OpenVPN Router Speeds

OmniNegro

Since the last thread by this name ceased to exist due to trolls, this one is the replacement. I wish I remembered half the content of that thread. But it will get here in time.

At the moment, the two best routers on the market are the Asus RT-AC68U and the Netgear Nighthawk AC1900.

Each of these is capable of exceeding 50 megabits per second.

OmniNegro

I previously based an estimate for speeds on my own Linksys WRT54GL 1.1 router. It has a 200 Mhz Broadcom CPU, and managed an average of just above 260 KiloBytes per second. (or if you prefer bit/s that is 260 * 8 = 2080, so 2 megabits per second.)

And since most people only use bytes for anything, that was the measure I used. This means that if the Asus RT-AC68U is a dual core 800 Mhz CPU and about as fast per Mhz it would be capable of 2080 KiloBytes per second. (Or * 8 for bits, meaning around 16 megabits per second. And since I said that this and the Netgear Nighthawk AC1900 are each capable of more than 50 megabits per second, they are evidently much more capable than the mathematics suggest.)

In the previous thread about this, I amended my estimate to account for this, but I only have the aged relic of a router as a gauge. And it is clearly vastly inferior compared to newer top of the line routers.

So please help me fix this thread up with more up to date examples of your speeds, and what speed you get without the VPN running too so we can know what to expect. Thank you in advance.

OmniNegro

Here is the screenshot I made in the last OpenVPN Router Speeds thread. (The thread is stuck in moderation limbo, and may not return.)

This is what I based my incorrect mathematics on. As I explained above, the newer routers are more than three times as fast per Mhz.

200 Mhz Broadcom CPU on a Linksys WRT54GL manages ~2080 Kilobits per second, but a 800 Mhz dual core CPU on a Asus RT-AC68U manages well past 50 megabits per second, instead of the 16,640 kilobits per second that it would manage if it were not right at three times as potent at the same speeds.

Anyway, here is the image.


Note that I am quite interested in any help people can provide for all of us to have a better understanding of what speeds to expect, what routers are better, and any experiences.

Please share liberally. Thank you each in advance.

OmniNegro

Anyone have any experience with these routers? The EdgeMAX Lite looks promising if a bit strange. It has 2 GB of flash and 512 MB or RAM, but only a dual core 500 Mhz CPU. Still, it is less than $100, so it may be the best price per value router capable of OpenVPN I have ever seen.
http://www.ubnt.com/edgemax#edge-router-lite
http://www.ubnt.com/downloads/datasheets/edgemax/EdgeRouter_Lite_DS.pdf

cosmoxl

will wait a bit more and then may go for a router that can really handle good encryption.  50mbit is getting there.

does openvpn take advantage of multi core cpu yet?

OmniNegro

will wait a bit more and then may go for a router that can really handle good encryption.  50mbit is getting there.

does openvpn take advantage of multi core cpu yet?

This depends on how exactly it is compiled. I believe in most cases it is not compiled to utilize multi-core CPUs.

There are already routers available that can handle 50 megabits per second with encryption. See my first post in this thread for two examples.

cosmoxl

yeah, 50mbit is getting there.  I'd want one that can handle 100mbit. :-)  of course, if they can compile in a way to allow it to use both cores then perhaps that will happen with these routers.

OmniNegro

Someone asked for instructions for setting up a Asus AC-66 router to do OpenVPN. And since the user in question has already flashed Tomato onto it, I am going to simplify things and link in generic Tomato instructions here, as well as the links to the required files and screenshots of my own setup since I use Tomato Shibby on my ancient WRT54GL router. (I do not actually use the VPN that way since I have much faster Internet speeds than my old router can handle.)

I will be posting screenshots of my own router as an example, since most examples I see online use incorrect settings or are made by competing services. (I will not steal their guide. I will just make my own.)

First of all, you need to login to your router that is flashed with Tomato. Some settings will be different from mine, and some features will be absent. That should not matter.

