Asus RT-AC87U OpenVPN speeds

[AndromancE]

Hi everybody!

I have an Asus RT-AC87U. While I got everything up and running just fine specially using Merlin's FWs (no hiccups no drop outs). I'm wondering if I could squeeze the most of it, that's why I payed that much in first place.

The question here about OpenVPN speeds (by PIA). Many people here say this router is capable of speeds over 50 mbps if the RT-AC68 can do 50. When I first tried mine with the nearest VPN server I only got around 15% of the speed I usually achieve when using my PC connected to the same VPN server by PIA's own software (92mbps).

So I went on trying to turn off anything that could possibly steal CPU power starting with AiProtection which resulted in a tinny bump in speeds (about 2-3%) then the Firewall which didn't affect the speeds at all. And all down to NAT acceleration off and boom it jumped to 40%. FYI that's 38mbps from 100mbps provided by my ISP. While 38mbps is fine for my needs, I'm just wondering if this router is actually capable of higher speeds or at least as much as the AC68.

Here are my settings:

-Enabled OpenVPN client 1 and 2 with specific routing to different devices on default encryption (lowering the encryption to AES128 didn't make any difference...in speed).
-AiProtection on (affects 2-3% the speeds when sharing the same CPU core 1 with OpenVPN client 1).
-Firewall on.
-MAC filter on.
-DHCP off.
-QoS off.
-2.4ghz off.
-NAT acceleration off.
-Parental control off.
-DNS filtering off.
-Rest on default.
-CPU temp 66-70c.
-ISP speed 100mbps down/10mbps up.

When download speed reaches 38mbps (downloading nvidia driver or adobe PS or speedtesting) I noticed that the router CPU Core 1 never goes over 25% and Core 2 hovers between 50-60% which means there's plenty of CPU power left unused.


Could somebody please shed some light on this.

 

[m9107761]

Hi,
do you try NAT acceleration on?

 

[AndromancE]

NAT acceleration hugely affects the speed. When ON the max I get is about 16 mbps from the same server. I started to think about returning this piece of junk. As other problems started to arise, specially the 5ghz is now dropping periodically. This router has been a big failure by Asus. Petty though, the GUI is near perfect.

 

[joegreat]

NAT acceleration hugely affects the speed. When ON the max I get is about 16 mbps from the same server. I started to think about returning this piece of junk. As other problems started to arise, specially the 5ghz is now dropping periodically. This router has been a big failure by Asus. Petty though, the GUI is near perfect.

Hi,

My (new) 87U runs like charm: The VPN speed is great and WLAN is much better then before....

On my VPN provider (PerfectPrivacy with up to 3 GBit internet connections) runs with Cipher 'AES-256-CBC' which results on my routers to >40 MBits down speed and >10 MBit up. I have not done detailed comparison with the my previous 68U, but I get the impression that the VPN is on the 87U approx. 10% faster than before.

So my conclusion ist that you should try an alternative software/firmware and setup the router after thorough thinking in respect of free channels, detailed configuration and wireless power settings... This could make you a happy camper as I am!

 

[kvic]

On my VPN provider (PerfectPrivacy with up to 3 GBit internet connections) runs with Cipher 'AES-256-CBC' which results on my routers to >40 MBits down speed and >10 MBit up. I have not done detailed comparison with the my previous 68U, but I get the impression that the VPN is on the 87U approx. 10% faster than before.

87U shall indeed perform better than 68U wrt OpenVPN speed. It's due to the underlying architecture in 87U. 5GHz wireless is offloaded to a separate processor. The main processor only handles routing + 2.4GHz traffic. So plenty of CPU cycles left for running OpenVPN.

BTW, for the same reason, 88U will have way better OpenVPN performance than 68U at stock clocks.

Some users reported 5GHz instability in 87U. If that has been fixed with latest firmware, 87U is a very good deal at its black-swan low price.

 

[AndromancE]

Regarding kvic's answer. That's exactly what I though when I was deciding between 87u and 68u. Plus future proofing. The offloaded 5ghz gave me the impression that the main processor might be freed from a heavy task, and as I was planing to turn off 2.4ghz from the beginning so I could have it even more free and concentrate its power towards OpenVPN tasks . But that didn't take me nowhere near what I was hopping for (but 38mbps is still enough for most tasks).

When I decided to go for the 87u I checked the forums and Asus website if the 5ghz problems were definitively fixed. At first it was dropping and then I switched to Marlin FW and everything was ok, then I decided to update the FW to the Marlin's latest and then the problems started once again. I'll try to reset the whole thing again and setup from scratch.

joegreat, what did you mean with alternative firmware? like dd-wrt or something? I feel it very convenient using Merlin FW vs Stock or dd-wrt (I had it in my previous router). Could you share your setups? BTW I also live in a very challenging new building .

And thanks for commenting.

 

[AndromancE]

I just wanted to add that when I bought my 87u I wasn't expecting it to do magic. We are using light to communicate (radiowaves are just part of the spectrum) but it's so affected by the environment even air molecules can block it or slow it down. Well, unless some genius figures how we could use neutrinos for communication, that would be awesome . But even then we might have interference coming from our cosmic neighbors LOL.

