Netgate SG-1000 microFirewall

Author Topic: pfSense hardware for home router - OpenVPN performance  (Read 25361 times)

0 Members and 1 Guest are viewing this topic.

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #60 on: September 19, 2017, 03:53:54 am »
Think I found whats giving me the very high results on Speedtest.net. With LZO compression disabled in OpenVPN my results are near 500 Mbps again, with LZO enabled its much higher. But it appears speedtest.net is a bit tricked by LZO:

"When doing VPN tests to measure connection speeds, most people turn to the web’s most prominent internet speed testing website, speedtest.net. Unfortunately, although speedtest.net is a very good indicator of naked internet speed, it can yield some very odd results when VPN testing, often indicating speeds much faster than not just the naked internet results, but than the cap put on a service by the ISP . The reason for this is that the Flash based speedtest.net tool does not account for LZO compression, which is built into the  OpenVPN protocol.

LZO compression
OpenVPN has built into it the optional ability to use the LZO lossless compression library. Much like the better known .zip format, this compresses the size of some files types, which can indeed increase data throughput, but does not count against your ‘real’ bandwidth usage. Files that are already compressed, such as .zip, .rar, and .mp3, and .jpg files, do not benefit much from additional compression. As we noted earlier, speedtest.net is easily confused by the use of LZO compression" (https://www.bestvpn.com/vpn-speed-test-overview/)

So my real world speed is probably 500 Mbps, still very nice  ;D
« Last Edit: September 19, 2017, 03:59:02 am by denova »

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #61 on: September 19, 2017, 06:07:25 am »
Nice found!
Your's definitely a great achievement. I also have a PIA connection at moment (swedish server), but I had never exceed the theoretical maximum speed. On what PIA server are you connected?

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11994
  • Karma: +474/-15
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #62 on: September 19, 2017, 07:23:20 am »
Interesting. There's nothing wrong with using compression. Speedtests data should probably be non-compressible to test the actual available bandwidth though. But it shows how much it can help if what you're transferring is compressible.

Steve

Offline VAMike

  • Sr. Member
  • ****
  • Posts: 429
  • Karma: +65/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #63 on: September 19, 2017, 07:34:21 am »
I don't see any point in enabling compression on the modern internet. The majority of data is either encrypted (thus incompressible) or already compressed (like streaming video). So outside of benchmarks it basically never gets used, but it always adds a bit of CPU overhead.

Offline stephenw10

  • Administrator
  • Hero Member
  • *****
  • Posts: 11994
  • Karma: +474/-15
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #64 on: September 19, 2017, 10:19:02 am »
I guess it all depends on what your expected traffic is. Yeah if you're mostly using https and netflx then maybe not worth it. I've never actually tried to measure the overhead introduced though.

Steve

Offline VAMike

  • Sr. Member
  • ****
  • Posts: 429
  • Karma: +65/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #65 on: September 19, 2017, 01:24:45 pm »
I guess it all depends on what your expected traffic is. Yeah if you're mostly using https and netflx then maybe not worth it. I've never actually tried to measure the overhead introduced though.

If the bulk of your traffic isn't encrypted or already compressed, then you've got a very, very unusual traffic profile. If someone's transferring huge quantities of uncompressed text over http, then sure, they should enable link compression.

Offline Pippin

  • Full Member
  • ***
  • Posts: 253
  • Karma: +23/-3
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #66 on: September 19, 2017, 01:36:10 pm »
To do a OpenVPN speed test I find that downloading a incompressible BIN or zip or ... from a server(s) on the net gives better consistent results. Just search something like "download test bin zip file".
Something like: https://www.thinkbroadband.com/download
And use the download url`s in this program: http://www.nirsoft.net/utils/download_speed_tester.html

Quote
I don't see any point in enabling compression on the modern internet
Indeed, according to the manual it adds at least 1 byte/packet for lzo + the needed processing power, for lz4 I don`t know.
2.3.2-RELEASE (amd64) - GB N3150N-D3V
"There must be someone with intelligence in the party"
"Well, that rules you out Pippin"

Offline denova

  • Newbie
  • *
  • Posts: 18
  • Karma: +4/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #67 on: September 19, 2017, 03:33:04 pm »
Nice found!
Your's definitely a great achievement. I also have a PIA connection at moment (swedish server), but I had never exceed the theoretical maximum speed. On what PIA server are you connected?

I use the nl.privateinternetaccess.com server, but I think it's just about selecting one near you. I'll try the Swedish one some day :)

Offline mauroman33

  • Full Member
  • ***
  • Posts: 175
  • Karma: +23/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #68 on: September 20, 2017, 01:29:37 am »
Nice found!
Your's definitely a great achievement. I also have a PIA connection at moment (swedish server), but I had never exceed the theoretical maximum speed. On what PIA server are you connected?

