to measure the overhead introduced though.

            If the bulk of your traffic isn't encrypted or already compressed, then you've got a very, very unusual traffic profile. If someone's transferring huge quantities of uncompressed text over http, then sure, they should enable link compression.

            This assumes you're just using the connection to do normal browsing and internet usage, i.e., an OpenVPN Client. What about the OpenVPN server. Where I connect to my home or work network from afar, often with a sub-optimal connection and transfer all kinds of files and data (much of it un-encrypted) from my home network to my laptop. This is where LZOv2 is useful.

            I can't even think of what connections on my home network would consist of very much uncompressed data by volume. Video is compressed, pictures are compressed, documents are compressed. There'd be some uncompressed html & source code, but that would be such a small fraction of traffic as to be negligible. Again, if you really do have an overwhelming workload of uncompressed data then sure it makes sense to compress it. (Although I'd look at doing that somewhere else than the edge in the VPN client, personally–by spreading out the compression work to other places you'll be doing less in the single threaded bottlenecked openvpn process.) But for most people that's not the case, and the compression is just adding overhead with no real benefit.

            1 Reply Last reply Reply Quote 0
            • V
              VAMike
              last edited by

              @ecfx:

              why not use adaptive compression and let OVPN to decide when to use it or not ?

              So the way that works is to compress everything, then look at it, decide whether the compression ratio is good enough, stop compressing for a bit if not, then repeat that cycle. All of which happens inside the single openvpn process that doesn't scale particularly well. The only reason to bother with that is if you expect that it'll be useful at least some of the time. A few years ago I'd typically see at least 60% of traffic on an internet link be HTTP, with plain text making up a good portion of that. Now it's more common to see 60+% HTTPS by volume (not compressible) and most of the remaining HTTP is either protocol compressed or consists of images or other incompressible data. At any rate, it's not really a matter of guessing: the openvpn client status log can tell you the compression ratio you're actually getting. :)

              1 Reply Last reply Reply Quote 0
              • Y
                yogibo
                last edited by

                @denova:

                The reason for this is that the Flash based speedtest.net tool does not account for LZO compression, which is built into the  OpenVPN protocol.

                did you try beta.speedtest.net I believe that doesn't use flash.

                I have i3-7350K and I tried disabling compression and it didn't seem to make a difference, I am able to hit around 700mbs to 800mbs.  Maybe i'm not disabling it correctly.

                1 Reply Last reply Reply Quote 0
                • B
                  belt9
                  last edited by

                  Yeah we aren't talking about any noticeable difference with compression on or off. That's why pretty much everyone turns out on. You won't notice the difference if you turn it off.

                  1 Reply Last reply Reply Quote 0
                  • F
                    Fuego
                    last edited by

                    Hi guys, new to the pfSense world  :)

                    I got a j3355b-itx coming in the mail this weekend, which I will be mainly using as VPN server for remote access.

                    From what I have seen, these speeds are as OpenVPN clients. Has anyone done any speed test as OpenVPN serer for remote access?

                    My current router tops at around 30Mbps (as vpn server), I'm hoping to achieve at least 150Mbps using the j3355b on gigabit connection.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      There is no significant difference between client and server modes for OpenVPN. There may be a difference between encrypting and decrypting but that depends of which direction the majority of your traffic is going. It too though is not something I've seen as significant. You should be able to push 100Mbps+ with that I would expect. Let us know your results.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • F
                        Fuego
                        last edited by

                        @stephenw10:

                        .. Let us know your results.

                        Steve

                        Will do. Thanks

                        1 Reply Last reply Reply Quote 0
                        • M
                          mauroman33
                          last edited by

                          @Fuego:

                          Hi guys, new to the pfSense world  :)

                          I got a j3355b-itx coming in the mail this weekend, which I will be mainly using as VPN server for remote access.

                          From what I have seen, these speeds are as OpenVPN clients. Has anyone done any speed test as OpenVPN serer for remote access?

                          My current router tops at around 30Mbps (as vpn server), I'm hoping to achieve at least 150Mbps using the j3355b on gigabit connection.