Then click on VPN Tunneling on the left, then it opens up and you should click OpenVPN Client.


Now select Client 1 and "Basic" from the right side, and etup the details similar to what I have here, and you will have to put in your username and password in the obvious fields.
For the "Server Address", you can use any of the hostnames in this link:
https://www.privateinternetaccess.com/pages/network/

Next up, click "Advanced" and setup things like I have in this image, and just for ease, here are the lines to add to "Custom Configuration".
persist-key
persist-tun
tls-client
comp-lzo
verb 1


Finally, click "Keys" and there is only one single field to mess with. Under "Certificate Authority" add the following including the dashes and the begin certificate and end certificate stuff. Here is an exact quote.
-----BEGIN CERTIFICATE-----
MIID2jCCA0OgAwIBAgIJAOtqMkR2JSXrMA0GCSqGSIb3DQEBBQUAMIGlMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCT0gxETAPBgNVBAcTCENvbHVtYnVzMSAwHgYDVQQK
ExdQcml2YXRlIEludGVybmV0IEFjY2VzczEjMCEGA1UEAxMaUHJpdmF0ZSBJbnRl
cm5ldCBBY2Nlc3MgQ0ExLzAtBgkqhkiG9w0BCQEWIHNlY3VyZUBwcml2YXRlaW50
ZXJuZXRhY2Nlc3MuY29tMB4XDTEwMDgyMTE4MjU1NFoXDTIwMDgxODE4MjU1NFow
gaUxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJPSDERMA8GA1UEBxMIQ29sdW1idXMx
IDAeBgNVBAoTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMSMwIQYDVQQDExpQcml2
YXRlIEludGVybmV0IEFjY2VzcyBDQTEvMC0GCSqGSIb3DQEJARYgc2VjdXJlQHBy
aXZhdGVpbnRlcm5ldGFjY2Vzcy5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
AoGBAOlVlkHcxfN5HAswpryG7AN9CvcvVzcXvSEo91qAl/IE8H0knKZkIAhe/z3m
hz0t91dBHh5yfqwrXlGiyilplVB9tfZohvcikGF3G6FFC9j40GKP0/d22JfR2vJt
4/5JKRBlQc9wllswHZGmPVidQbU0YgoZl00bAySvkX/u1005AgMBAAGjggEOMIIB
CjAdBgNVHQ4EFgQUl8qwY2t+GN0pa/wfq+YODsxgVQkwgdoGA1UdIwSB0jCBz4AU
l8qwY2t+GN0pa/wfq+YODsxgVQmhgaukgagwgaUxCzAJBgNVBAYTAlVTMQswCQYD
VQQIEwJPSDERMA8GA1UEBxMIQ29sdW1idXMxIDAeBgNVBAoTF1ByaXZhdGUgSW50
ZXJuZXQgQWNjZXNzMSMwIQYDVQQDExpQcml2YXRlIEludGVybmV0IEFjY2VzcyBD
QTEvMC0GCSqGSIb3DQEJARYgc2VjdXJlQHByaXZhdGVpbnRlcm5ldGFjY2Vzcy5j
b22CCQDrajJEdiUl6zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAByH
atXgZzjFO6qctQWwV31P4qLelZzYndoZ7olY8ANPxl7jlP3YmbE1RzSnWtID9Gge
fsKHi1jAS9tNP2E+DCZiWcM/5Y7/XKS/6KvrPQT90nM5klK9LfNvS+kFabMmMBe2
llQlzAzFiIfabACTQn84QLeLOActKhK8hFJy2Gy6
-----END CERTIFICATE-----


Now everything is done except saving by scrolling down below where my screenshots cut off and clicking save. And since you will be using it all the time, you will want the checkbox on the "Basic" tab called "Start with WAN" checked. That makes it startup every time the router starts.

