AX88 OpenVPN hardware assist.

[Svalbaard]

Hi, I currently have an AC88 that I run with Merlin firmware and a VPN client connection to my provider. Whist this is perfectly functional, unfortunately it is not great in terms of the impact on overall internet speed when taking into account the VPN encryption / decryption overhead.

So I've heard rumours that the new AX88 has hardware assistance for OpenVPN and was hoping someone could (A) confirm whether this is the case, and (B) if there were any pointers to more information about it, and whether it makes any real difference in the real world in terms of the router build.

Many thanks.

 

[RMerlin]

https://www.snbforums.com/threads/openvpn-performance-of-the-rt-ac86u.41217/

Same CPU as the RT-AC86U, except it's the quad-core version.

 

[Svalbaard]

https://www.snbforums.com/threads/openvpn-performance-of-the-rt-ac86u.41217/

Same CPU as the RT-AC86U, except it's the quad-core version.

Thanks for the response Mr M. So over my 100MBps line, with my AC88 I generally tend to get between 10-40 of throughput with the VPN enabled (I use AirVPN) depending on local contention and other factors. In your experience, and I'm obviously not asking for a definite, but I would expect to see much better throughput with either the AC86 or the AX88?

Many thanks.

 

[L&LD]

Thanks for the response Mr M. So over my 100MBps line, with my AC88 I generally tend to get between 10-40 of throughput with the VPN enabled (I use AirVPN) depending on local contention and other factors. In your experience, and I'm obviously not asking for a definite, but I would expect to see much better throughput with either the AC86 or the AX88?

Many thanks.

Not Mr. M! But yes, you will see a marked improvement with either of those.

 

[JemTheWire]

I am in Manchester (UK) have an AX88U and also use AirVPN. I have my VPN Clients configured for a couple of local servers and a couple overseas.

My Virgin Media BB package is 200/12.

Using a local AirVPN server, I have just done a speed test (Speedtest.net) from my iPad and got the results in the attachment.

No complaints from me!

 

[RMerlin]

but I would expect to see much better throughput with either the AC86 or the AX88?

Depends on your provider, they could be the bottleneck. While I can get 220 Mbps between an Asus router and a local computer, NordVPN gives me around 50 Mbps with the particular server I use for testing.

 

[Svalbaard]

View attachment 16889

I am in Manchester (UK) have an AX88U and also use AirVPN. I have my VPN Clients configured for a couple of local servers and a couple overseas.

My Virgin Media BB package is 200/12.

Using a local AirVPN server, I have just done a speed test (Speedtest.net) from my iPad and got the results in the attachment.

No complaints from me!

Thanks for this. Yes I'm with VM also but on the 100 package. I guess I'll get the old card out and get one bought then. Cheers.

 

[Svalbaard]

Depends on your provider, they could be the bottleneck. While I can get 220 Mbps between an Asus router and a local computer, NordVPN gives me around 50 Mbps with the particular server I use for testing.

Thanks. Much appreciated.

 

[Svalbaard]

So I have the AX88 turning up today. Obvs the first thing i'll be doing is an install of the Merlin firmware. I'm not expert level like some of you fine folks, so I was hoping if anyone has any advice on the most relevant settings to make maximise both wifi and OpenVPN performance I'd be happy to hear them, and I'll post back my results to see what difference the AX88 has made over the AC88.

Thanks again.

 

[L&LD]

So I have the AX88 turning up today. Obvs the first thing i'll be doing is an install of the Merlin firmware. I'm not expert level like some of you fine folks, so I was hoping if anyone has any advice on the most relevant settings to make maximise both wifi and OpenVPN performance I'd be happy to hear them, and I'll post back my results to see what difference the AX88 has made over the AC88.

Thanks again.

Looking forward to your findings!

This is the order I follow when flashing RMerlin's firmware to a new router for customers:

1. Download the firmware you want to flash and make sure to check the sha256sum.sha256 hash on the extracted firmware file. This sha256sum.sha256 file is included in the zip file you download.
   1. I always use Hashtab to verify the file isn't corrupted via downloading, before attempting to use it.
2. Perform a quick/temporary wizard setup to gain access to the main GUI.
   
