New wireless setup

[John Fallon]

On a good days, when AC86U worked I had full 200 Down and 20 Up speeds with decent ping as well.
My already returned 86U was dropping WLAN on both bands way to often. Spotty coverage and random failed reboots became it's nail to the coffin.
However I've learned more about my requirements in regards to home networking and discovered, that HW Accelerated Encryption is a must for OVPN, so I have to stick with the new generation routers with latest BCM CPUs.
AX92U is on it's way, so I'll keep you updated once I'll be done with testing.

 

[Trip]

lacking very needed HW Acceleration to deal with AES-256-GCM.

Apologies I didn't mention that earlier, to save you the trouble.

@Marin and @John Fallon:

For something baseline viable, relatively inexpensive and easy to manage, the best full LAN-to-WAN ecosystem would probably be UniFi. A Dream Machine would give you the classic "all-in-one", but with expandability, so you could add a UniFi PoE switch and more APs, all as-needed, and adopt and control all of them from a single pane of glass. If there's an easier setup out there, I haven't heard of it. Another ecosystem that's more legacy in style but fairly rock-solid is Cisco RV/SG/WAP small biz stuff. @coxhaus seems to love it. RV gateways are very simple in their capability and the whole ecosystem can't be governed by a single control plane like UniFi can, but the entire stack is very reliable, usually production-ready for the features they do have, and direct support from Cisco is of course way deeper than what Ubiquiti offers.

For specialized wants/needs:

Gateway - If you know you ultimately want to be running services (VPN, etc.) at hundreds of Mb/s or more, and/or just don't want to have to even be concerned with ever being bottlenecked, I would skip right over MIPS/ARM (consumer all-in-ones, Ubiquiti, Mikrotik, etc.) and go straight to x86 hardware. This could be a PC with a multi-NIC card, an embedded appliance (Qotom/Protectli), a 1U rackmount server, whatever. You'd be free to run whatever distro you wanted - OpenWRT, Untangle, pfSense, OPNSense, etc. I would probably suggest pfSense, as it's widely known and proven. A great go-between, as John was thinking, might be a Netgate pre-built appliance, like the SG-3100, which would get your feet wet with something ready-to-go and supported.

Switching - If you go UniFi for wifi, I highly recommend running their switches for the single pane of glass. Otherwise, Cisco SG, HPE OfficeConnect (19__/18__ series) or refurb enterprise. PoE is highly desirable. Layer 2 is enough, but a layer 3 switch would allow you offload even more services from the gateway and learn even more (DHCP, inter-VLAN routing, etc.). I really like Cisco SG350, as it's GUI-based, while also having an IOS-like CLI to learn. For something full-enterprise and totally rock-solid, HPE ProCurve/Aruba (2530 and up) is probably the best buy out there, with a ton of it for dirt cheap on eBay, NetworkTigers, etc. and the failure rates are practically zero. Most 24 and 48-port models can be on the noisier side, but the little 2530-8G-PoE+ or even 2930F-8G-PoE+ are silent, serve as great "mini" core switches for a home network and are awesome to learn on.

WiFi - I would go for something centralized, expandable, even mesh-capable. For most houses/apartments, UniFi is good enough. If you're not thinking of running UniFi switches, though, then UniFi APs alone are less of an obvious choice. TP-Link Omada would be baseline-viable for dirt cheap. Cisco WAP's are rock-solid, albeit not truly controller-based. Then there's integrated controller stuff, where the APs themselves host the controller, and offer master/slave auto-redundancy as well (why UniFi does't have this by now is beyond me...). Aruba Instant On (app or cloud-controlled) or Granstream GWN (app, local web or cloud-controlled) are low priced and very easy to deploy. Then there's big-boy wifi. Aruba, Ruckus, etc. I personally run Ruckus, as the quality of the endpoint connections you get is just tops, regardless of the airspace you're in (you can see my other posts as to why). But the stuff is spendy, for sure. Overall, UniFi should be good enough, but maybe give the other stuff a look as well. Maybe enterprise kit if you're really hankering for overkill, but probably unnecessary.

Hope some of that helps!

 

[Klueless]

On a good days, when AC86U worked I had full 200 Down and 20 Up speeds with decent ping as well.

What VPN speeds did you see with the other home routers you tested? (Wanting to learn from you.)

Apologies I didn't mention that earlier, to save you the trouble.

No worries, it was brought up ...

