<![CDATA[Hardware encryption on Netgate 3100 with pfSense Plus 23.01, using OpenVPN]]>Yesterday I upgraded a Netgate 3100 at a customer. Had to apply that one fix with the modules, and upgrade packages, otherwise it went OK.

Now I wanted to check for crypto. Did the setting for crypto disappear with this upgrade?

The dashboard tells me: "Hardware crypto AES-CBC,SHA1,SHA256"

The main OpenVPN server we run looks like this:

Data Ciphers: AES-256-GCM
Digest: SHA256
D-H Params: 2048 bits

Does that mean we don't use hardware crypto currently? To me it looks like that.

Ah, and even inside the ovpn-server config I have "No Hardware Crypto Acceleration". And only three AES-xxx-CBC ciphers to choose with hw crypto.
I was quite sure to have enabled hw crypto when setting this up. Maybe something changed, maybe I was wrong.

]]>https://forum.netgate.com/topic/178242/hardware-encryption-on-netgate-3100-with-pfsense-plus-23-01-using-openvpnRSS for NodeSat, 18 Apr 2026 06:41:07 GMTFri, 24 Feb 2023 09:13:12 GMT60<![CDATA[Reply to Hardware encryption on Netgate 3100 with pfSense Plus 23.01, using OpenVPN on Fri, 24 Feb 2023 18:58:50 GMT]]>@mcury Oh, interesting (and sad).

I was able to enable CBC ciphers in the OpenVPN server and choose hw crypto for that as well. Can't tell if it works though. We will test and monitor CPU load etc for a check.

]]>https://forum.netgate.com/post/1090070https://forum.netgate.com/post/1090070Fri, 24 Feb 2023 18:58:50 GMT<![CDATA[Reply to Hardware encryption on Netgate 3100 with pfSense Plus 23.01, using OpenVPN on Fri, 24 Feb 2023 18:57:28 GMT]]>@gandalf33 No DCO enabled yet, no.

]]>https://forum.netgate.com/post/1090069https://forum.netgate.com/post/1090069Fri, 24 Feb 2023 18:57:28 GMT<![CDATA[Reply to Hardware encryption on Netgate 3100 with pfSense Plus 23.01, using OpenVPN on Fri, 24 Feb 2023 12:06:18 GMT]]>@sgw It seems that openvpn is no longer accelerated by the SG-3100 crypto engine.

You can read more about it at:
https://forum.netgate.com/topic/171261/openvpn-and-sg-3100-crypto-support/7
https://www.mail-archive.com/freebsd-stable@freebsd.org/msg136970.html

]]>https://forum.netgate.com/post/1089943https://forum.netgate.com/post/1089943Fri, 24 Feb 2023 12:06:18 GMT<![CDATA[Reply to Hardware encryption on Netgate 3100 with pfSense Plus 23.01, using OpenVPN on Fri, 24 Feb 2023 12:05:16 GMT]]>Have you enabled DCO ? DCO requires GCM which your hardware crypto doesn't handle.

]]>https://forum.netgate.com/post/1089942https://forum.netgate.com/post/1089942Fri, 24 Feb 2023 12:05:16 GMT