                          From opening post:

                          Intel Celeron J3355 2x2GHz        -TDP 10W -CPU Mark 1333 -Single Thread  884
                          3200/10,9 =  293 Mbps OpenVPN performance (estimate)

                          1 Reply Last reply Reply Quote 0
                          • D
                            digitalgimpus
                            last edited by

                            @mauroman33:

                            From opening post:

                            Intel Celeron J3355 2x2GHz        -TDP 10W -CPU Mark 1333 -Single Thread  884
                            3200/10,9 =  293 Mbps OpenVPN performance (estimate)

                            Waiting for the chassis to arrive so I can set mine up and upgrade… IMHO for the price it's pretty impressive performance.

                            1 Reply Last reply Reply Quote 0
                            • F
                              Fuego
                              last edited by

                              Just finished putting my box together.

                              • J3355B-ITX
                              • 2 x (2GB) DDR3L 1600
                              • 5400 rpm drive
                              • Dual port Intel Pro /1000
                              • Antec ISK300-150 Case

                              All default settings…

                              Best I got I was 100Mbps down 232Mbps up.

                              I'll start playing with settings soon...

                              vpn_j3355b.PNG
                              vpn_j3355b.PNG_thumb

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Hmm, I would not have expected such a big difference there.

                                Are you seeing any errors on the WAN interface itself?

                                Do you have fast-io set or send/rec buffers increased? There are knobs for that in the gui in 2.4, you have to add them as custom settings in 2.3.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • B
                                  belt9
                                  last edited by

                                  @Fuego:

                                  Just finished putting my box together.

                                  • J3355B-ITX
                                  • 2 x (2GB) DDR3L 1600
                                  • 5400 rpm drive
                                  • Dual port Intel Pro /1000
                                  • Antec ISK300-150 Case

                                  All default settings…

                                  Best I got I was 100Mbps down 232Mbps up.

                                  I'll start playing with settings soon...

                                  hmmm, somethings definitely wrong here, others have reported faster speeds on that cpu without even maxing out yet.

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    Fuego
                                    last edited by

                                    @stephenw10:

                                    Hmm, I would not have expected such a big difference there.

                                    Are you seeing any errors on the WAN interface itself?

                                    Do you have fast-io set or send/rec buffers increased? There are knobs for that in the gui in 2.4, you have to add them as custom settings in 2.3.

                                    Steve

                                    That was with default settings right after installing pfSense.

                                    Still haven't got a chance read on wiki for tweaks, but added:

                                    fast-io
                                    sndbuf 524288
                                    rcvbuf 524288

                                    under VPN custom options, I was able to get 198Mbps down 234Mbps up. CPU was around 60%.

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      No errors on WAN I assume then?

                                      That's a significant improvement! Still a bigger difference between down and up then I'd expect though.

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        denova
                                        last edited by

                                        @yogibo:

                                        @denova:

                                        The reason for this is that the Flash based speedtest.net tool does not account for LZO compression, which is built into the  OpenVPN protocol.

                                        did you try beta.speedtest.net I believe that doesn't use flash.

                                        I have i3-7350K and I tried disabling compression and it didn't seem to make a difference, I am able to hit around 700mbs to 800mbs.  Maybe i'm not disabling it correctly.

                                        Hmm, you might be correct. I just tried the beta version and still reached 765 Mbps regardless of compression. Maybe its not the compression after all.

                                        I think it's safe to say you can reach around 750 Mbps with OpenVPN on PIA with a G4400 processor (a $50 chip!). It might be the sweet spot for anyone with a 1000 mbit connection, unless you're trying to reach 900 or something but I'm not quite sure the CPU is the bottleneck for that.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          The fact it's flash based should make no difference there. The only thing that matters is what their test data is, if it's compressible.

                                          That's an impressive result if you're seeing that without compression. Both in terms of the CPU's ability and PIAs.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            denova
                                            last edited by

                                            @stephenw10:

                                            The fact it's flash based should make no difference there. The only thing that matters is what their test data is, if it's compressible.

                                            That's an impressive result if you're seeing that without compression. Both in terms of the CPU's ability and PIAs.

                                            Steve

                                            Well, the incorrect accounting for LZO is often connected to some speedtests using Flash. For example here: "it is very important to note that using flash-based speed tests like speedtest.net are unrealible for VPN services. This is because VPN services use compression to increase the speed that data flows across the network. Some flash based speed test servers do not properly account for this" (https://vikingvpn.com/speed). More in general it might not be Flash that's the issue, but for speedtest.net its a problem apparently.

                                            But quite happy indeed, especially as I'm using some refurbished Lenovo M700 SFF with a Chinese Ebay Intel I350-T4. Great job for pfsense as well, its unfortunate they switched off the donations.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.