Since implementing OpenVPN, I've spent quite some time trying to squeeze out more performance out of it. The 600 MHz MIPS processor in the N66/AC66 simply lacks the raw power to be able to achieve very high OpenVPN performance when going through a fast (30+ Mbits) Internet connection.
For historical interest, here are the results of past improvements. These are throughput rates measured by running an iperf server on the router, and an iperf client on the WAN side. The client and router were connected over an OpenVPN tunnel (over my LAN, so the Internet connection is not a factor - this is on a Gigabit LAN).
The tunnel is TUN-based, with AES-128-CBC as cipher.
Note that since I was running the iperf server on the router itself (for simplicity), these numbers might not be the true maximum speed you could reach through a tunnel. But as all tests were done with the same setup, the performance jumps are a valid reference.
Router is either an RT-AC66U or an RT-N66U (they should have the same performance).
Oldest test data I have in my notes:
With 270.25, I was compiling openssl + openvpn + lzo with -O3 compiler optimizations, and I also backported all the native ASM code from OpenSSL 1.0.1 into the 1.0.0 version used by Asuswrt.
I lost track of other improvements occurring in the following releases (some could be from Asus themselves), but still some improvement in the latest public release:
And now, the latest bit of nitro that got poured into the firmware:
This latest optimization done by the compiler is applied firmware-wide, so it might improve general performance of the whole router, not just OpenVPN.
So between 270.24 and 374.33, there's been quite some improvements, going from 19.5 Mbits/s to 26.1 Mbits/sec. Not bad
For historical interest, here are the results of past improvements. These are throughput rates measured by running an iperf server on the router, and an iperf client on the WAN side. The client and router were connected over an OpenVPN tunnel (over my LAN, so the Internet connection is not a factor - this is on a Gigabit LAN).
The tunnel is TUN-based, with AES-128-CBC as cipher.
Note that since I was running the iperf server on the router itself (for simplicity), these numbers might not be the true maximum speed you could reach through a tunnel. But as all tests were done with the same setup, the performance jumps are a valid reference.
Router is either an RT-AC66U or an RT-N66U (they should have the same performance).
Oldest test data I have in my notes:
Code:
=== 3.0.0.4.270.24:
AES-128-CBC [152] 0.0-30.0 sec 69.9 MBytes 19.5 Mbits/secWith 270.25, I was compiling openssl + openvpn + lzo with -O3 compiler optimizations, and I also backported all the native ASM code from OpenSSL 1.0.1 into the 1.0.0 version used by Asuswrt.
Code:
=== 3.0.0.4.270.25 (with openvpn + openssl + lzo optim):
AES-128-CBC [152] 0.0-30.0 sec 79.5 MBytes 22.2 Mbits/secI lost track of other improvements occurring in the following releases (some could be from Asus themselves), but still some improvement in the latest public release:
Code:
=== 3.0.0.4.374_32:
AES-128-CBC 0.0-30.0 sec 84.8 MBytes 23.7 Mbits/secAnd now, the latest bit of nitro that got poured into the firmware:
Code:
=== 3.0.0.4.374.33_Alpha3
AES-128-CBC 0.0-30.1 sec 93.8 MBytes 26.1 Mbits/secThis latest optimization done by the compiler is applied firmware-wide, so it might improve general performance of the whole router, not just OpenVPN.
So between 270.24 and 374.33, there's been quite some improvements, going from 19.5 Mbits/s to 26.1 Mbits/sec. Not bad
