Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

OpenVPN performance of the RT-AC86U

Discussion in 'VPN' started by RMerlin, Sep 14, 2017.

  1. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    23,925
    Location:
    Canada
    I've run a few iperf tests through an OpenVPN tunnel with the OpenVPN 2.4 server running on the RT-AC86U (on an early alpha build of Asuswrt-Merlin). The iperf client ran on my i7 7700K desktop, and the iperf server was on an i5 5200 laptop, connected on the other side of the RT-AC86U. Both computers are connected over Gigabit Ethernet.

    Tests were run with various ciphers. I used the same iperf parameters as I've used in the past, so these can be compared with my previous test results posted here on SNBForums. From memory, the RT-N66U was getting around 22 Mbps, and the RT-AC68U was around 50-60 Mbps. Both were using AES-128-CBC, with OpenVPN 2.3.

    iperf command parameters:
    Code:
    P:\Tools>iperf -c 192.168.1.10 -M 1400 -N -l 64K -t 30
    
    Here are the results.

    AES-128-CBC + LZO (Adaptive):
    Code:
    [ ID] Interval       Transfer     Bandwidth
    [296]  0.0-30.0 sec    698 MBytes    195 Mbits/sec
    
    AES-128-GCM + LZO:
    Code:
    [ ID] Interval       Transfer     Bandwidth
    [292]  0.0-30.0 sec    735 MBytes    205 Mbits/sec
    
    AES-128-GCM + LZ4:
    Code:
    [ ID] Interval       Transfer     Bandwidth
    [296]  0.0-30.0 sec    768 MBytes    215 Mbits/sec
    
    Interestingly, the performance hit of AES-256-GCM over AES-128-GCM is negligeable, implying that the bottleneck does not lies in the cipher, but in the rest of the OpenVPN code.
    AES-256-GCM + LZ4:
    Code:
    [ ID] Interval       Transfer     Bandwidth
    [292]  0.0-30.0 sec    755 MBytes    211 Mbits/sec
    
    As I expected, this router is a beast for OpenVPN. Performance should be close to that with the GT-AC5300 (Asus's OpenVPN isn't entirely as optimized as my implementation, but it shouldn't be far behind).

    So basically, expect around 200 Mbps of throughput (I doubt the GT-AC5300's extra cores will make any real difference, OpenVPN being single threaded). That's about 4x faster than the RT-AC68U, and probably around 3x faster than the RT-AC88U/RT-AC3100/RT-AC5300.
     
    Last edited: Sep 14, 2017
    LouisvilleUK and Temchenko like this.
  2. Temchenko

    Temchenko Occasional Visitor

    Joined:
    Sep 12, 2017
    Messages:
    11
    Great! Now will have to wait for your firmware to roll out. Really exited about that. Hope that AC86U will be new bestseller for value/money standpoint.

    Отправлено с моего XT1635-02 через Tapatalk
     
    kingnh likes this.
  3. pete y testing

    pete y testing Very Senior Member

    Joined:
    Jul 12, 2011
    Messages:
    1,850
    Location:
    victoria, australia
    just got a hold of one of these to have a look at

    to my big surprise is its form factor , its pretty much the exact same size as the rt-ac68u , so im glad its not a big honking router to start with

    just did a quick samba read throughput and it was sitting around 110Mb/s when tested with my asus pce-ac88 and test comp with my ds415+ connected to the router

    so this thing has some big kahunas
     
  4. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    23,925
    Location:
    Canada
    Asus' stock firmware is also able to push 70 MB/s in write speed (I made it past 100 MB/s in my firmware by adjusting CPU affinity). And that's with SMB2 enabled. Quite impressive compared to past generations.

    Try an OpenSSL speed test for more fun...

    Code:
    [email protected]:/tmp/home/root# openssl speed -evp aes-128-cbc
    Doing aes-128-cbc for 3s on 16 size blocks: 34942605 aes-128-cbc's in 2.98s
    Doing aes-128-cbc for 3s on 64 size blocks: 24912812 aes-128-cbc's in 3.00s
    Doing aes-128-cbc for 3s on 256 size blocks: 11306808 aes-128-cbc's in 3.00s
    Doing aes-128-cbc for 3s on 1024 size blocks: 3619044 aes-128-cbc's in 2.99s
    Doing aes-128-cbc for 3s on 8192 size blocks: 490938 aes-128-cbc's in 2.97s
    OpenSSL 1.0.2j  26 Sep 2016
    built on: reproducible build, date unspecified
    options:bn(64,32) rc4(ptr,char) des(idx,cisc,16,long) aes(partial) idea(int) blowfish(ptr)
    compiler: /opt/toolchains/crosstools-arm-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/bin/arm-buildroot-linux-gnueabi-gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DOPENSSL_NO_HEARTBEATS -DL_ENDIAN -Os -march=armv8-a -fomit-frame-pointer -mabi=aapcs-linux -marm -ffixed-r8 -msoft-float -D__ARM_ARCH_8__ -ffunction-sections -fdata-sections -O3 -Wall -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DAES_ASM -DBSAES_ASM -DGHASH_ASM
    The 'numbers' are in 1000s of bytes per second processed.
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    aes-128-cbc     187611.30k   531473.32k   964847.62k  1239431.79k  1354129.33k
    
    (Make sure to use -evp to get the CPU-enhanced code path).
     