*Edit* Here are the configuration files that the Certificate Authority part came from.
https://www.privateinternetaccess.com/openvpn/openvpn.zip

And it is only fair to give proper credit where it is due. @johnfromnowhere is a user here who also has a Linksys WRT54GL router like mine. He helped my get out from under the rock I was hiding under and risk bricking my router by flashing it to Shibby. I was a flashing coward, and he did everything but hold my hand and tell me it will be okay until I finally pulled my head out of my ass and flashed the router. Thank you @Johnfromnowhere. I still owe you for this.

hoju

Awesome writeup Omninegro!  I wish I had tyour configuration walkthrough when I originally flashed my router.   However I am still confused as to what must be changed to have hulu work under my setup?  This is my current setup yet it still does not work as I get the annon proxy error

OmniNegro

Awesome writeup Omninegro!  I wish I had tyour configuration walkthrough when I originally flashed my router.   However I am still confused as to what must be changed to have hulu work under my setup?  This is my current setup yet it still does not work as I get the annon proxy error

I think the change has to be on the side of Hulu. And they are currently unwilling to change. There is really nothing you can do besides writing a message to Hulu explaining that the VPN block they are doing is making their service entirely unusable and you will have to cancel if they continue.

OmniNegro

Actually, the feedback for that suggests there is no open sourced firmware options, and no support for VPNs. So the Linksys WRT1900AC is a joke until that changes. And they cost $250 or more.

*Edit* Oh, I should at least thank you for sharing. I do greatly appreciate hearing about the new router options we have. Thank you.

*Edit* Here are a few more things to consider. From this link, I get the following quote.

"Given the confusion that the mentions of OpenWrt support in Linksys
press releases have caused, we would like to clarify the state of
WRT1900AC support in OpenWrt and the ongoing collaboration with Linksys.

Members
of the OpenWrt team have been in contact with Linksys for a while,
discussing collaboration on device support in OpenWrt.
There had been
no technical collaboration on device support until Belkin engineers
posted a few incomplete patches in early April. These patches are
currently being cleaned up, as they do not meet our quality standards.

The
most important part that is still missing is a usable driver for the
Marvell 802.11ac wireless chipset. Belkin is working on fixing this, but
they have not given us an estimation on when such a driver will be
provided.

The default firmware for this device seems to be using a
proprietary driver provided by Marvell, which uses non-standard APIs
for configuration. We don't know if Marvell will open source this
driver, or will work on an alternative Linux driver. We believe that
both approaches require a considerable amount of effort and time.

Because
of these issues, we would currently recommend against purchasing this
device until we have the missing pieces of software to make it
functional with OpenWrt.

The Linksys press release claims that the
device is "OpenWrt ready" and "Open Source ready". Given how much is
still missing, and that not even the GPL code for this device was posted
to the Linksys GPL code center, we consider these claims to be
premature and unfortunately misleading.

Regards,

The OpenWrt Team"

And here are some links that clarify more.

https://forum.openwrt.org/viewtopic.php?id=50173

https://lists.openwrt.org/pipermail/openwrt-devel/2014-January/023354.html

*Edit* And one more... http://www.dd-wrt.com/site/content/dd-wrt-linksys-wrt-1900ac

OmniNegro

I sure hope so. It is a beast of a router still. But excellent hardware is still useless without software that behaves.

Linksys should have made sure all the drivers were available before throwing around terms like "Open Source Ready" and such. Marvell will likely never release the drivers for the hardware, and that makes it all but impossible to make firmware.

nmrman

As of today, Netgear R7000 is a better value than the Linksys wrt1900ac as the netgear already has good dd-wrt support(It is also Kong's personal router and every new release gets tested on it).  The admin at DD-WRT forums came out and said that they haven't heard from Linksys/Belkin yet and if there is going to be DD-WRT it will be a long while.
Netgear can easily be overclocked to 1200MHz (Several people are running it at 1400). The only thing that the wrt-1900 has that others don't is the esata port.

