Netgate SG-1000 microFirewall

Author Topic: pfSense hardware for home router - OpenVPN performance  (Read 25593 times)

0 Members and 3 Guests are viewing this topic.

Offline VAMike

  • Sr. Member
  • ****
  • Posts: 429
  • Karma: +65/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #45 on: December 05, 2016, 07:45:40 am »
Ok, so on a non pFsense device there is no correlation between theoretical and real sped ?

The test is a heuristic, and it remains to be seen how accurate it is across a wide variety of machines. In this case I'd specifically wonder whether the abnormally large blocks used to pad the test runtime give wildly inaccurate results for off-board crypto processors. (On the RK3288, IIRC, the crypto is handled by a specific module, as in the old via padlock stuff, and those generally do much better for large blocks than small blocks because of a high fixed setup cost. On systems with onboard crypto like AES-NI for which the heuristic was initially developed, there's a much lower penalty for small blocks.) I doubt that linux vs fbsd has much to do with it.

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #46 on: December 05, 2016, 08:38:21 am »
Ok, so on a non pFsense device there is no correlation between theoretical and real sped ?

I think there is also correlation for not pfSense devices, but I don't think you could be sure to get a definitive answer on the pfSense forum.

Offline teh g

  • Jr. Member
  • **
  • Posts: 44
  • Karma: +5/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #47 on: April 12, 2017, 12:27:14 pm »
Figured I'd show my J3455 results:

Intel Celeron J3455 4x1.5GHz        -TDP 10W -CPU Mark 2134 -Single Thread  782

AES-256-CBC : 267.9 Mbps
AES-256-GCM: 282.4 Mbps

AES-128-CBC: 270.0 Mbps
AES-128-GCM: 284.9Mbps

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #48 on: July 23, 2017, 10:22:43 am »
I know it's a bit of an old topic but I'm currently looking at some pfsense hardware with openvpn capabilities as well..

As I have a 1000/1000 fiber connection, I was wondering if a kaby lake celeron 3865u (1.8 GHz, dual core) would do similar or better than a j3355 for pfsense+openvpn purposes?
« Last Edit: July 23, 2017, 10:30:44 am by denova »

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #49 on: July 23, 2017, 01:08:58 pm »
Probably pretty similar to j3355, but that's a mobile part.

Offline chrcoluk

  • Sr. Member
  • ****
  • Posts: 407
  • Karma: +22/-50
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #50 on: September 12, 2017, 10:50:28 am »
aes256 is just needlessly throwing away performance especially on CBC, I suggest sticking to aes128-gcm guys.
pfSense 2.4
Qotom Q355G4 or Braswell N3150 with Jetway mini pcie 2x intel i350 lan - 4 gig Kingston 1333 C11 DDR3L
 - 60 gig kingston ssdnow ssd - ISP Sky UK

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #51 on: September 17, 2017, 03:48:55 pm »
Figured I'd show my J3455 results:

Intel Celeron J3455 4x1.5GHz        -TDP 10W -CPU Mark 2134 -Single Thread  782

AES-256-CBC : 267.9 Mbps
AES-256-GCM: 282.4 Mbps

AES-128-CBC: 270.0 Mbps
AES-128-GCM: 284.9Mbps

Ended up with a G4400 build myself, speed with PIA using OpenVPN and AES-128-CBC is near 500 Mbps. I never see the CPU taxed above 30% though with AES-NI enabled.
 
Also, the idle power consumption for the total system is about 13 watts, which is still fine for me.
« Last Edit: September 17, 2017, 04:08:39 pm by denova »

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 12002
  • Karma: +474/-15
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #52 on: September 18, 2017, 10:11:51 am »
Nice result. I would assume one core is at 100% in those conditions?

Steve

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #53 on: September 18, 2017, 01:36:14 pm »
While using some of the tips and tricks in this topic: https://forum.pfsense.org/index.php?topic=112877.15 I was able to increase my speed to 700-800 Mbps with a Speedtest.net test using a nearby 1000 mbit server (see attached).

