Poor VPN speed when using Asus OpenVPN Client

[Geraner]

Hi,

I made a comparison of a couple of VPN providers in connection to internet speed, when configuring an Linksys WRT1900ACSv2 router with DD-WRT firmware inside. Using the DD-WRT OpenVPN client function to have the router encrypting all traffic directly.
You can read about the review in this link.

As you see in the review I usually get speeds between 70 and 140 Mbit/s depending on which VPN provider I'm using.

I have today moved back to my Asus RT-AC88U router, and updated it to the latest Merlin firmware 382.1_2.
I configured a few VPN providers in the OpenVPN settings of the router and found out that the internet speed is terrible compared to the tests I did on my Linksys router with DD-WRT firmware.

I between 40 and 60 Mbit/s. No matter which VPN provider I'm using.
For example with PIA (Private Internet Access) I recveived in the past 123 / 102 Mbit/s.
Now with the Asus router I'm getting only 41 / 43 Mbit/s.

The performance of both routers should be rather equal. Both have dual core Processors 1,4 GHz (Asus) and 1,6 GHz (Linksys).

Why is the VPN speed so low when using the Asus router?

 

[ColinTaylor]

Run top on each router when you're doing the test to see the CPU load.

I wonder whether the Asus is only using one core of the CPU vs. the Linksys using two?

Also check that the actual encryption level being used is the same.

 

[Geraner]

Well, was running top and htop on the ASUS router while doing a speedtest.
You are right, the ASUS is only using one core. Total CPU usage goes never over 49%.
Don't have the Linksys connected to my network now, but can make similar tests once again later with the Linksys router.
Anyway, encryption settings are used the same. Default settings for each VPN provider.

Is the ASUS then really a dual core router, if the software on it can't address work to two CPU's at the same time? Hmm ... or is it a bug in the Ausus OpenVPN package implementation?

 

[ColinTaylor]

Is the ASUS then really a dual core router, if the software on it can't address work to two CPU's at the same time? Hmm ... or is it a bug in the Ausus OpenVPN package implementation?

It's definitely dual core , but it does require the software to be written and complied to take advantage of it.

You said you were using 382.1_2, was the older branch (380) any different?

 

[john9527]

OpenVPN is single threaded....it can't take advantage of more than one core. Always been that way for all platforms.

 

[Geraner]

Well, I will try to do some more in-detail "top" result comparison tomorrow.

Anyway, I was thinking about the software which is on the two routers. Both are build on Linux.
When checking the Asus router, the linux kernel version on this is:
Linux RT-AC88U-7998 2.6.36.4brcmarm #1 SMP PREEMPT Sat Dec 2 00:55:19 EST 2017 armv7l ASUSWRT-Merlin

When checking the Linksys router, it's running with DD-WRT firmware linux kernel:
Linux 4.9.66 #80 SMP Fri Dec 1 06:24:04 CET 2017 armv7l

Maybe I should flash the RT-AC88U with DD-WRT firmware, and do the same test again. I saw there was a DD-WRT firmware for this model available. But only 4 LAN ports are working on the router when using DD-WRT. (still a bug that isn't fixed).

 

[RMerlin]

The Linksys CPU has hardware-accelerated crypto, the RT-AC88U does not.

 

[DonnyJohnny]

I think those who want to compare between models in Openvpn speed can use this site as benchmark.
https://wiki.openwrt.org/doc/howto/benchmark.openssl

Strangely ac86u is a cheaper yet better model than the ac88u. Misleading numbering. Haha ..

 

[Geraner]

The Linksys CPU has hardware-accelerated crypto, the RT-AC88U does not.

Thanks RMerlin. That would explain the differences in OpenVPN speed when comparing those two routers.

 

[Tadas]

What a disappointment never again buy asus crap routers.

 

[Geraner]

Just because it was requested, below the results from the "top" command, while using the OpenVPN client in both routers. Using PIA with the same settings.
Copied during the 4th / 5th speedtest run on each device.

ASUS RT-AC88U - Firmware: Merlin 382.1_2
Speed Downlink 42 Mbit/s
Speed Uplink 40 Mbit/s

Mem: 206208K used, 309096K free, 2492K shrd, 2872K buff, 16396K cached
CPU: 17.6% usr 9.0% sys 0.0% nic 48.9% idle 0.0% io 0.0% irq 24.3% sirq
Load average: 0.77 0.39 0.19 2/127 1058
PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND
647 1 admin R 4620 0.9 0 46.0 /etc/openvpn/vpnclient4 --cd /etc/openvpn/client4 --config config.ovpn
305 1 admin R 7664 1.4 1 1.9 nt_center
3 2 admin SW 0 0.0 0 1.2 [ksoftirqd/0]
285 1 admin R 4900 0.9 1 0.9 /sbin/netool

