VPN Perfromance

[LeSilverFox]

I'm a relative newbie and hoping to get some feedback on the overall performance of the VPN client running in ASUS routers.

I have the ac-66u router with Merlin 374.42 loaded. I configured it to use my VPN service provider using OpenVPN. here's the speed I'm getting.
My ISP line is a 16Mb down and 4M up
with no VPN I get 14Mb down and 3.5Mb up (speedtest.net)
with the OpenVPN connected in the router I get 3-4Mb down and 3Mb up
If I connect to the exact same VPN server from a win7 pc or from OsX or from Linux I get 12-13-Mbits down and 3.4mB up

Why is that huge difference from running the client in the router or in a desktop/laptop pc. This model of router should be able to manage much more traffic ? The MTU size is 1500 (I have a DHCP connection to my ISP), set in the router (WAN page). If the MTU was wrong, why would the PCs connecting through the same router get better performance ? What could I tweak ?

Thanks for any pointers..

 

[Adamm]

I'm a relative newbie and hoping to get some feedback on the overall performance of the VPN client running in ASUS routers.

I have the ac-66u router with Merlin 374.42 loaded. I configured it to use my VPN service provider using OpenVPN. here's the speed I'm getting.
My ISP line is a 16Mb down and 4M up
with no VPN I get 14Mb down and 3.5Mb up (speedtest.net)
with the OpenVPN connected in the router I get 3-4Mb down and 3Mb up
If I connect to the exact same VPN server from a win7 pc or from OsX or from Linux I get 12-13-Mbits down and 3.4mB up

Why is that huge difference from running the client in the router or in a desktop/laptop pc. This model of router should be able to manage much more traffic ? The MTU size is 1500 (I have a DHCP connection to my ISP), set in the router (WAN page). If the MTU was wrong, why would the PCs connecting through the same router get better performance ? What could I tweak ?

Thanks for any pointers..

IIRC its due to the fact the router CPU is much weaker then what you have in your PC (600Mhz), this especially effects MIPS routers, you will find better performance on dual core ARM routers (AC56U/AC68U) but you will never have the same performance you get running the client on your PC.

 

[LeSilverFox]

thanks Adamm for the quick reply.

so, does this mean that I can only get 3-4Mb OpenVPN performance on the AC-66U ? I do understand the CPU issue between pc and router but I would have thought the new Ausus routers (like the one I have ) would have no problems dealing with 10-15Mb openvn traffic.

 

[Sky1111]

thanks Adamm for the quick reply.

so, does this mean that I can only get 3-4Mb OpenVPN performance on the AC-66U ? I do understand the CPU issue between pc and router but I would have thought the new Ausus routers (like the one I have ) would have no problems dealing with 10-15Mb openvn traffic.

AC-66U is a decent router, but it is not meant for running VPN Client.
If you can, try it with R7000 (Kong's firmware 24345 is the last known good one) or RT-AC68U with Merlin - you will get much better speeds even without overclocking.

 

[Shonk]

Do you actually need 256bit encryption?

if not you can use PPTP which has 128bit encryption
and tops out at around 39.5mbit at 662mhz on the AC66U

 

[CaptainSTX]

You also need to look at the other factors impacting VPN speeds.

1. Distance from your location to the city where the VPN server is located.

2. The VPN provider. Not all VPN providers have the same size pipe connecting them to the Internet. I have found StrongVPN gives me speeds 2X as fast Astrill, IPVanish, HMA and several others I have tested prior to renewing my annual VPN contract.

 

[rlcronin]

You also need to look at the other factors impacting VPN speeds.

1. Distance from your location to the city where the VPN server is located.

2. The VPN provider. Not all VPN providers have the same size pipe connecting them to the Internet. I have found StrongVPN gives me speeds 2X as fast Astrill, IPVanish, HMA and several others I have tested prior to renewing my annual VPN contract.

A good general guideline, but in this case the OP's pc's get much better speeds to the same vpn provider, so these points are not relevant in this case I suspect.
--
bc

 

[LeSilverFox]

thank you all for the constructive feedback and the many workaround suggested. I will certainly try another VPN provider to see if the speed changes.

After reading dozens of posts here on VPN speeds, many people reported the AC66U is able to manage VPN speeds of 15-20Mbit. I know setups and connection variables are different but I was kinda hoping for a steady 10Mb, which I though would not be overly ambitious. I will certainly try changing the encryption cypher - presently using blowfish (BF-CBC) - I need to check with the provider to see which ones are supported.

As for the distance from the VPN node, that would create latency and packet routing issues and would impact all devices consistently, not just the router...maybe wrong here.

My fallback plan is to get a mini-pc and run pfsense. I'm just not ready to give up on the ASUS yet, there must be something else I can tweak...

 

[sinshiva]

OP, can you alter the server config? if so, post it here with the keys/certs removed, if you still have this provider

 

[LeSilverFox]

thanks sinshiva:
No I can not alter the server config - I'm using vpn.ac as the provider

My question: the same server config and the same server location gives a very good performance on my linux/mac computers but not on the ASUS. Why ?And the ASUS CPU is not maxed for the the 3-4Mb openvpn stream. From memory, it was running around 30% utilization (I used the unix command 'top' to see cpu utilization). I honestly thought it is to do with the MTU setting somewhere but if I had the wrong MTU in the router, i figured all other connected devices would be impacted as well - right ?? Do openvpn clients running in osx or ubuntu have the smarts to auto adjust mtu and ip windows sizes to optimize ?

here's my client config:

Start with Wan: No
Interface type: tun
Protocol: UDP
server address xxxxx port: 1194
Firewall:automatic
Authorization :TLS
Username/password: Yes
Username xxx
Password xxx
Username Auth Only: Yes
Extra HMAC : Disabled
Create NAT: Yes
poll interval:0
redirect traffic: yes
accept DNS: Exclusive
Encryption cipher: BF-CBC
TLS regeneration time: -1
Connection retry: 30
Verify server certificate: No
Customer config:
persist-key
persist-tun
tls-client
remote-cert-tls server

 

[sinshiva]

try adding;

mssfix 1399

 

[LeSilverFox]

Great, thanks for the hint.

So the value of 1399 wasn't the best fit but I read up on the mssfix/mtu sizing and I settled on mssfix 1450 . And this gave me an increase from 4.1Mbit to 6.7Mbit downstream speed. This I can live with..(for now).

Again, thank you for the excellent suggestion..