Netgate Store

Author Topic: pfSense hardware for home router - OpenVPN performance  (Read 28828 times)

0 Members and 1 Guest are viewing this topic.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 186
  • Karma: +24/-0
    • View Profile
pfSense hardware for home router - OpenVPN performance
« on: July 25, 2016, 06:55:28 am »
I read several questions about what hardware to build an home router and many people here seem to be interested in surfing through an OpenVPN client, so I performed that simple OpenVPN benchmark on different hardware:
https://forum.pfsense.org/index.php?topic=105238.msg616743#msg616743 (Reply #9 message)

The features of all these CPUs come from www.cpubenchmark.net

Only the Celeron J1900, in this group, does not support the AES-NI instructions to improve the speed in encryption and decryption.

Here the results:

Intel Celeron N3150 4x1.6GHz    -TDP 6W  -CPU Mark 1642 -Single Thread  456
3200/27,5 = 116 Mbps OpenVPN performance (estimate)

Intel Celeron J1900 4x2GHz        -TDP 10W -CPU Mark 1881 -Single Thread  528
3200/36,5 =  88 Mbps OpenVPN performance (estimate)

AMD A10-7300 APU 4x1.9GHz    -TDP 19W -CPU Mark 3032 -Single Thread 1017
3200/12,5 = 256 Mbps OpenVPN performance (estimate)

Intel i7-4500U 2x1.8GHz            -TDP 15W -CPU Mark 3795 -Single Thread 1578
3200/10,7 = 299 Mbps OpenVPN performance (estimate)

Intel i7-4790S 4x3.2GHz            -TDP 65W -CPU Mark 9631 -Single Thread 2261
3200/9,6 =   333 Mbps OpenVPN performance (estimate)

Intel Celeron J3355 2x2GHz        -TDP 10W -CPU Mark 1333 -Single Thread  884
3200/10,9 =  293 Mbps OpenVPN performance (estimate)

Test about i7-4500U was taken from Paint in his tread:
https://forum.pfsense.org/index.php?topic=113610.30

Test about Celeron J3355 was taken from pfBasic here:
https://forum.pfsense.org/index.php?topic=105238.msg709164#msg709164

In the real world, I found the same test values either through some speed test websites either in the download of some large files.

Feel free to add your hardware's score.
« Last Edit: September 19, 2017, 12:55:52 am by mauroman33 »

Offline Pippin

  • Full Member
  • ***
  • Posts: 264
  • Karma: +24/-3
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #1 on: July 25, 2016, 07:27:56 am »
Very much doubt these calculations or any....., to much variables to make a good estimate that will reflect reality.
Cipher, digest, hash, compression, mtu, buffersizes, network, latency, etc. all play a role.
And also the type of data that goes through the tunnel.

Quote
Intel Celeron N3150 4x1.6GHz    -TDP 6W  -CPU Mark 1642 -Single Thread  456
3200/27,5 = 116 Mbps OpenVPN performance (estimate)

As argument, with N3150 (Gigabyte N3150N-D3V), I can tell you that in a client to client Iperf test, I was getting 160 Mbit/s throughput, I used:
No crypto hardware selected (meaning AES-NI will be used automatically if it`s supported, N3150 does)
no compression
DH 2048
AES-256-CBC
SHA512
prng SHA512 32 #(prng_hash = 'RSA-SHA512'/prng_nonce_secret_len = 32)
cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384/2048 bit RSA

As you can see, with these somewhat "heavier" settings it is higher then the calculated 116 Mbit/s.

Furthermore, keep in mind that this was client to client, meaning there is an extra round of crypto happening at server.....
« Last Edit: July 25, 2016, 07:42:39 am by Pippin »
2.3.2-RELEASE (amd64) - GB N3150N-D3V
"There must be someone with intelligence in the party"
"Well, that rules you out Pippin"

Offline Paint

  • Full Member
  • ***
  • Posts: 211
  • Karma: +32/-2
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #2 on: July 25, 2016, 09:09:40 am »
Since I read many information requests about the hardware to build an home router and several people seem interested in surfing through an OpenVPN client, I have performed on different hardware the simple OpenVPN benchmark referenced here:
https://forum.pfsense.org/index.php?topic=105238.msg616743#msg616743 (Reply #9 message)

The features of these CPUs come from www.cpubenchmark.net

The only CPU in the group that does not support AESNI instructions is the Celeron J1900.