OmniNegro

As of today, Netgear R7000 is a better value than the Linksys wrt1900ac as the netgear already has good dd-wrt support(It is also Kong's personal router and every new release gets tested on it).  The admin at DD-WRT forums came out and said that they haven't heard from Linksys/Belkin yet and if there is going to be DD-WRT it will be a long while.
Netgear can easily be overclocked to 1200MHz (Several people are running it at 1400). The only thing that the wrt-1900 has that others don't is the esata port.

There is one thing that I noticed that is debatably better about the Linksys. (Provided they actually get off their asses and make it usable.) It has a fan. I have for decades now been putting tiny fans out to blow over small electronic devices to cool them down. And it is past time that they start coming with cheap fans to blow away excess heat.

Please do correct me if the Netgear or Asus models have fans.This would be the first I heard of such.

OmniNegro

For the current price of the Linksys WRT1900AC, you can get an EdgeMax Pro with a dual core 1 Ghz CPU and 2 GB RAM. They are crazy expensive, but cheap for the performance.
http://www.ubnt.com/edgemax#edge-router-pro
http://www.streakwave.com/Itemdesc.asp?ic=ERPRO-8A

They are currently $370 USD each. But wow. Compared to what we jokingly call "consumer" routers, these things are like Godzilla compared to a Gecko.

nezzz

For the current price of the Linksys WRT1900AC, you can get an EdgeMax Pro with a dual core 1 Ghz CPU and 2 GB RAM. They are crazy expensive, but cheap for the performance.
http://www.ubnt.com/edgemax#edge-router-pro
http://www.streakwave.com/Itemdesc.asp?ic=ERPRO-8A

They are currently $370 USD each. But wow. Compared to what we jokingly call "consumer" routers, these things are like Godzilla compared to a Gecko.

I'm currently using the Edgerouter Lite. Powerful as it is, it is not a router you should even recommend to a geek. Most of the functions are only accessible from command line anyway.

OmniNegro

For the current price of the Linksys WRT1900AC, you can get an EdgeMax Pro with a dual core 1 Ghz CPU and 2 GB RAM. They are crazy expensive, but cheap for the performance.
http://www.ubnt.com/edgemax#edge-router-pro
http://www.streakwave.com/Itemdesc.asp?ic=ERPRO-8A

They are currently $370 USD each. But wow. Compared to what we jokingly call "consumer" routers, these things are like Godzilla compared to a Gecko.

I'm currently using the Edgerouter Lite. Powerful as it is, it is not a router you should even recommend to a geek. Most of the functions are only accessible from command line anyway.

Agreed. That was basically what I said here. (It was off topic in that thread, but oh well.)
https://www.privateinternetaccess.com/forum/index.php?p=/discussion/comment/15828#Comment_15828

VPN

@nezzz: But isn't the command line exactly what geeks would prefer to use? *g*

That aside, can you tell us a bit about the speeds you could achieve with OpenVPN on that device? I like the open OS approach, and would consider exchanging my self-built device for one of these if the performance is comparable.

nmrman

@Omni: You are right about the fan on 1900ac. It is also implemented right in that it only turns on when needed and speeds up when needed even more.  But, the whole need for a fan is debatable for the normal life expectancy of the consumer routers.  I am not getting into it.  I have an R7000 and it runs cool enough.  The fan may be useful if it is heavily overclocked(1400 from the default 1000 MHz)

rainmakerraw

@OmniNegro @VPN @nezzz

I looked at those after I saw Omni recommend them (can't find the thread now!). While it's a nice piece of kit for what it is - and the price - I'm afraid to buy it in my country in Europe comes closer to $500 than $100.

As I said on the other thread I currently run IPFire (a fork of IPCop) on an old PC. With the release of AMD's rather lovely Jaguar AM1 SoC architecture however, I think I'll be building a nice new microATX rig in a router-style case and perhaps migrating to pfSense or similar.