 

[John Fallon]

What VPN speeds did you see with the other home routers you tested?

Forgot about them so fast. Not necessarily because they were so bad, but simply because they were not fit for my purpose.
Tested both R7800 and WRT3200 with stock and 3rd party FWs (DDWRT, OpenWRT, Voxel) and they never exceeded 20Mbit Down and few Mbit Up. I am sorry for lack of detailed report, but once I have discovered how slow they are with OVPN I`ve prepared them instantly for a return.
Newly bought AX92U waiting to be installed. I am a bit worried, that it isn't backed by any 3rd party FW, but lets hope AsusWRT is good enough in this case and supporting fully all needed functions. Will report back with results once done with testing.
Thank you kindly for all your help, suggestions, kind word and support.
Have a marvellous weekend.

 

[Klueless]

... they never exceeded 20Mbit Down and few Mbit Up. I am sorry for lack of detailed report, but once I have discovered how slow they are with OVPN

Thank you kindly. I really expected better even w/o hardware acceleration. That is detailed enough to keep me from making the wrong mistake : -)

Newly bought AX92U waiting to be installed

Didn't know, that has hardware encryption? Best of luck!

 

[OzarkEdge]

Kind members. With all due respect I have given my AC86U last chance today and it failed even beyond my expectations.
Loaded official, latest FW. Done proper reset. Went through initial setup and few minutes later router died. I won't be touching it again, it deserves its faith.
In regards to my question.
Would you have any decent recommendations?

Persistence. When new hardware fails to perform its basic functions, consider it DOA and exchange it. I think you walked away from a decent home router/VPN solution with options including AiMesh and Asuswrt-Merlin third party firmware.

OE

 

[John Fallon]

AX92U meant to be equipped with Broadcom BCM4906 @ 1.8 GHz quad core, capable of HW Accelerated Crypto, but I am not convinced now if that functionality is fully supported in bare AsusWRT or does it need Merlin's magic to fly..
So far I wasn't able to squeeze speeds I was having with AC86U on both Merlin's & Stock FW.
I can't do better than barely over half of my original bandwidth. Also OVPN client on AX92U seems somewhat unreliable as results are not comparable. Under identical circumstances, once it'll give me 20Mb and seconds later 120Mb downstream. Upstream isn't an issue, roughly 85-100% of OB with reasonable pings of around 20ms.
Not impressed so far at all. This needs to go.
I am afraid, ordering another AC86U is the only viable solution here.

 

[CaptainSTX]

VPN speeds tend to be more highly variable than the speed on the WAN from your ISP.

1. If your ISP WAN speed slows down that will degrade your speed on the VPN.
2. If your VPN provider's server is congested or his pipe to the Internet is congested you slow down.
3. The distance to the VPN server may impact the speed all things being equal.
4. What else is happening on the router at the time of the speed test.
5. Might need a different VPN provider
6. If you have the option you might want to reduce the encryption level.

For Instance on my AC86 running two VPN clients and using spdMerlin to measure connection speeds.

ISP Connection provisioned 200/12 (Normally over provisioned by 20%)

Over the past 7 days: (Test run in the hours 7 AM - 6PM twice hourly)

MAX AVE MIN
WAN 239 207 108
VPN1 - Houston 224 152 61 AES-128 - Distance 805 miles
VPN3 - Atlanta 221 136 56 AES-256 - Distance 473 miles.

 

[Trip]

I am afraid, ordering another AC86U is the only viable solution here.

Perhaps if you're intent on sticking with Asus it may be, but there are many, many other options if you'd be willing to consider some of the other stuff you've looked at, and that I and others have mentioned.

 

[John Fallon]

Events, tests and experiments from this week brought me to one conclusion. It was very silly of me to get so tangled with OVPN, it wasn't worth the hassle at all. OVPN protocol was, is and will be nothing but the bottleneck in most systems and I should probably go with different solution from very beginning.
This morning brought me a clear, new vision of starting again with very different approach. I'll pick the best hardware with most support from communities and then focus on IKE2, WireGuard. Many OEM's and DEV's are clear with their lack of interest in neither of this protocols, so list should be much easier to make. Thankfully both R7800 and WRT3200 are still boxed and waiting for return, so they will be an excellent point to start with as both have plenty of love from communities.
I will keep you updated on my progress.
Thank you kindly for all your support.