These are the results:

Intel Celeron N3150 4x1.6GHz    -TDP 6W  -CPU Mark 1642 -Single Thread  456
3200/27,5 = 116 Mbps OpenVPN performance (estimate)

Intel Celeron J1900 4x2GHz        -TDP 10W -CPU Mark 1881 -Single Thread  528
3200/36,5 =  88 Mbps OpenVPN performance (estimate)

AMD A10-7300 APU 4x1.9GHz    -TDP 19W -CPU Mark 3032 -Single Thread 1017
3200/12,5 = 256 Mbps OpenVPN performance (estimate)

Intel i7-4500U 2x1.8GHz            -TDP 15W -CPU Mark 3795 -Single Thread 1578
3200/10,7 = 299 Mbps OpenVPN performance (estimate)

Intel i7-4790S 4x3.2GHz            -TDP 65W -CPU Mark 9631 -Single Thread 2261
3200/9,6 =   333 Mbps OpenVPN performance (estimate)


The test about i7-4500U was taken from Paint in its tread:
https://forum.pfsense.org/index.php?topic=113610.30

Jumping from theory to practice, with my router (Celeron N3150) I found the same values in speed test websites or in downloading large files.

Feel free to add the results of your hardware and grow this database.

please note that test for the Intel i7-4500U test, I was running at cMAX locked - therefore my processor was running in Turbo mode at 3.0ghz and with hyperthreading.
pfSense i7-4510U + 2x Intel 82574 + 2x Intel i350 Mini-ITX Build
940/880 mbit Fiber Internet from FiOS
Dell PowerConnect 2716 Gigabit Switch
Netgear R8000 AP (DD-WRT)
Asus RT-66U AP (DD-WRT)


Offline mauroman33

  • Full Member
  • ***
  • Posts: 186
  • Karma: +24/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #3 on: July 25, 2016, 12:02:40 pm »
I agree with Pippin that this is not a gospel.

My intention is to have a rough estimate for a connection via OpenVPN.

In my city, most areas are connected to 50mbs, only a few come to 100Mbs, from this point of view can be useful to know what is the minimum hardware to fully exploit this connection speed.

In my case (fiber 100) Celeron N3150 meets all requirements.

I tried in another city with a fiber connection 250 and I found that the maximum download speed of 125Mbs download is fairly consistent with the test results, so in this case I would have to buy a CPU as that used by Paint.

I used PIA and this is the connection log:

Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
Data Channel Encrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
Data Channel Decrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
Control Channel: TLSv1.2, cipher TLSv1 / SSLv3 DHE-RSA-AES256-SHA, RSA 4096 bit

Offline Pippin

  • Full Member
  • ***
  • Posts: 264
  • Karma: +24/-3
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #4 on: July 25, 2016, 01:33:07 pm »
Thanks for this info, it has more value then theoretical calculation in my eyes ;)
Since I have no fast ISP connection available here this practical info is very helpful.

In my city, most areas are connected to 50mbs, only a few come to 100Mbs, from this point of view can be useful to know what is the minimum hardware to fully exploit this connection speed.
In my case (fiber 100) Celeron N3150 meets all requirements.
Yes, that is a good thinking, one could also think about the future when upgrading to faster line speed, needing more overhead on your pfS box.

Quote
I tried in another city with a fiber connection 250 and I found that the maximum download speed of 125Mbs download is fairly consistent with the test results, so in this case I would have to buy a CPU as that used by Paint.
You mean you put pfS box as client to PIA?
Then maybe PIA is not giving you more? Or you have tested with a PC too and get more then 125 Mbit/s on that 250 Mbit/s line?
Also running more packages can decrease speed.