The Jaguar AM1 APUs are around $25 and the same for the boards, while putting out very decent power. The 1.3GHz quad core (the cheapest of the bunch) only consumes 25W and yet has a decent 2MB L2 cache and bags of processing power for its size. It also supports hardware accelerated AES decryption on-chip and has built in 4k graphics output!

Even a bargain basement setup of that order, with the smallest and cheapest available RAM (2GB DDR3 single channel) and a cheap 32GB SSD, would amply cope with 1Gbps traffic and many simultaneous connections. You also get the advantage of making a nice sleek box to hide away in the corner, and on-board wifi with a GUI based routing/firewall distro.

What's not to like? Way better than any crapware consumer box you could buy for twice the price, with a free inbuilt backdoor!

OmniNegro

I think the life expectancy of normal routers is about to plummet due to the revelations that basically every last mass produced router is either designed with software that locks you out and likely contains backdoors, or hardware that does the same transparently to the software.

But the reason I say that is that I am still using an ancient relic of the distant past. My Linksys WRT54GL. This thing must be a decade old or more.

OmniNegro

@OmniNegro @VPN @nezzz

I looked at those after I saw Omni recommend them (can't find the thread now!). While it's a nice piece of kit for what it is - and the price - I'm afraid to buy it in my country in Europe comes closer to $500 than $100.

As I said on the other thread I currently run IPFire (a fork of IPCop) on an old PC. With the release of AMD's rather lovely Jaguar AM1 SoC architecture however, I think I'll be building a nice new microATX rig in a router-style case and perhaps migrating to pfSense or similar.

The Jaguar AM1 APUs are around $25 and the same for the boards, while putting out very decent power. The 1.3GHz quad core (the cheapest of the bunch) only consumes 25W and yet has a decent 2MB L2 cache and bags of processing power for its size. It also supports hardware accelerated AES decryption on-chip and has built in 4k graphics output!

Even a bargain basement setup of that order, with the smallest and cheapest available RAM (2GB DDR3 single channel) and a cheap 32GB SSD, would amply cope with 1Gbps traffic and many simultaneous connections. You also get the advantage of making a nice sleek box to hide away in the corner, and on-board wifi with a GUI based routing/firewall distro.

What's not to like? Way better than any crapware consumer box you could buy for twice the price, with a free inbuilt backdoor!

I think that was this thread.
https://www.privateinternetaccess.com/forum/index.php?p=/discussion/2845/openvpn-router-speeds#Item_4
Or was it this one?
https://www.privateinternetaccess.com/forum/index.php?p=/discussion/comment/15828#Comment_15828

But yeah, a real PC always beats a purpose specific device. If these new systems are really going to be that cheap, even the EdgeMax routers would be a ripoff. I will have to look into that.

rainmakerraw

My memory eludes me, but alas it's a trivial detail.

I absolutely loved my old WRT54GL, which used to run various incarnations and derivatives of Tomato firmware. I was rather upset when I had to sell her, after upgrading to 100Mbps internet when the '54GL could only cope with around 50Mbps throughput. First world problems, and all that haha.

If you search through your favoured engine for terms along the lines of 'AMD A1 Jaguar Kabini SoC' you'll find various interesting articles and reviews etc. For a high spec router/firewall and home server they're ideal and super low powered for what you get out of them.

nezzz

@nezzz: But isn't the command line exactly what geeks would prefer to use? *g*

That aside, can you tell us a bit about the speeds you could achieve with OpenVPN on that device? I like the open OS approach, and would consider exchanging my self-built device for one of these if the performance is comparable.

Thats because this router does not work straight out of the box. Even for the average geek, you would need to do lots of setting up the iptables, routing tables, VLAN, subnetting, etc... not exactly a geeky router.

If you don't understand the advanced options or scripting in ddwrt, openwrt or tomato. Edgerouter is 10x harder.

I think that was this thread.

https://www.privateinternetaccess.com/forum/index.php?p=/discussion/2845/openvpn-router-speeds#Item_4
Or was it this one?
https://www.privateinternetaccess.com/forum/index.php?p=/discussion/comment/15828#Comment_15828

But yeah, a real PC always beats a purpose specific device. If these new systems are really going to be that cheap, even the EdgeMax routers would be a ripoff. I will have to look into that.

