Netgate SG-1000 microFirewall

Author Topic: pfSense hardware for home router - OpenVPN performance  (Read 25185 times)

zzroot and 1 Guest are viewing this topic.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #15 on: August 29, 2016, 12:25:52 pm »
I don't have any problems to get close to the full speed of my 100Mbps line with IPVanish. Later I'll post my configuration

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #16 on: August 29, 2016, 03:26:49 pm »
I'd love to get close to these results. With my J1900 based 2.3.2 box I only pull 5Mbps in real world tests. Surely it must be a setup issue. I'm using 256 aes cbc with ip vanish. I could be an issue with ip vanish, too.

I was going to start a new thread about this, but since this is a benchmark thread, I figured I would ask if there are any generic settings to optimize the openvnc client? I don't want to hijack this thread but was curious if I'm missing something you pfsense veterans are doing since I'm quite new to it.

Here are the print screens of the settings and the custom options:

explicit-exit-notify 2;
ifconfig-nowarn;
tls-client;
persist-key;
persist-tun;
remote-cert-tls server;
reneg-sec 0;
auth-nocache;
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384;
fast-io;
sndbuf 524288;
rcvbuf 524288

Offline DestructionIce

  • Newbie
  • *
  • Posts: 3
  • Karma: +1/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #17 on: August 29, 2016, 09:57:46 pm »
Thank you so much!  I had a few different settings.  LZO Compression on and:

fast-io;
tun-mtu 1500;
persist-key;
persist-tun;
persist-remote-ip;
auth SHA256;
keysize 256;
tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
AES256-SHA

With your advanced settings, I'm getting line speed (100Mbps)! Cheers!

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 433
  • Karma: +27/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #18 on: August 29, 2016, 10:05:20 pm »
Thank you so much!  I had a few different settings.  LZO Compression on and:

fast-io;
tun-mtu 1500;
persist-key;
persist-tun;
persist-remote-ip;
auth SHA256;
keysize 256;
tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
AES256-SHA

With your advanced settings, I'm getting line speed (100Mbps)! Cheers!

Can you report on exactly what you changed?  Is the config you just posted your current config?  Thanks!
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #19 on: August 30, 2016, 02:01:43 am »
Thank you so much!  I had a few different settings.  LZO Compression on and:

fast-io;
tun-mtu 1500;
persist-key;
persist-tun;
persist-remote-ip;
auth SHA256;
keysize 256;
tls-cipher DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:
AES256-SHA

With your advanced settings, I'm getting line speed (100Mbps)! Cheers!

Glad to help you.
I do not see big differences in the custom options, except for the tls-cipher line ... I have some doubts if its syntax is correct because I always used it with "WITH" like here
https://community.openvpn.net/openvpn/ticket/304
I also used compression, but I had not noticed any change in the connection speed.
« Last Edit: August 30, 2016, 02:05:01 am by mauroman33 »

Offline Scampicfx

  • Jr. Member
  • **
  • Posts: 35
  • Karma: +1/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #20 on: August 30, 2016, 05:08:22 am »
If it helps someone...

Intel(R) Atom(TM) CPU C2558 @ 2.40GHz

(timings averaged over 3 runs, but they never varied more than .1 sec)

(with aesni.ko loaded):  3200/24.03 = 133.17
(with aesni.ko unloaded):  3200 / 23.58 = 135.71

Dear garyd9,

thanks for your tests!

Just to get it right: This means C2558 gets a OpenVPN throughput of around 130 Mbit/s?

Right now I'm trying to make a decision between C2358, C2558, C2758, Xeon D-1518...
Basically, all I need is 500 Mbit/s WAN throughput and around 100 Mbit/s OpenVPN throughput. I would like to use snort.
But the most important point to me right now is to have a stable OpenVPN throughput of 100 Mbit/s...

I'm wondering if a C2358 will accomplish this performance as well?
Since OpenVPN is single-threaded, afaik, a C2358 may have nearly the same openvpn performance as the c2558?

EDIT: Well, I just see, there is a big difference in base clock rate... 1,7 GHz vs. 2,4 GHz... So I think the C2358 won't be able to run 100 Mbit/s OpenVPN throughput? According to other threads the OpenVPN throughput of C2358 is somewhere at 70 Mbit/s. Is that correct?
« Last Edit: August 30, 2016, 05:19:57 am by Scampicfx »

Offline garyd9

  • Full Member
  • ***
  • Posts: 140
  • Karma: +13/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #21 on: August 30, 2016, 07:57:27 am »
Just to get it right: This means C2558 gets a OpenVPN throughput of around 130 Mbit/s?
Theoretically.  Real world performance would vary.

I'm wondering if a C2358 will accomplish this performance as well?
Since OpenVPN is single-threaded, afaik, a C2358 may have nearly the same openvpn performance as the c2558?

EDIT: Well, I just see, there is a big difference in base clock rate... 1,7 GHz vs. 2,4 GHz... So I think the C2358 won't be able to run 100 Mbit/s OpenVPN throughput? According to other threads the OpenVPN throughput of C2358 is somewhere at 70 Mbit/s. Is that correct?
I don't run openvpn.  I just ran the test proposed by the OP and posted the results.  However, based on the differences between the C2358 and C2558, I'd guess that the 2358 would have a difficult time getting to 100 megabit/sec openvpn performance. 