Quote
I used PIA and this is the connection log:

Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
Data Channel Encrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256-bit key
Data Channel Decrypt: Using 256-bit message hash 'SHA256' for HMAC authentication
Control Channel: TLSv1.2, cipher TLSv1 / SSLv3 DHE-RSA-AES256-SHA, RSA 4096 bit
What compression does PIA use and what type of data was being downloaded?

I find online speedtests somewhat unreliable/inconsistent. Before you know it the speed to PIA is being measured instead of to you.
Some time ago I used speedtest.net and found my download/upload speed being higher then my line speed  :)

My writing is no gospel either, I found the following from trying and asking questions as why?
A better/more reliable way I found is to download a incompressible binary/zip/rar file from a fixed location/server near me.

Why incompressible?
Attached images show how compression can "mislead" measurements.
I connect through OpenVPN to my NAS in another country and then download from fixed locations.
My line speed (to NAS) is a practical whopping 9,5 Mbit/s down and 2,1 Mbit/s up  :)
The line speed of NAS location is 50 Mbit/s symmetric, so NAS pulls in data more quickly.
Yet, you can see in four cases I`m getting down speed above 9,5 Mbit/s.
The reason is because those four files are compressible and the one giving 8,56 Mbit/s is not.


Sorry for the long post and if my questions are too much just tell  ;D

2.3.2-RELEASE (amd64) - GB N3150N-D3V
"There must be someone with intelligence in the party"
"Well, that rules you out Pippin"

Offline mauroman33

  • Full Member
  • ***
  • Posts: 186
  • Karma: +24/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #5 on: July 25, 2016, 02:27:51 pm »
Hello Pippin,
thanks for the reply. More info make more useful a tread.  ;)
I brought the mini PC with the pfSense installation in a different city.
The available speed was about 280Mbs without VPN and about 125Mbps connected to the PIA server.
In the PIA connection I kept the compression disabled and I downloaded some big ISO files and several torrent files.
« Last Edit: July 25, 2016, 02:31:14 pm by mauroman33 »

Offline CiscoX

  • Jr. Member
  • **
  • Posts: 32
  • Karma: +2/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #6 on: August 25, 2016, 02:13:55 pm »
Hi,

Here is my results:

Intel i5-6400 4x2.7GHz            -TDP 65W -CPU Mark 6530 -Single Thread 1827
3200/9,89 =   323 Mbps OpenVPN performance (estimate)
Intel i5-7400
8GB DDR4 2133Mhz
Samsung SSD 120

Offline ecfx

  • Full Member
  • ***
  • Posts: 227
  • Karma: +31/-15
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #7 on: August 25, 2016, 02:31:15 pm »
Intel E8400 -   3200 / 15.68 (real) => 201 Mbps OpenVPN performance (estimate)
Intel E8500 -   3200 / 15.17 (real) => 210 Mbps OpenVPN performance (estimate)

New system tested:

Intel Xeon E5320 -   3200 / 27.41 (real) => 116 Mbps OpenVPN performance (estimate)
« Last Edit: August 28, 2016, 04:16:48 am by n3by »

Offline garyd9

  • Full Member
  • ***
  • Posts: 140
  • Karma: +15/-12
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #8 on: August 25, 2016, 09:21:13 pm »
If it helps someone...

Intel(R) Atom(TM) CPU C2558 @ 2.40GHz

(timings averaged over 3 runs, but they never varied more than .1 sec)

(with aesni.ko loaded):  3200/24.03 = 133.17
(with aesni.ko unloaded):  3200 / 23.58 = 135.71

The reason for doing it with and without aesni.ko is Pippin's observation in this thread:  https://forum.pfsense.org/index.php?topic=115627.msg646399#msg646399

(Not sure what kind of influence RAM might have in this test, so I guess I should include that my memory is PC3-12800 ECC CL11)

