Expect VPN speed

[Rick Mathes]

I have installed PIA vpn service on my AC68u with latest firmware 378_56_2. My normal no vpn speed is 60Mbps. When my vpn is turned on I am only getting 7Mbps. Is that all I can expect.

 

[System Error Message]

what VPN type are you using?

 

[Rick Mathes]

privateinternetaccess dot com (PIA) or is that not what you mean. This is all new to me. I am running openvpn if thats what you mean

 

[Nullity]

Encryption really bogs down the embedded CPUs in routers. 7Mbit is a slower than I would expect with the AC68U, though...

Have you checked the CPU load while speedtesting the VPN? If the CPU never maxes out, your VPN provbider might be the problem.

 

[Rick Mathes]

The maximum load on my cpu is 42% while speedtesting.

 

[Nullity]

You may be hitting as CPU load limit. If that is true, you could try using a different encryption like aes128 rather than aes256 so that the CPU load per bit would drop.

 

[joegreat]

I have installed PIA vpn service on my AC68u with latest firmware 378_56_2. My normal no vpn speed is 60Mbps. When my vpn is turned on I am only getting 7Mbps. Is that all I can expect.

Hi,

I run OpenVPN with the provider Perfect Privacy and get up to 40-50 MBit down stream and ~10 MBit upstream (on a 150/15 connection). So you better blame you VPN provider...

My AC68U router is overclocked to 1200,666 speed (to be set in the init-start script as Asus overwrites the values on boot) - check the real CPU speed with cat /proc/cpuinfo and look for BogoMIPS near to 2400.

With kind regards
Joe

 

[Nullity]

Hi,

I run OpenVPN with the provider Perfect Privacy and get up to 40-50 MBit down stream and ~10 MBit upstream (on a 150/15 connection). So you better blame you VPN provider...

My AC68U router is overclocked to 1200,666 speed (to be set in the init-start script as Asus overwrites the values on boot) - check the real CPU speed with cat /proc/cpuinfo and look for BogoMIPS near to 2400.

With kind regards
Joe

What encryption cipher and key-size (128, 192, 256?) do you use?

(I dunno if key-size is the right term.)

 

[System Error Message]

openVPN speeds for these routers arent exactly good because of the CPU. If you want wirespeed VPN you would be looking at x86 or one of those routers that i use that has 36 cores. The router maxes out at 10Mb/s at his frequency but download comes from an x86 server that is the VPN provider.

Its possible his downloads use a lower encryption size compared to upload.

 

[john9527]

I have installed PIA vpn service on my AC68u with latest firmware 378_56_2. My normal no vpn speed is 60Mbps. When my vpn is turned on I am only getting 7Mbps. Is that all I can expect.

I'm also on PIA and get in the 55Mbps range on my AC68R overclocked to 1200,800.

For best speed on PIA use UDP, port 1196 and cipher AES-128-CBC

Note that your ISP can also be traffic shaping. Some people seem not to be able to get the higher speeds no matter what they try.

 

[Rick Mathes]

I'm also on PIA and get in the 55Mbps range on my AC68R overclocked to 1200,800.

For best speed on PIA use UDP, port 1196 and cipher AES-128-CBC

Note that your ISP can also be traffic shaping. Some people seem not to be able to get the higher speeds no matter what they try.

Unfortunately it made no difference or maybe even a little slower. Going to try a different vpn location.

 

[joegreat]

What encryption cipher and key-size (128, 192, 256?) do you use?

(I dunno if key-size is the right term.)

The Perfect Privacy standard setup uses Cipher 'AES-256-CBC' for both directions:

Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication

 

[Rick Mathes]

I just have it set to default so don't know exactly what that would be.

 

[joegreat]

I just have it set to default so don't know exactly what that would be.

Here we go: The renewal of the key gives you the final answer!

Full log:

Nov  7 08:34:42 openvpn[1486]: TLS: tls_process: killed expiring key
Nov  7 08:34:45 openvpn[1486]: TLS: soft reset sec=0 bytes=75485/0 pkts=671/0
Nov  7 08:34:46 openvpn[1486]: VERIFY OK: nsCertType=SERVERNov  7 08:34:49 openvpn[1486]: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Nov  7 08:34:49 openvpn[1486]: Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Nov  7 08:34:49 openvpn[1486]: Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Nov  7 08:34:49 openvpn[1486]: Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Nov  7 08:34:49 openvpn[1486]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-CAMELLIA256-SHA, 4096 bit RSA

 

[Nullity]

AFAIK, there is no known method of practically decrypting aes-128 in a timely manner, so it is safe to use and will most likely yield you 2x the throughput.

For things needing long-term storage, choose the strongest enncryption possible, but for things like browsing, aes-128 should be fine... unless you are an enemy of the state.

 

[joegreat]

AFAIK, there is no known method of practically decrypting aes-128 in a timely manner, so it is safe to use and will most likely yield you 2x the throughput.

Well,

I am perfectly happy with the throughput of my router's VPN connection (see above), as it's used for browsing only and for a few users. And as my provider uses per default AES-256: I do not want mess round with different settings.

In case I would need more VPN throughput (e.g. for downloads) I could still connect directly from one of my PCs/Notebooks and get higher speed. But: Depending on the traffic at the VPN server and the download server it might not be even more then via the router...

With kind regards
Joe

 

[Nullity]

Well,

I am perfectly happy with the throughput of my router's VPN connection (see above), as it's used for browsing only and for a few users. And as my provider uses per default AES-256: I do not want mess round with different settings.

In case I would need more VPN throughput (e.g. for downloads) I could still connect directly from one of my PCs/Notebooks and get higher speed. But: Depending on the traffic at the VPN server and the download server it might not be even more then via the router...

With kind regards
Joe

My bad. I should have made it clear I was talking to the OP.