3. Flash the RMerlin firmware (384.10_2).
   1. Perform a quick/temporary wizard setup to gain access to the main GUI after it reboots.
   2. Reset the router to factory defaults.
      1. Make sure you also checked the box that says to 'initialize all settings...' too.
4. Perform a quick/temporary wizard setup to gain access to the main GUI once again.
5. Let the router idle for at least 10 minutes. (You should notice the CPU graphs go 'quiet' by then).
6. Check the box to 'format the jffs partition on next boot' option.
   1. Make sure you hit 'Apply' at the bottom of the page.
   2. These steps (6) are most important if you do not have the 'initial all settings...' checkbox next to the reset to factory defaults button in the GUI.
7. Now, reboot the router 3 times in the next 15 minutes or so, waiting for at least 5 to 10 minutes between boots.
8. Now, perform a hard reboot - unplug the router from the ac power plug (not from the ac power socket on the wall) and wait 2 minutes.
9. Hold the WPS button and keep holding it while you plug in the ac power for around 30 seconds. The router should reboot. Let go of the WPS button and wait for the router to boot up. This may take longer than normal.
10. If the WPS NVRAM erase procedure was successful above, the wizard setup should now greet you.
    
11. Do a final quick/temporary wizard setup to access the GUI and then re-flash the same firmware.
12. After it reboots, complete the wizard setup and proceed to minimally and manually configure the router to secure it and connect to your ISP (See the M&M Config link for more details in my signature below).
13. Note that it can take up to an hour for the router to fully settle into its new firmware.
14. At the end of the hour, I will reboot one final time to ensure as stable a router and network as possible.

The above steps will ensure that the router and firmware start off from a good/known state. This will be invaluable when (if) troubleshooting is needed to determine if the issues are firmware/settings related or if they are more likely hardware issues.

https://www.snbforums.com/threads/faq-nvram-and-factory-default-reset.22822/

The link above has more details of why a reset is necessary in some cases (like when flashing between stock Asus and RMerlin firmware) for Asus routers and why we would want to minimize any inter-firmware interactions in a proactive fashion.

Further information can be found in my signature following the links below.

 

[Svalbaard]

Looking forward to your findings!

This is the order I follow when flashing RMerlin's firmware to a new router for customers:

1. Download the firmware you want to flash and make sure to check the sha256sum.sha256 hash on the extracted firmware file. This sha256sum.sha256 file is included in the zip file you download.
   1. I always use Hashtab to verify the file isn't corrupted via downloading, before attempting to use it.
2. Perform a quick/temporary wizard setup to gain access to the main GUI.
   
3. Flash the RMerlin firmware (384.10_2).
   1. Perform a quick/temporary wizard setup to gain access to the main GUI after it reboots.
   2. Reset the router to factory defaults.
      1. Make sure you also checked the box that says to 'initialize all settings...' too.
4. Perform a quick/temporary wizard setup to gain access to the main GUI once again.
5. Let the router idle for at least 10 minutes. (You should notice the CPU graphs go 'quiet' by then).
6. Check the box to 'format the jffs partition on next boot' option.
   1. Make sure you hit 'Apply' at the bottom of the page.
   2. These steps (6) are most important if you do not have the 'initial all settings...' checkbox next to the reset to factory defaults button in the GUI.
7. Now, reboot the router 3 times in the next 15 minutes or so, waiting for at least 5 to 10 minutes between boots.
8. Now, perform a hard reboot - unplug the router from the ac power plug (not from the ac power socket on the wall) and wait 2 minutes.
9. Hold the WPS button and keep holding it while you plug in the ac power for around 30 seconds. The router should reboot. Let go of the WPS button and wait for the router to boot up. This may take longer than normal.
10. If the WPS NVRAM erase procedure was successful above, the wizard setup should now greet you.
    
11. Do a final quick/temporary wizard setup to access the GUI and then re-flash the same firmware.
12. After it reboots, complete the wizard setup and proceed to minimally and manually configure the router to secure it and connect to your ISP (See the M&M Config link for more details in my signature below).
13. Note that it can take up to an hour for the router to fully settle into its new firmware.
14. At the end of the hour, I will reboot one final time to ensure as stable a router and network as possible.

The above steps will ensure that the router and firmware start off from a good/known state. This will be invaluable when (if) troubleshooting is needed to determine if the issues are firmware/settings related or if they are more likely hardware issues.

https://www.snbforums.com/threads/faq-nvram-and-factory-default-reset.22822/

The link above has more details of why a reset is necessary in some cases (like when flashing between stock Asus and RMerlin firmware) for Asus routers and why we would want to minimize any inter-firmware interactions in a proactive fashion.

Further information can be found in my signature following the links below.

That's great. Thanks so much. I'll try to work through all of that over the next day or so and update appropriately.