Offline DestructionIce

  • Newbie
  • *
  • Posts: 3
  • Karma: +1/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #22 on: August 30, 2016, 09:25:09 am »
Can you report on exactly what you changed?  Is the config you just posted your current config?  Thanks!

The changes I made were to disable lzo compression and use mauroman33's custom options. Like he mentioned the main difference in that is the "tls-cipher" line it would seem.

I also made sure to turn off any crypto hardware "assistance" options I may have fiddled with. Most were already disabled, but I did play around with using "RDRAND", so I had to disable that again.

My overall config isn't exactly like his screen shots, though.  I tick the boxes to disable addition of routes to the route table and handle those with AON.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #23 on: August 30, 2016, 09:43:01 am »
Can you report on exactly what you changed?  Is the config you just posted your current config?  Thanks!

The changes I made were to disable lzo compression and use mauroman33's custom options. Like he mentioned the main difference in that is the "tls-cipher" line it would seem.

I also made sure to turn off any crypto hardware "assistance" options I may have fiddled with. Most were already disabled, but I did play around with using "RDRAND", so I had to disable that again.

My overall config isn't exactly like his screen shots, though.  I tick the boxes to disable addition of routes to the route table and handle those with AON.

The suggestion to disable the Cryptographic Hardware comes by Pippin's messages in this thread:
https://forum.pfsense.org/index.php?topic=115627.30

Offline Paint

  • Full Member
  • ***
  • Posts: 209
  • Karma: +32/-2
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #24 on: August 30, 2016, 10:21:03 am »
here are my advanced server settings:

fast-io;sndbuf 0;rcvbuf 0;push "sndbuf 524288";push "rcvbuf 524288";keepalive 10 120;push "redirect-gateway def1";push "redirect-gateway-ipv6 def1";push "route-ipv6 2000::/3";

Here are my advanced client settings:

Code: [Select]
fast-io
fragment 0
mssfix 0
sndbuf 524288
rcvbuf 524288
lport 0
remote-random
remote-cert-tls server
resolv-retry 4
key-method 2
mute 10
mute-replay-warnings
keepalive 10 120
auth-retry nointeract
setenv FORWARD_COMPATIBLE 1
verb 3
reneg-sec 0
script-security 2

Ultimately, i think we should push to change to Softether as the VPN client.  It supports backwards compatibility to OpenVPN and is much faster than OpenVPN for the same hardware. 

Here is a feature list: https://www.softether.org/1-features
« Last Edit: August 30, 2016, 10:58:10 am by Paint »
pfSense i7-4510U + 2x Intel 82574 + 2x Intel i350 Mini-ITX Build
940/880 mbit Fiber Internet from FiOS
Dell PowerConnect 2716 Gigabit Switch
Netgear R8000 AP (DD-WRT)
Asus RT-66U AP (DD-WRT)


Offline sirozha

  • Jr. Member
  • **
  • Posts: 57
  • Karma: +0/-3
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #25 on: August 30, 2016, 05:39:22 pm »
What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

Offline Paint

  • Full Member
  • ***
  • Posts: 209
  • Karma: +32/-2
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #26 on: August 30, 2016, 07:00:45 pm »
What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

While softether can be used for obsfcation, softether actually supports more corporate features than OpenVPN. It supports IPSec, VLANs, OpenVPN, etc. In addition, the code is more modern and supports  multithreaded VPN. I get comparable speeds from my Raspberry Pi running Softether VPN versus my i7 pfsense box running pfSense.

Anyway, not trying to hijack the thread. Just adding my .02
« Last Edit: August 30, 2016, 08:40:57 pm by Paint »
pfSense i7-4510U + 2x Intel 82574 + 2x Intel i350 Mini-ITX Build
940/880 mbit Fiber Internet from FiOS
Dell PowerConnect 2716 Gigabit Switch
Netgear R8000 AP (DD-WRT)
Asus RT-66U AP (DD-WRT)


Offline garyd9

  • Full Member
  • ***
  • Posts: 140
  • Karma: +13/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #27 on: August 30, 2016, 08:39:39 pm »
Ultimately, i think we should push to change to Softether as the VPN client.
Well, it's already in freeBSD ports...

Offline whosmatt

  • Sr. Member
  • ****
  • Posts: 433
  • Karma: +27/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #28 on: August 30, 2016, 08:53:40 pm »
What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

And that doesn't have any bearing on the performance numbers, which is what we're discussing here.  We're talking about the technology and performance on given hardware, not the reasons we're using it.  This discussion is directly relevant to anyone using OpenVPN, regardless of the use case.
home:  pfSense on ESXi 6.5. 2 v cores, 512MB RAM, 8GB disk.  Host is MSI AM1I, Athlon 5350, 16GB DDR3, 60GB SSD, 320GB HDD, HP NC360T NIC.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #29 on: August 31, 2016, 01:45:00 am »
What some people consider here to be VPN is quite different from what's VPN is in a corporate world. Hiding one's identity to be able to download stolen content is not the reson VPN was invented. When one lists VPN throughput to such a service, it's not what VPN's purpose is in pfSense.

Sorry mate, I don't understand. How do you know what is the reason why people are using a VPN here?
Are you maybe speaking of your personal experience?
Personally I have some good reasons to use it, starting from the systematic throttling performed by the ISP in my area if you don't use the services directly purchased from it ...
But maybe, as rightly said whosmatt, this is not the forum for this kind of discussion.
« Last Edit: August 31, 2016, 02:12:28 am by mauroman33 »