    Voxel likes this.
  5. LouisvilleUK

    LouisvilleUK Occasional Visitor

    Joined:
    Dec 1, 2015
    Messages:
    26
    And... Order has been placed. :)
     
  6. maxbraketorque

    maxbraketorque Regular Contributor

    Joined:
    Dec 6, 2015
    Messages:
    82
    Impressive. Looking forward to hearing about more tests. This router clearly has the potential to completely kill off RT-AC88U sales, so this is yet another reason that I'm also puzzled as to what ASUS plans to do with the RT-AC88U.
     
  7. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    23,925
    Location:
    Canada
    The RT-AC86U is indeed in an odd spot. Price is between the RT-AC68U and RT-AC88U, but performance is better than the RT-AC88U, at the cost of one single stream lost on the 2.4 GHz band, and only LAN 4 ports. If anything, it's the RT-AC3100 that feels redundant now at this point. It might have slightly better coverage than the RT-AC86U due to having four detachable external antennas.

    I wonder if going with a 4x4 design on the 5 GHz band wasn't a last minute change by Asus, as the fourth antenna needed by it is internal.

    The platform still has growing pains, as it's a MAJOR change over past Broadcom products, but it's getting there.
     
  8. pete y testing

    pete y testing Very Senior Member

    Joined:
    Jul 12, 2011
    Messages:
    1,850
    Location:
    victoria, australia

    btw are you using the pce-ac88 for testing ? i have a strange issue with write speeds over the pce-ac88 where it seems to be limiting it to around 22MB/s , irs a brand new test rig with new install of windows 10 and using the asus drivers

    will have a play with OpenSSL once i get this dam write issue sorted

    and thats how i see it too , the 88u is aimed at a different crowd , the 86u is the direct replacement for the 68u ( we dont even get the ac3100 here in OZ anyway ) , and as the direct replacement for the rt-ac68u this is indeed worth the upgrade , this is prob the international version that everyone will get instead of the limited rel;ease of the rt-ac3100

    was ether that or form factor choice , i quite like the fact its not as big as the titanic :) , i will say im still getting 1,6M sync at 15 meters through a semi solid wall on 5 gig and that compares well to the other 2156M 5 gig clients if have tested
     
  9. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    23,925
    Location:
    Canada
    No, all my development is done over Ethernet and serial, from my laptop. I did get some odd SMB results however when I was doing my initial test, I was getting less than 1 MB/s. Was caused by my USB Ethernet adapter being in an USB2 instead of an USB3 port. Which is still odd, as I was getting nowhere close to the 20-30 MB/s I'd expect out of USB2. Finetuning the router's socket options in smb.conf did make a difference. I assume the issue is when the network link isn't fast enough, the router isn't properly filling up the pipe. I don't remember which specific socket option was causing it tho, I'll have to revisit that at a later time.

    So maybe you are experiencing something similar with your wireless adapter.

    One thing you can try is manually running smbd on the second CPU core, using the taskset program (should also be present in stock FW).

    The form factor is indeed really good. Won't appeal to people wanting to wall mount it, but still. It should also be doing fairly good for cooling, even tho they used one single large heatsink.

    BTW if you ever want to dismantle it, the screws are hidden behind the back label. I opened mine so I could hook up some wires to the serial header, ran them out through the back grill. The connector headers barely fit once the router was closed (I had to leave the pcboard screws a bit looser to accomodate for it).

    I need to find wires with shorter connection headers than what ships with all my TTL adapters. So far I was only able to run them through my RT-AC5300 (drilling holes on the side to run them out) and on the back of this RT-AC86U. My RT-AC88U and RT-AC87U have their top permanently left unscrewed, so I can quickly hook up wires to the header.
     
  10. Voxel

    Voxel Senior Member

    Joined:
    Dec 9, 2014
    Messages:
    365
    Interesting. Very impressive...

    Do you have the same results with "-elapsed" option?

    And what does "openssl engine" say?

    Voxel.
     
  11. RMerlin

    RMerlin Part of the Furniture

    Joined:
    Apr 14, 2012
    Messages:
    23,925
    Location:
    Canada
    Not much difference with elapsed:

    Code:
    The 'numbers' are in 1000s of bytes per second processed.
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    aes-128-cbc     192624.81k   540520.01k   969324.08k  1235202.71k  1348357.09k
    
    Asus disabled OpenSSL engines on the HND platform. I had to re-enable them otherwise Tor would fail to build, however there's no Broadcom-specific engine in the firmware (and Asus doesn't even include the default ones either, as they ain't used anyway). At this time, all these improvements come from the B53 architecture and HW AES instructions.

    I haven't had time to dig through the kernel options yet to see if they have a BCM HW acceleration option that could be enabled or disabled, I'm still at the implementation phase for the whole platform. Optimization will come later.
     
    Voxel likes this.

Share This Page