Offline mauroman33

  • Full Member
  • ***
  • Posts: 186
  • Karma: +24/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #9 on: August 26, 2016, 02:12:33 am »
Thanks to CiscoX, n3by and garyd9 for sharing their test results!  ;)

As one of the reasons I started this thread was also to find a device capable of adapting to a future growth speed of my home connection from 100Mbs to 250Mbs, I want to share the possibility to combine in a Gateway Group two or more VPN client connections, as highlighted here by M_Devil:
https://forum.pfsense.org/index.php?topic=115992.msg647068#msg647068

Because OpenVPN it is not scalable
https://www.clearos.com/resources/documentation/clearos/content:en_us:kb_o_openvpn_performance
this kind of configuration, used to improve the connection speed, depends on how many cores are in the CPU.

If anyone else has a chance to try this configuration, please let us know!

« Last Edit: August 26, 2016, 05:27:07 am by mauroman33 »

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 433
  • Karma: +27/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #10 on: August 27, 2016, 07:12:45 pm »
Wanted to chime in with my real world results and my theoretical results.  Running an AMD Sempron 2650. This is a dual core 1.45GHz Kabini part with AES-NI.  My theoretical results are about 92Mbps.  Real world gets me about 80Mbps give or take.  This is with AES-256-CBC on PIA tunnels.  FWIW. 
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 186
  • Karma: +24/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #11 on: August 28, 2016, 01:27:25 am »
Hi whosmatt, what is the speed of your line?
Because you're using PIA that allows five concurrent connections, maybe you could try to use two VPN client in the same time to improve your speed connection, as highlighted in the previous message.

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 433
  • Karma: +27/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #12 on: August 28, 2016, 02:56:19 pm »
Hi whosmatt, what is the speed of your line?
Because you're using PIA that allows five concurrent connections, maybe you could try to use two VPN client in the same time to improve your speed connection, as highlighted in the previous message.

My line is nominally 150Mbps, tests at about 160Mbps.  I can try multiple connections for sure.  Will post the results.  I'm thinking of upgrading my setup anyway; didn't buy it originally for pfSense; just kind of worked out that way.   I can either drop in an Athlon 5350 (4 cores 2.05 GHz) or 5370 (4 cores 2.2GHz) or bring the AMD setup back to my HTPC (where it started) and buy something entirely different for pfSense.  Oh, the possibilities (and the $$)
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 186
  • Karma: +24/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #13 on: August 28, 2016, 04:42:40 pm »
My line is nominally 150Mbps, tests at about 160Mbps.  I can try multiple connections for sure.  Will post the results.  I'm thinking of upgrading my setup anyway; didn't buy it originally for pfSense; just kind of worked out that way.   I can either drop in an Athlon 5350 (4 cores 2.05 GHz) or 5370 (4 cores 2.2GHz) or bring the AMD setup back to my HTPC (where it started) and buy something entirely different for pfSense.  Oh, the possibilities (and the $$)

Yes please, let us know the results.
About these two Athlon I would expect results not far from what I got with my A10-7300, that was 256Mbs.
I believe this can be an excellent value for money choice.

Offline DestructionIce

  • Newbie
  • *
  • Posts: 3
  • Karma: +1/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #14 on: August 29, 2016, 10:03:34 am »
In this group only the Celeron J1900 does not support the AES-NI instructions to improve the speed of applications performing encryption and decryption.

Here are the results:

Intel Celeron J1900 4x2GHz        -TDP 10W -CPU Mark 1881 -Single Thread  528
3200/36,5 =  88 Mbps OpenVPN performance (estimate)


I'd love to get close to these results. With my J1900 based 2.3.2 box I only pull 5Mbps in real world tests. Surely it must be a setup issue. I'm using 256 aes cbc with ip vanish. I could be an issue with ip vanish, too.

I was going to start a new thread about this, but since this is a benchmark thread, I figured I would ask if there are any generic settings to optimize the openvnc client? I don't want to hijack this thread but was curious if I'm missing something you pfsense veterans are doing since I'm quite new to it.