Purpose built routers will always beat micro PCs in power management and idling. Not to mention their updates come more frequently. Also if something breaks on a micro PC setup, you're pretty much on your own, there is hardly any documentation since everyone uses different hardware. In purpose built routers, the registers are all common and easily troubleshooted.

OmniNegro

EdgeRouter Lite uses seven watts. EdgeRouter Standard uses thirty-five watts. EdgeRouter Pro uses forty watts. Strangely, the EdgeRouter PoE uses sixty watts. (Twelve watts per data port in use, and up to ten for the overhead of the system if I read the PDF correctly.) Each of these listed wattages is the maximum for the device. And I doubt any system as capable can beat the efficiency of the EdgeRouter Lite.

So apparently, the EdgeRouters are powered mostly by the utter confusion of the users who thought they knew what they were doing. (That is my explanation. I am sticking to it.)

*Edit* Naming you so you get the alert that you were mentioned in a comment here. I hope it still works in an edit. @nezzz

VPN

@nezzz: Thanks for listing the setup steps. I understand how that would be confusing for a regular user. I personally would love it

Still, could you perhaps tell us something about the transfer speeds you're getting? I really want to know

OmniNegro

For ease of comparison, we must presume you use BF-CBC as the cipher.

OmniNegro

I really hope this guy/gal making the post here just has this thing setup very wrong, or his provider is seriously lacking.
http://community.ubnt.com/t5/EdgeMAX/Performance-as-an-OpenVPN-client/m-p/821540#U821540

And another. Sounds like the EdgeRouters are quite underpowered for encryption. Hardly surprising considering I have LED lightbulbs that use far more power than some of the EdgeRouter models.
http://community.ubnt.com/t5/EdgeMAX/OpenVPN-performance-optimization/m-p/817842#U817842

And there are plenty more threads like these.

nezzz

@nezzz: Thanks for listing the setup steps. I understand how that would be confusing for a regular user. I personally would love it

Still, could you perhaps tell us something about the transfer speeds you're getting? I really want to know

I'm still using my AC68 for OpenVPN. It beats any router for crunching numbers hands down. 

Personally I use the Edgerouter with a Cisco switch to do some more complex routing and subnetting in my home that cannot be done on the AC68. I only use the AC68 for my Netflix, Hulu and Pandora

nezzz

Well I am getting a Miktotik CCR1009 now after being sold watching a friend of mine push 7Gbps  over OpenVPN, comes with 9 cores and 2gb ram, SFP+ port for 10gbps and most importantly hardware encryption.

http://routerboard.com/CCR1009-8G-1S-1Splus

Should be coming in 2 weeks. I wonder if any VPN company would allow me to consume 1 server's worth of bandwidth all on my own

OmniNegro

Well I am getting a Miktotik CCR1009 now after being sold watching a friend of mine push 7Gbps  over OpenVPN, comes with 9 cores and 2gb ram, SFP+ port for 10gbps and most importantly hardware encryption.

http://routerboard.com/CCR1009-8G-1S-1Splus

Should be coming in 2 weeks. I wonder if any VPN company would allow me to consume 1 server's worth of bandwidth all on my own

It only uses 35 watts? I have light bulbs that use a lot more power than that... Honestly I doubt this will do what you expect it to be able to do.

The problem is that in every single case I know of, OpenVPN is single threaded, so the number of cores is useless until that is fixed. And there is absolutely nothing in the manual for the RouterOS about setting cores (Singular or plural) to OpenVPN tasks.
http://wiki.mikrotik.com/wiki/Manual:TOC
http://wiki.mikrotik.com/wiki/Manual:Interface/OVPN
http://wiki.mikrotik.com/wiki/OpenVPN_Configuration_Step_by_Step