 

[Klueless]

I would expect: rock solid performance, decent wireless coverage and good CPU for my OpenVPN client

This morning brought me a clear, new vision of starting again with very different approach. I'll pick the best hardware with most support from communities and then focus on IKE2, WireGuard

Intriguing. So much I don't know. You mentioned that you wanted to run a VPN client on your router. Is that because you didn't want to load a VPN client on all your computing devices? (That might become an alternative in another month : -)

Does everything connect to a VPN service for anonymity and security up and to said service? If you go with a different (non "open") VPN client will you have to change services?

Or are you running split stack, e.g., only using VPN for "work" and riding the wild Internet for everything else? Would "non-Open" work with "work"?

You're suggesting these VPN alternatives have reduced overhead such that they will not overwhelm a router's CPU?

Thanks. I've been enjoying learning (at your expense : -)

 

[Trip]

I've personally been running WireGuard between my EdgeRouter at home and a cloud workstation I run at Vultr and can hit near line-rate with very little tax on the CPU, so it's definitely lightyears ahead in that regard. Plus way simpler to setup. A good potential move if your use-case fits, and it sounds as though this one may.

 

[John Fallon]

I've got familiar with WireGuard documentation, benchmarks and realised quickly it's the future of the virtual private networking.
VPN providers recognized it as a valid option for a good reason and adapted very quickly by adding it's support to their offer (my provider including).
When it comes to OVPN protocol. I think it's only so popular because it's simple in configuration, widely available and supported by all VPN providers, but that's about to change because most using it as a client do realise it's choking their bandwidth without powerful and expensive hardware and even then when compared to other available protocols it's performance is extremely poor.

 

[John Fallon]

In other words, I don't want to spend hundreds of $$$ for new hardware just to get decent results with VPN, when better alternative is available.
That being said, I'll have to wait with final conclusion untill I'll get to setting up WG on my rock solid DDWRT machine and testing it for myself.

 

[CaptainSTX]

I think WireGuard will be useful on routers with processors not optimized or powerful enough to handle OpenVPN at line speeds.

I have run WireGuard on my PC using an App from Astrill and I currently don't see much if any difference between WireGuard and OpenVPN speed wise.

 

[John Fallon]

I think WireGuard will be useful on routers with processors not optimized or powerful enough to handle OpenVPN at line speeds.

That fact alone opens plenty of possibilities and means that I don't have to stick with a handful machines just because they're equipped with SOC supporting HW Acc Cypher much required for barely acceptable OVPN speeds.

I do apologize if I kept my posts in rather sour tone and against OVPN, but discovering Mr. Donenfeld's alternative has suddenly offered a long awaited solution.
As usually, I do kindly thank you all for your highly valuable opinions and suggestions.

 

[Klueless]

Persistence. When new hardware fails to perform its basic functions, consider it DOA and exchange it. I think you walked away from a decent home router/VPN solution with options including ... Asuswrt-Merlin third party firmware.

I almost hate going back to the past especially in light of the OP's new approach of checking out lower overhead VPN alternatives (e.g., Wireguard, etc) but this --> recent post did remind me that RMA is still a valid alternative for some of us.

 

[OzarkEdge]

I almost hate going back to the past especially in light of the OP's new approach of checking out lower overhead VPN alternatives (e.g., Wireguard, etc) but this --> recent post did remind me that RMA is still a valid alternative for some of us.

If I don't trust the vendor return and/or maker RMA process, I wouldn't buy the product in the first place. That's the deal.

OE

 

[Val D.]

What would you recommend from your own experience?

Router/Firewall + Switch + Access Points.
What exactly hardware/software - according to your budget and knowledge.

I like DIY projects, a little distraction from everyday activities. Was planing to do it long time ago, but there was always something more urgent to do around my business. Currently running x86 hardware with pfSense (after some playing with Untangle and OPNsense), 8-port managed switch with PoE and 2 x AC1750 Access Points with PoE. One 5GHz network and one 2.4GHz guest network separated with VLAN. WiFi performance is excellent and roaming is seamless, just had to adjust some sticky clients. OpenVPN is as fast as the other server can send data, >400Mbps easily achievable. CoDel scheduling works perfectly, A and A+ bufferbloat test all the time. IP/DNS Filtering and IDS/IPS Packet Inspection takes care of the bad guys. The power consumption is ~50W most of the time (compared to ~15W for AIO consumer devices), but the performance is stellar.