 

[kvic]

But that didn't take me nowhere near what I was hopping for (but 38mbps is still enough for most tasks).

My use of VPN is primarily router as server. Managed to reach a sustained 80Mbit/s on my overclocked AC56U under a custom dual wan setup. On a single WAN is slightly more than 70Mbit/s. So we can see the firmware's routing code isn't doing terrifically efficient w.r.t OpenVPN.

Reading your case in detail, you use router as VPN client and it's PIA. You shall search for john9527's posts regarding PIA. IIRC there were some discussion on a way to boost the speed significantly for PIA. Perhaps 40% increase in your case. His fork also has PIA default profile now optimised for speed I guess.

 

[supervizor]

I just wanted to chime in with a problem I seem to have to see if you people have it as well. On my Asus RT-AC87U I get speeds for upload up to 60 mbit/s and it maxes one of the cores out (by using client 2, Merlin FW 380.57), but download is at max. 35 mbit/s and no cores are maxed out (for OpenVPN, AES-256-CBC, AirVPN). So it looks like pretty much the same problem as AndromancE has.. (I have a 100/100 mbit/s connection.)
I have tried so many things for two days now to get it higher, but I think I give up for now. Turning NAT acceleration off was a huge deal, but nothing else than that seemed to help. I can't understand or comprehend how upload can be that much different from the download speed.. I have tested mostly with speedtest.net but regarding d0wnload speed, also tried ripping TV-programs from the danish website dr.dk, to no avail. There must be something blocking the download stream in the router somehow.. I can't even test that much, since AirVPN only has OpenVPN protocol and in that, only allows AES-256-CBC cipher..
Also, I have tested it with AirVPNs program on a computer, and while the upload is the same, whether the router acts as VPN client or the AirVPN utility on the computer, the download is faster about 10 m/bit/s on the computer, using AirVPNs VPN-utility.

 

[joegreat]

On my Asus RT-AC87U I get speeds for upload up to 60 mBit/s and it maxes one of the cores out (by using client 2, Merlin FW 380.57), but upload is at max. 35 mBit/s and no cores are maxed out (for OpenVPN, AES-256-CBC, AirVPN). So it looks like pretty much the same problem as AndromancE has.. (I have a 100/100 mBit/s connection.)

Wow, upload between 35 and 60 MBit (=MegaBit or mBit = MilliBit?) are very impressive - I get only 10-12 MBit with my AC87U router...

Download is much better in my case (up to 50 MBit) but it's not surprising as den encryption is done by the host server and the decryption is lighter (see: Why does AES encryption take more time than decryption?) and therefore faster on the small router CPU.

Well, now I wonder what is actually your question or problem?

 

[supervizor]

I made an error, shirt, sorry about that.. The download is at 35 mbit/s (max.) and the upload is at 60 mbit/s (max.). Upload is always more than 45 mbit/s but download is always less than 35, rarely reaching its max at 35.. Which I find odd.

Thanks for the link, I will check it out..
Its Megabit (not byte). My bad, since Byte is with capital B and bit with small b.
It almost seems that you have the opposite problem of what I have.. My question /problem is why the router is doing this? Or is it the FW from Merlin? Why is upload faster than the download and why doesn't it use 100% of its cores to download, when it maxes at least one core out regarding upload? But only uses 30-40% of only one core to download and 20-30% of the second core? Why this discrepancy? Will we ever know? Does Merlin know? Will he have a go at the problem? And so on.. I cannot see any reason to where else the problem can be, other then in the hard- or the software of the router.

 

[kvic]

Wow, upload between 35 and 60 MBit (=MegaBit or mBit = MilliBit?) are very impressive - I get only 10-12 MBit with my AC87U router...

Download is much better in my case (up to 50 MBit) but it's not surprising as den encryption is done by the host server and the decryption is lighter (see: Why does AES encryption take more time than decryption?) and therefore faster on the small router CPU.

Well, now I wonder what is actually your question or problem?

Indeed, I observed a disparity of about 10Mbit/s between download and upload. Upload being not as speedy.

 

[AndromancE]

Here I am again. This router can't stop giving me headaches. The 5ghz is dropping constantly. I had to downgrade back to Merlin 378.56_2 but to no avail. I just couldn't continue with this router anymore and withstand the complains from everyone at home about the wifi dropping. I've just contacted amazon and they accepted to return it back (awesome amazon).

The problem now that I got attached to AsusWRT Merlin interface. It just suits my needs perfectly. Specially the OpenVPN section. No other FW that I know of gives the possibility to have 5 openvpn clients active at the same time with special routing to any device you want withing the LAN. And I use 3 active clients all the time each connected to different PIA server and each routed to couple of devices.

Giving the hit or miss with the ac87s I'm willing to downgrade to even the ac68 for the sake of the sleek GUI and stability. Is this a good decision? Will I get a decent Openvpn speed out of the weaker 68? say at least 30mbps which is enough for most streaming tasks even 4k.

