spdMerlin WAN speed is correct...VPN is very low!!

[rwheaton1]

I have been driving myself crazy trying to figure out my VPN speed. I recently purchased NordVPN and I pull 1.4GB through Comcast/Xfinity. After configuring my VPN my speedtests no longer automatically show a WAN test and now are under VPN1C. It only shows around 100 to 200 mbps range but when I run an OOKLA test, from my laptop that is hardwired via a gigabyte connection, I just about get a gigabyte. Anyone have insight into this? Any information you need to help diagnose this problem? I do not have QOS turned on. Love all your scripts Jack!!!

 

[Ripshod]

The speed results are easy to explain. Testing with the router uses the router's limited cpu, whereas testing on a laptop uses the laptop's much more capable cpu.
Are you routing everything through the VPN? That may explain the lack of WAN results.

 

[rwheaton1]

The speed results are easy to explain. Testing with the router uses the router's limited cpu, whereas testing on a laptop uses the laptop's much more capable cpu.
Are you routing everything through the VPN? That may explain the lack of WAN results.

Yes, everything is going through the VPN. I might add my AppleTV to use WAN...don't know if that would then do a WAN test.

 

[Viktor Jaep]

Yes, everything is going through the VPN. I might add my AppleTV to use WAN...don't know if that would then do a WAN test.

The VPN speed isn't able to go above 200-300Mbps max on our routers, mostly limited to CPU performance, distance to your newest VPN server, and maximums imposed by your VPN provider. The highest I've been able to get is about 230Mbps on NordVPN with a 1Gbps WAN connection.

 

[rwheaton1]

The VPN speed isn't able to go above 200-300Mbps max on our routers, mostly limited to CPU performance, distance to your newest VPN server, and maximums imposed by your VPN provider. The highest I've been able to get is about 230Mbps on NordVPN with a 1Gbps WAN connection.

So, basically I need a vpn device that can actually handle at least gigabyte speed. Thanks for the help!!

 

[visortgw]

So, basically I need a vpn device that can actually handle at least gigabyte speed. Thanks for the help!!

No VPN will be as fast as the unencrypted Internet connection that it utilizes.

 

[Viktor Jaep]

So, basically I need a vpn device that can actually handle at least gigabyte speed. Thanks for the help!!

A PC or Pi device could do the trick, as long as the VPN provider lets you consume that much bandwidth.

 

[Tech9]

So, basically I need a vpn device that can actually handle at least gigabyte speed.

You may get close to Gigabit eventually, but unlikely. You are not getting Gigabyte speed with any device.

 

[rwheaton1]

Thank you for everyone's input!!!

 

[rwheaton1]

A PC or Pi device could do the trick

I've been wanting a Pi device

 

[Tech9]

Raspberry Pi and similar low power ARM devices won't give you Gigabit speeds on VPN. You need x86 hardware 6th gen i3 or better and WireGuard. For Gigabit on OpenVPN you need fast i7 core. The whole all network VPN idea is seriously flawed and usually leads to wasted money on extra hardware and user experience disappointment. You don't get any extra security with commercial VPN services. You just pay for promises. More information:

News - Don't use VPN providers - use your own...

Interesting take on things... https://gist.github.com/joepie91/5a9909939e6ce7d09e29 Personally, I do use VPN (quite a bit) but that is inbound to my router from my clients when I'm outside - I do have a VPS in the cloud (DigitalOcean at present, I was on Oracle Public Cloud for quite some...

www.snbforums.com

 

[js28194]

AES-NI instruction set strikes again. Even with that, full throughput is not happening.

 

[Viktor Jaep]

Raspberry Pi and similar low power ARM devices won't give you Gigabit speeds on VPN. You need x86 hardware 6th gen i3 or better and WireGuard. For Gigabit on OpenVPN you need fast i7 core. The whole all network VPN idea is seriously flawed and usually leads to wasted money on extra hardware and user experience disappointment. You don't get any extra security with commercial VPN services. You just pay for promises. More information:

News - Don't use VPN providers - use your own...

Interesting take on things... https://gist.github.com/joepie91/5a9909939e6ce7d09e29 Personally, I do use VPN (quite a bit) but that is inbound to my router from my clients when I'm outside - I do have a VPS in the cloud (DigitalOcean at present, I was on Oracle Public Cloud for quite some...

www.snbforums.com

Just rip and replace with an intel chip on the Pi... all good! Bolt on some extra antennas... rock on and profit!

 

[torch]

You can get close to full Gigabit on OpenVPN. I have OpenVPN running on Asus RT-AX86U (latest Merlin) at home (Google 1G fiber) and have tested 840Mbps from a couple of the ISPs in SLC to ATL (USA) using AES-256-GCM cipher with only fast-io custom config on the server side. Clients have been MacBooks using OpenVPN config on latest Tunnelblick which is also OpenVPN 2.6.5
https://tunnelblick.net/downloads.html

You can check your ciphers on your router:

openvpn —show-ciphers

And the speed of various ciphers (higher is better):

openssl speed -elapsed -evp aes-256-gcm
openssl speed -elapsed -evp chacha20-poly1305

CHACHA20-POLY1305 is the cipher used by Wireguard.

 

[Tech9]

I have OpenVPN running on Asus RT-AX86U (latest Merlin) at home (Google 1G fiber) and have tested 840Mbps

Every single user so far reporting impossible for this CPU core OpenVPN speeds had IPv6 leak or other inaccurate speed measurement.

 

[torch]

So you have proof that it is impossible....

 

[Tech9]

Yes, on 386/388 firmware it doesn’t go above 180Mbps. On older 384 firmware and routers with the same CPU cores 250Mbps was possible. The difference comes from newer OpenVPN versions used in newer firmware. There are security improvements, but with performance loss. You can’t get 840Mbps out of this CPU core. OpenVPN uses single CPU core only.

 

[torch]

Sorry - your opinion is not proof.
Current Merlin on AX86U runs OpenVPN 2.6.5 which defaults to AES-258-GSM & AES-128-GSM, which openssl 1.1.1u provides. That cipher is much faster on the AX86U than the CHACHA20-POLY1305 (Wireguard) as can be seen by running the openssl speed tests. Of course client has to also use the same cipher to get good results. And both server & client have to be configured correctly; OpenVPN 2.6.x has changed/deprecated some parameters.
https://build.openvpn.net/man/openvpn-2.6/openvpn.8.html
I did see some theoretical OpenVPN performance calculations based on openssl
https://x3mtek.com/openvpn-performance/
but they are not necessarily real world. I would welcome others to test...YMMV

 

[Tech9]

All I'm trying to tell you what you see is perhaps not what you think it is. End of story.

 

[doczenith1]

@torch this is an old thread but does backup @Tech9's claim that the AX86U is not doing 840 Mbps over OpenVPN. While the cores in your AX86U are faster than the AC86U used in the thread they are not 3x faster.

OpenVPN performance of the RT-AC86U

I've run a few iperf tests through an OpenVPN tunnel with the OpenVPN 2.4 server running on the RT-AC86U (on an early alpha build of Asuswrt-Merlin). The iperf client ran on my i7 7700K desktop, and the iperf server was on an i5 5200 laptop, connected on the other side of the RT-AC86U. Both...

www.snbforums.com