That's actually a lot better than I had expected. While testing, the OpenVPN WCPU goes up to a about 50% and the max one core is used is also about 50%. Is this normal? I thought OpenVPN would be harder on my processor? (3.3 Ghz G4400 Skylake processor with AES-NI enabled) I'm quite sure my VPN is working fine as the OpenVPN process is spiking and both speedtest.net and privateinternetaccess.com report my PIA ip address. The cipher used is AES-256-CBC.
« Last Edit: September 18, 2017, 04:23:44 pm by denova »

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 12002
  • Karma: +474/-15
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #54 on: September 18, 2017, 04:28:46 pm »
Hmm, that is surprisingly fast. Almost suspiciously so.

Increasing the buffers and setting fast-io can help quite a bit though. Those options are in the gui in 2.4.

Steve

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #55 on: September 18, 2017, 04:50:28 pm »
Thanks Steve. Yeah, I'm not sure what to think of it yet (1000/1000 mbit connection)

These are the settings I've used:

tls-client;
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA;
remote-cert-tls server;
persist-key;
persist-tun;
persist-remote-ip;
keysize 256;
reneg-sec 0;
link-mtu 1540;
fragment 0;
mssfix 0;
fast-io;
sndbuf 1572864;
rcvbuf 1572864;

All seemed fine in the logs until I just received this error in the OpenVPN log: 38532 tun packet too large on write (tried=1500,max=1482).
Is that bad news? Can't seem to find anything decisive about it. 
« Last Edit: September 18, 2017, 04:55:53 pm by denova »

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 12002
  • Karma: +474/-15
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #56 on: September 18, 2017, 05:03:32 pm »
There's no way the link-mtu is 1540, you should probably remove that.

I'm not sure what setting mssfix and fragment to 0 does. Probably nothing, it seems to be undefined.

When I tested locally I found increasing the send receive buffers above 512k made negligible difference.

Steve

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #57 on: September 18, 2017, 05:14:31 pm »
Think you are correct, changed to this settings:

tls-client;
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA;
remote-cert-tls server;
persist-key;
keysize 256;
reneg-sec 0;
fast-io;
sndbuf 572864;
rcvbuf 572864;

No more errors in the log but the same speed (700-800 Mbps).

EDIT: a bit too soon, a new error occurs every approx. 5 minutes: PID_ERR replay-window backtrack occurred [13] [SSL-0] [000000000000__00000000000000000000000000000000000000000000000000] 0:4803054 0:4803041 t=1505773250[0] r=[-3,64,15,13,1] sl=[22,64,64,528]. Apparently this is connected to having some packet loss while using UDP instead of TCP.   

Back on topic: apparently a G4400 is able to reach 700+ Mbps with PIA under favorable circumstances (server very close etc). 
« Last Edit: September 18, 2017, 05:36:42 pm by denova »

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #58 on: September 19, 2017, 12:53:33 am »
Hi denova, your results are really interesting.
It could be nice if you'll have the time to run test suggested in the first post. Just out of curiosity.
cheers
« Last Edit: September 19, 2017, 12:56:54 am by mauroman33 »

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #59 on: September 19, 2017, 02:51:55 am »
Hi denova, your results are really interesting.
It could be nice if you'll have the time to run test suggested in the first post. Just out of curiosity.
cheers

8.45 seconds, so 3200/8.45 would be around 380 Mbps. I'm getting up to 850 Mbps though, with about 50% core taxing.

I still don't really get it, is there something I'm missing?

Connection 1000/1000 mbit, Private Internet Access, OpenVPN settings:

Server mode: peer to peer
Protocol: UDP on IP4 only
Peer Certificate Authority: PIA certificate
AES-256-CBC
Compression: LZO compression
Device mode: tun layer 3 tunnel mode
Custom options:

tls-client;
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA;
remote-cert-tls server;
persist-key;
persist-tun;
persist-remote-ip;
keysize 256;
reneg-sec 0;
fragment 0;
mssfix 0;
fast-io;
sndbuf 572864;
rcvbuf 572864;


« Last Edit: September 19, 2017, 03:57:41 am by denova »