Or is there a router with the same or better functionalities, specially OpenVPN like in Merlin's?

I need a new router by this weekend, so any suggestion will be appreciated.

Kind regards

 

[MoBlues]

Here I am again. This router can't stop giving me headaches. The 5ghz is dropping constantly. I had to downgrade back to Merlin 378.56_2 but to no avail. I just couldn't continue with this router anymore and withstand the complains from everyone at home about the wifi dropping. I've just contacted amazon and they accepted to return it back (awesome amazon).

The problem now that I got attached to AsusWRT Merlin interface. It just suits my needs perfectly. Specially the OpenVPN section. No other FW that I know of gives the possibility to have 5 openvpn clients active at the same time with special routing to any device you want withing the LAN. And I use 3 active clients all the time each connected to different PIA server and each routed to couple of devices.

Giving the hit or miss with the ac87s I'm willing to downgrade to even the ac68 for the sake of the sleek GUI and stability. Is this a good decision? Will I get a decent Openvpn speed out of the weaker 68? say at least 30mbps which is enough for most streaming tasks even 4k.

Or is there a router with the same or better functionalities, specially OpenVPN like in Merlin's?

I need a new router by this weekend, so any suggestion will be appreciated.

Kind regards

I hope AndromancE just by chance got a LEMON because I'm really keepin' an eye on getting an RT-AC87U to replace my 3-year old AC-66R! I don't mind a used one for $120 with Merlin.

 

[AndromancE]

Well, mysteriously after re-updating to Merlin's 380.57_0 and activating MU-MIMO (My LG G's support it) the wireless started to working fine. And I even overclocked the CPU to just 1200mhz and seen a huge difference in OpenVPN speeds from ~36 mbps to a whopping 68mbps! from the nearest PIA server to me. It was so fast I just couldn't believe it and started to check and recheck and stress testing it but it was a real data from OpenVPN and the 5ghz didn't have not even one hiccup. It's been stable since last week Wednesday.

I didn't set it to reboot as I didn't want it to clear the vram so I wont lose the overclocking and shutdown the OpenVPN client (It always happens after reboot).

The temps were satisfactory too. With no active cooling and only on vertical position the CPU settled on 70c and the 5ghz on 60c (2.5ghz disabled).

And again, amazon was so helpful and flexible when I asked them to keep the Router for more time as it seemed stable enough. They even welcomed me to contact them when ever I want to return it .

Hopefully with more updates this router will be more stable and pay for its high price in the next 3-4 years I plan to use.

 

[Borghees]

Hello,

I read this post with interest. I have similar issues: I tried the latest Asus Merlin stable and alpha builds only to find the vores are not fully loaded with an OpenVPN connection.

I tried Client 1: load core 1 is about 15% and core 2 about 50% during download resulting in a 18Mbs speed and load core 1 50% and core 2 100% resulting in a 35Mbs uploadspeed (from a 100/50 connection). Client 2 uses only core 1 and ore 2 stays idle.

During 1 speedtest, core 2 was almost fully used resulting in 50Mbs download speed. But that was a one-timer.

Does anyone have an idea what I can do to make the router fully use the cores and thus increase the speed of an OpenVPN connection? I switched off NAT acceleration btw.

Thanks!

 

[Cake]

To the OP, you mentioned AI protection is on, I know its for testing purpases. I want to point out to others- This probably defeats your vpn if your using it for privacy. As far as I know TrendMicro acts like dns, your url query gets looked up through your vpn dns (if that is what you have configured), also your router which is most likely not using the vpn also takes that url and sends it off to TrendMicro to see if its on the list, then you proceed through your vpn. TrendMicro will have your WAN IP plus the website you visited. It is a publicly traded company.
Correct me if I am wrong, although the AI trendmicro eula does say they are doing this, sometimes a person may think that with vpn on they are private.

 

[RMerlin]

Does anyone have an idea what I can do to make the router fully use the cores and thus increase the speed of an OpenVPN connection? I switched off NAT acceleration btw.

That's not possible, because OpenVPN is a single-threaded program.

 

[Borghees]

That's not possible, because OpenVPN is a single-threaded program.

Thanks for your reply. I wasn't aware. Limiting the load to one core seems a strange decision taking into account the heavy en-/decrypting.

However, even if it is a single-thread program, one would expect that thread to at least function 100% during load (i.e. up- and downloads). Now it only loads 100% during upload yet maxes out at 50% during download. Would you have an explanation for this behavior?

Thanks in advance, I appreciate your response!

 

[RMerlin]

Thanks for your reply. I wasn't aware. Limiting the load to one core seems a strange decision taking into account the heavy en-/decrypting.

However, even if it is a single-thread program, one would expect that thread to at least function 100% during load (i.e. up- and downloads). Now it only loads 100% during upload yet maxes out at 50% during download. Would you have an explanation for this behavior?

Thanks in advance, I appreciate your response!

Bottleneck being elsewhere than at the CPU level on download. Could be related to NAT acceleration perhaps, I don't know.