Good router for NordVPN on 1Gbps connection?

[lmerega]

Hi all, right now I am using Asus RT-N66U fo my VDSL connection.
I use NordVPN and I have no more than 10 mbps up/down because of sha-256 weight.
I am moving on a 1 Gbps FTTH connection and it's time to change router.
I would like to continue using NordVPN and I would like an alternative FW (Merlin, DD-WRT, Tomato, ecc. ecc.)
Which could be a good router not too expensive to satisfy my requests?

TIA

Luca

 

[CaptainSTX]

Hi all, right now I am using Asus RT-N66U fo my VDSL connection.
I use NordVPN and I have no more than 10 mbps up/down because of sha-256 weight.
I am moving on a 1 Gbps FTTH connection and it's time to change router.
I would like to continue using NordVPN and I would like an alternative FW (Merlin, DD-WRT, Tomato, ecc. ecc.)
Which could be a good router not too expensive to satisfy my requests?

TIA

Luca

Before spending the money for a router which you will have to do. After you get your 1 gig connection test running the NordVPN app directly on a very powerful PC with a gigabyte Ethernet port and see what speeds you can get. With many or most VPN providers you probably won't get much more than a 200 Mbps download speed. I only get 125 -145 Mbps from mine. Some people report higher speeds. For whatever reason most VPN providers don't have the processing power or bandwidth to give you super high speeds.

To duplicate the speed on your PC you will need to to build a custom box running Pfsense, OpenWRT, or something else with a fast Intel processor with AI-NES support. Some SOHO routers have fast processors but none as powerful as an I5 or I7 processor so your speed will probably be less than 100 Mbps.

 

[System Error Message]

gigabit* ethernet port, not gigabyte.

a lot of x86 PCs will manage 1Gb/s of VPN if it has decent IPCs (no core2s, AMDs (except ryzen)) on a tough encryption scheme.

as for routers some mikrotik routers are capable of 300-500Mb/s of VPN per core if you use AES. If not relying on hardware acceleration, Pick ARM over MIPS. ARM A12,15 are faster than ARM A9. ARM A9 is faster than ARM A7 only by a bit. The new 64 bit ARM is quite decent. None of these will get you 1Gb/s though as for that you need x86. Even on x86 not all encryptions are hardware accelerated.

 

[lmerega]

I know I will have a decreased speed, but sometimes I do nooed VPN and I would like not to decrease too much.
400/500 Mbps would be wonderful, I thought about 200 or 300 Mbps maximum.
That said, I do not have time to build a custom box, isn't there a router with a good CPU like the mentioned above?

TIA

 

[RMerlin]

isn't there a router with a good CPU like the mentioned above?

None that will give you 500 Mbps with OpenVPN, no.

The best I have seen so far is the Asus RT-AC86U which can hit 200 Mbps with OpenVPN using AES-128-CBC, and that's by using Broadcom's HW crypto acceleration module. Performance would probably be lower using AES-256-CBC.

Anything beyond that with OpenVPN will require a desktop-class CPU.

 

[lmerega]

Now I am using RT-N66U with your great FW.
NordVPN requires AES256CBC.
My max down/up speed is 10/10 mbits.
Do you think that moving to AC68U will increase at least to 100 mbps?

TIA

 

[CaptainSTX]

Now I am using RT-N66U with your great FW.
NordVPN requires AES256CBC.
My max down/up speed is 10/10 mbits.
Do you think that moving to AC68U will increase at least to 100 mbps?

TIA

NO. I use the AC1900P with a 1.4 Ghz processor and I get download speeds of 60 - 70 Mbps. My ISP without the VPN tests at 170 - 180 Mbps.

 

[MichaelCG]

Have you even tested if NordVPN can even provide 100Mbps? Before you go off on a journey for a new router, I would suggest testing from a decently powerful desktop or laptop to confirm what speeds you can really get from them.

 

[MichaelCG]

That said, I do not have time to build a custom box

You realize you can easily get 100Mbps out of a 5+ year old x86 box? Getting pfSense up and running should take you under 60 minutes assuming you know very basic PC skills. My system is built from a much older Core2 box that I had to add in a 2nd network interface card. Boot it, follow the menu prompts to do basic network config, then open the WebUI to complete configuration.

Now in my case, finding a local store that carries 4-5 year old decommissioned Enterprise desktops for under $100 happens to be very easy....which I know isn't the case for everyone.

 

[CaptainSTX]

Before committing to use Pfsense do some research, read a manual on it and be willing to commit the time necessary to get it up and running. It is powerful and has many, many great features but loading it onto a system and getting it running with advanced features such as VPN will probably take you longer than sixty minutes the first time you set up.

 

[lmerega]

With NordVPN app on my PC I can reach 200 Mbps (my maximum right now) with no problems.
That said, I know how to install and configure pfsense, but I already have too many boxes (raspbx, NAS, my PC, my Laptop, my wife's Laptop, etc. etc.) and PCs running.
Everything I can use in an embedded system is welcome ;-)

 

[RMerlin]

Now I am using RT-N66U with your great FW.
NordVPN requires AES256CBC.
My max down/up speed is 10/10 mbits.
Do you think that moving to AC68U will increase at least to 100 mbps?

TIA

No, especially not with AES-256-CBC. I wouldn't expect more than 30, maybe 40 Mbps top with that cipher.

 

[MichaelCG]

It is powerful and has many, many great features but loading it onto a system and getting it running with advanced features such as VPN will probably take you longer than sixty minutes the first time you set up.

Good point...I am pretty sure I can get my basic pfSense box up in under 30 minutes...but you are correct, I burned another couple hours working to get OpenVPN fully functional on mine.

I also understand the desire to not add yet another big box running...but with the requested performance out of OpenVPN, it is unlikely to be achieved on consumer grade routers at this time. It is getting better...but still not quite there.

 

[CaptainSTX]

Good point...I am pretty sure I can get my basic pfSense box up in under 30 minutes...but you are correct, I burned another couple hours working to get OpenVPN fully functional on mine.

I also understand the desire to not add yet another big box running...but with the requested performance out of OpenVPN, it is unlikely to be achieved on consumer grade routers at this time. It is getting better...but still not quite there.

The problem I had getting the VPN client running on Pfsense is that there are differences/ inconsistencies between Pfsense versions so what you read in your manual or see in the numerous YouTube videos may not apply to the version of Pfsense you are running. I was not able to get Astrill VPN to run and their support couldn't or wouldn't help. Finally changed to running OpenWRT and StrongVPN.

 

[NaX3R]

I'm in the same situation as OP with the difference that I use different VPN provider and need a router which would give me speeds of 50 Mbps down and 9 Mbps Up as my current router is crap and I only can get maximum 10 - 15 Mbps.

The solution would be to either get a router or small PC Box which I can use for OpenWRT or PFSense, any suggestions ? What's interesting from my research and what I have heard is that I can get a VIA (IGEL) ThinClient which are cheap and good for this purpose because they support encryption by default and can achieve high speeds. Also add NIC card to it and install PFSense and we should be set, I think. However, I'm confused about which one to get as where I live, I couldn't find any IGEL ThinClients. I need something small, power efficient so it won't draw much power and powerful enough to process encryption so I would get normal speeds.

 

[System Error Message]

intel atoms with hardware crypto, thats what you want. There are intel atom that are meant for low power servers and are likely to have hardware crypto. Make sure to use the encryption that the hardware supports for the best performance.

Recently intel came out with 16 core intel atom for servers where the boards are either supermicro or gigabyte.