 

[Svalbaard]

So first off, thanks for the guides and config steps and help so far. They were really invaluable in being able to start from a known "good" build. I tried to follow them to the letter, but there were a couple of steps that I don't think are relevant for the AX88 such as turning off FTP and Media server etc - unless I've missed them :-(

Anyway, after config, initial (non-VPN) performance stats are looking good. I use a Dell XPS15 i7-6700 laptop and tested my 100Mbps Virgin Media line using the built in Dell 1830 WiFi adapter, and a separate TP Link AC1200 dongle on 5G - and both came back with averages across the various samples I've taken of 109MBbs consistently according to Ookla. It will be interesting to see what evening performance will be like when there is more external local contention, but I've never seen 109MBps from my line before over WiFi so not sure if this is purely due to router performance.

Whilst I was at it I tried both a direct ethernet cable connection to the back of the router, and also a direct cable connection through a powerline plug over the other side of the house that is also plugged into the back of the router. Both came back with consistent averages of 110MBps. But again, not sure if this is pure router performance.

As I said, this is non-VPN performance, so tomorrow I'll download a fresh AirVPN ovn file and see what that brings.

Thanks again.

 

[L&LD]

So first off, thanks for the guides and config steps and help so far. They were really invaluable in being able to start from a known "good" build. I tried to follow them to the letter, but there were a couple of steps that I don't think are relevant for the AX88 such as turning off FTP and Media server etc - unless I've missed them :-(

Anyway, after config, initial (non-VPN) performance stats are looking good. I use a Dell XPS15 i7-6700 laptop and tested my 100Mbps Virgin Media line using the built in Dell 1830 WiFi adapter, and a separate TP Link AC1200 dongle on 5G - and both came back with averages across the various samples I've taken of 109MBbs consistently according to Ookla. It will be interesting to see what evening performance will be like when there is more external local contention, but I've never seen 109MBps from my line before over WiFi so not sure if this is purely due to router performance.

View attachment 16970

Whilst I was at it I tried both a direct ethernet cable connection to the back of the router, and also a direct cable connection through a powerplug over the other side of the house that is also plugged into the back of the router. Both came back with consistent averages of 110MBps. But again, not sure if this is pure router performance.

View attachment 16969

As I said, this is non-VPN performance, so tomorrow I'll download a fresh AirVPN ovn file and see what that brings.

Thanks again.

Looks great so far.

I'm not familiar with the RT-AX88U, but try looking in the USB Applications, Media Services and Servers section for those options.

I would say it is the router with its great hardware and even better firmware that is giving you these increases.

Looking forward to your next update.

 

[Svalbaard]

Thanks very much L&LD, and again, thanks for those links - they were/are immensely helpful.

I hope you don't mind me asking, but on the AirVPN front - I had been using .ovpn config files based on TCP/80 rather than UDP. I know you said you seem to get excellent AirVPN performance so was wondering if there was any preferred selection?

Cheers.

 

[L&LD]

Thanks very much L&LD, and again, thanks for those links - they were/are immensely helpful.

I hope you don't mind me asking, but on the AirVPN front - I had been using .ovpn config files based on TCP/80 rather than UDP. I know you said you seem to get excellent AirVPN performance so was wondering if there was any preferred selection?

Cheers.

Correction: I use OpenVPN. Not familiar with AirVPN.

Hope others answer this for you soon.

 

[JemTheWire]

My AirVPN profiles have been selected using TLS exit node 3 or 4 and UDP port 41185

 

[Svalbaard]

My AirVPN profiles have been selected using TLS exit node 3 or 4 and UDP port 41185

Thanks for this. I'll have a look at getting an .ovpn config file to test that, but overall using my existing UDP443 profile, performance with the new AX88 router looks markedly improved already.

I'll post some details later today.

Thanks again.

 

[Svalbaard]

So just a quick update in terms of VPN performance and I guess to ultimately answer the question I posed originally - yes, when using the baked in Openvpn client there is a definite performance improvement using the AX88 over the AC88. I am using the same set of .OVPN config files from AirVPN and I am now seeing throughput around the 60 - 70 MBps range consistently, rather than the 10 - 40 I was getting with the AC88. I will have a look at playing with the TLS config files suggested earlier to see what that gives, and make one final update later.

Thanks to everyone for their expert input and advice in helping me out here - it is very much appreciated.

 

[doczenith1]

If AirVPN allows the newer GCM ciphers use those over the older CBC ciphers as there is typically a small gain in throughput (note that with GCM you will set your Auth digest to 'none'). In general I believe UDP provides the best speed but some have had better speeds with TCP. Try both and see which performs better for you. As others have mentioned and from my personal experience with PIA the 86U can hit mid 200's of throughput using the vpn client so I would expect similar speeds with the AX88.

 

[Marin]

note that with GCM you will set your Auth digest to 'none

Would that be with any VPN provider? I use AES-256-GCM with NordVPN but my Auth digest is set at SHA512. I would say speeds I get are at approx 90-95% of those issued by ISP.