Linksys WRT1900ACSv2 - Firmware: DD-WRT v3.0-r34080 std (12/14/17)
Speed Downlink 109 Mbit/s
Speed Uplink 78 Mbit/s

Mem: 68968K used, 442880K free, 0K shrd, 6824K buff, 12984K cached
CPU: 31.2% usr 10.2% sys 0.0% nic 43.2% idle 0.0% io 0.0% irq 15.2% sirq
Load average: 0.54 0.26 0.11 2/77 2291
PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND
2000 1 root R 3276 0.6 1 49.9 openvpn --config /tmp/openvpncl/openvpn.conf --route-up /tmp/openvpncl/route-up.sh --route-pre-down /tmp/openvpncl/route-down.sh --daemon
1769 1 root S 4404 0.8 1 0.2 httpd -p 80
1263 1 root S 2268 0.4 0 0.2 hostapd -B -P /var/run/ath1_hostapd.pid /tmp/ath1_hostap.conf

As RMerlin already said above, what the reason for these differences are.

The Linksys CPU has hardware-accelerated crypto, the RT-AC88U does not.

Only users who have internet connections over about 40 Mbit/s Downlink or Uplink will come to the limits which the RT-AC88U brings due to the lack of CPU hardware-accelerated crypto.

I have now changed back to my Linksys router. Having 12+ devices connected to my home network, having a general good internet speed I don't want to loose more than the half of the internet speed when using a VPN in the router.

Question to RMerlin:
Are there already Asus routers existing which do support CPU has hardware-accelerated crypto?

 

[Tadas]

time change asus router thanks for information

 

[RMerlin]

Are there already Asus routers existing which do support CPU has hardware-accelerated crypto?

The RT-AC86U can hit 200 Mbps with OpenVPN.

 

[Geraner]

Interesting when comparing prices and release dates of those two routers here in Sweden.
RT-AC88U - Release date 2015-12-17. Price today: ca. 360 Euro.
RT-AC86U - Release date 2017-09-07. Price today: ca. 290 Euro.
It's really a shame that the RT-AC88U is missing this hardware-accelerated crypto. CPU 1.4 GHz vs 1.8 GHz should not be such a huge difference otherwise.
I want to see a RT-AC86U with 8 LAN ports. A real upgrade for the RT-AC88U!

 

[RMerlin]

It's really a shame that the RT-AC88U is missing this hardware-accelerated crypto. CPU 1.4 GHz vs 1.8 GHz should not be such a huge difference otherwise.

It's like comparing a Pentium 3 to a Pentium 4. The RT-AC88U bcm4709 and the RT-AC86U BCM4906 are two different CPU generations. Cortex A9 versus Cortex B53. You can't compare them by their clock rates.

 

[DonnyJohnny]

It's like comparing a Pentium 3 to a Pentium 4. The RT-AC88U bcm4709 and the RT-AC86U BCM4906 are two different CPU generations. Cortex A9 versus Cortex B53. You can't compare them by their clock rates.

That’s cheating.. trying to deceive the consumer with the model number.. hahaha... my isp is pushing RT-AC88U. Guess the profit margin is much higher than ac86u

 

[doczenith1]

For example with PIA (Private Internet Access) I recveived in the past 123 / 102 Mbit/s.
Now with the Asus router I'm getting only 41 / 43 Mbit/s.

The 88U can do better than what you are observing. I did some testing a while back (January 2017) and got the following speeds using the OpenVPN client on an Asus RT-AC3100 (same hardware as 88u) running Asuswrt-Merlin 380.64 firmware. Connecting to PIA VPN servers on port 1198 via UDP.

AC3100 (1.4 Ghz dual core)
CTF (Cut Through Forwarding NAT Acceleration enabled)
DL :74 Mbps with core 1 at 30%, core 2 at 85%
UL: 84 Mbps with core 1 at 35%, core 2 at 100%

The speed tests were conducted over a wired connection from the computer to the router.

Data encryption: AES-128-CBC
Data authentication: SHA1

 

[unsynaps]

The RT-AC86U can hit 200 Mbps with OpenVPN.

I really wish this info (stuff like CPU accelerated things) was more prominently on the product pages.

 

[Geraner]

Just tested it again. Can't confirm the speed's you are writing above.
With PIA I'm getting not mor than max. 45 Mbit/s in both directions with the same settings as you describe.
Testing AirVPN I'm getting nearly 50 Mbit/s. Anway, still far away from the speed I'm used to with the WRT1900ACSv2 and DD-WRT firmware.

 

[CheffieCT]

The RT-AC86U can hit 200 Mbps with OpenVPN.

Hi @RMerlin

I just have one quick question for you seeing you are the developer for the MerlinWRT firmware for Asus devices. Would you recommend to get ASUS router using your software or rather get Linksys router like WRT1900ACS to manage OPENVPN effectively? Please note I do have 100/25mbps link.

Your recommendation is highly appreciated.