I use the nl.privateinternetaccess.com server, but I think it's just about selecting one near you. I'll try the Swedish one some day :)

I do use that one because I spend most of the year in Sweden ;).
Staying myself much closer to the Copenhagen servers I tried that connection, but performance was not as good as expected.
I'll take a look on nl servers too. Thanks!

Offline belt9

  • Full Member
  • ***
  • Posts: 233
  • Karma: +24/-6
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #69 on: September 20, 2017, 08:27:09 am »
I guess it all depends on what your expected traffic is. Yeah if you're mostly using https and netflx then maybe not worth it. I've never actually tried to measure the overhead introduced though.

If the bulk of your traffic isn't encrypted or already compressed, then you've got a very, very unusual traffic profile. If someone's transferring huge quantities of uncompressed text over http, then sure, they should enable link compression.

This assumes you're just using the connection to do normal browsing and internet usage, i.e., an OpenVPN Client. What about the OpenVPN server. Where I connect to my home or work network from afar, often with a sub-optimal connection and transfer all kinds of files and data (much of it un-encrypted) from my home network to my laptop. This is where LZOv2 is useful.

Offline ecfx

  • Full Member
  • ***
  • Posts: 227
  • Karma: +31/-14
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #70 on: September 20, 2017, 08:35:12 am »
why not use adaptive compression and let OVPN to decide when to use it or not ?

Offline belt9

  • Full Member
  • ***
  • Posts: 233
  • Karma: +24/-6
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #71 on: September 20, 2017, 08:43:50 am »
no real reason when it comes to actual day to day usage you would notice.

Offline VAMike

  • Sr. Member
  • ****
  • Posts: 429
  • Karma: +65/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #72 on: September 20, 2017, 09:06:04 am »
I guess it all depends on what your expected traffic is. Yeah if you're mostly using https and netflx then maybe not worth it. I've never actually tried to measure the overhead introduced though.

If the bulk of your traffic isn't encrypted or already compressed, then you've got a very, very unusual traffic profile. If someone's transferring huge quantities of uncompressed text over http, then sure, they should enable link compression.

This assumes you're just using the connection to do normal browsing and internet usage, i.e., an OpenVPN Client. What about the OpenVPN server. Where I connect to my home or work network from afar, often with a sub-optimal connection and transfer all kinds of files and data (much of it un-encrypted) from my home network to my laptop. This is where LZOv2 is useful.
I can't even think of what connections on my home network would consist of very much uncompressed data by volume. Video is compressed, pictures are compressed, documents are compressed. There'd be some uncompressed html & source code, but that would be such a small fraction of traffic as to be negligible. Again, if you really do have an overwhelming workload of uncompressed data then sure it makes sense to compress it. (Although I'd look at doing that somewhere else than the edge in the VPN client, personally--by spreading out the compression work to other places you'll be doing less in the single threaded bottlenecked openvpn process.) But for most people that's not the case, and the compression is just adding overhead with no real benefit.
« Last Edit: September 20, 2017, 09:29:50 am by VAMike »

Offline VAMike

  • Sr. Member
  • ****
  • Posts: 429
  • Karma: +65/-11
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #73 on: September 20, 2017, 09:28:04 am »
why not use adaptive compression and let OVPN to decide when to use it or not ?
So the way that works is to compress everything, then look at it, decide whether the compression ratio is good enough, stop compressing for a bit if not, then repeat that cycle. All of which happens inside the single openvpn process that doesn't scale particularly well. The only reason to bother with that is if you expect that it'll be useful at least some of the time. A few years ago I'd typically see at least 60% of traffic on an internet link be HTTP, with plain text making up a good portion of that. Now it's more common to see 60+% HTTPS by volume (not compressible) and most of the remaining HTTP is either protocol compressed or consists of images or other incompressible data. At any rate, it's not really a matter of guessing: the openvpn client status log can tell you the compression ratio you're actually getting. :)

Offline yogibo

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: pfSense hardware for home router - OpenVPN performance
« Reply #74 on: September 20, 2017, 10:20:15 pm »

 The reason for this is that the Flash based speedtest.net tool does not account for LZO compression, which is built into the  OpenVPN protocol.



did you try beta.speedtest.net I believe that doesn't use flash. 

I have i3-7350K and I tried disabling compression and it didn't seem to make a difference, I am able to hit around 700mbs to 800mbs.  Maybe i'm not disabling it correctly.