1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

OpenVPN performance of the RT-AC86U

Discussion in 'VPN' started by RMerlin, Sep 14, 2017.

  1. Xentrk

    Xentrk Part of the Furniture

    Joined:
    Jul 21, 2016
    Messages:
    2,890
    Location:
    The Land of Smiles
    Not sure the provider is the issue. The 40 mbps line may be the bottleneck. Geo distance between you and the VPN server is another variable. I only had my hands on one for a few hours and did not have the opportunity to test on my 200 Mbps fiber connection. On my pfSense box, VPN performance using Ethernet connection is rather significant compared to wireless as WiFi can’t process jumbo frames. Make sure you test both Ethernet and wireless connectivity.
     
  2. Stevie

    Stevie Occasional Visitor

    Joined:
    Mar 4, 2018
    Messages:
    13
    Yeah I'm on vdsl atm, until I get 100mb fibre in the area. I used PIA and got about 25mb to UK, London server. Will try different providers and different servers.

    I'm also from another continent, so like you said will influence the speeds.

    Sent from my VKY-L09 using Tapatalk
     
  3. payandplay

    payandplay Occasional Visitor

    Joined:
    Oct 25, 2017
    Messages:
    11

    Hi Merlin,

    I was running Asus stock firmware on my RT-AC86U for several months, but today I decided finally to try Merlin 384.4_2 firmware.I have a NAS device in my network which i s only accessible via OpenVPN when a iptable routes are been added manually via SSH to the router. I've told me back ago that with stock firmware is not possible to save firewall settings and after router restart configuration is lost.., but with your firmware it is possible and with some firewall-start or nat start custom scripts.

    Can I ask you for some guidance how and what i need to do in order to create these scripts, in order to retain iptables configuration after router restart.

    Routes I need to add manually everytime router restarts.

    iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o br0 -j MASQUERADE
    iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
    iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE


    Thank you very much
     
  4. Vince

    Vince Occasional Visitor

    Joined:
    Dec 14, 2012
    Messages:
    26
    Great router got 90Mb OpenVPN on a 100Mb line with NordVPN and default settings from 10Mb on a RT-N66U
     
  5. Geraner

    Geraner Regular Contributor

    Joined:
    Jul 19, 2009
    Messages:
    142
    Location:
    Stockholm / Sweden
    I have also recently bought a RT-AC86U and made some VPN speed tests using the OpenVPN client in the router.
    https://www.skadligkod.se/vpn/vpn-speedtest-asus-rt-ac86u-merlin-firmware/
    After reading your posts I enabled HW Runner in the router. But this didn't improve / change any results in my test. Also disabling AiProtection did not have any impact on performance improvements.
     
    JoeBee, Xentrk and kamoj like this.
  6. steven168

    steven168 Occasional Visitor

    Joined:
    Mar 4, 2014
    Messages:
    47
    OpenVPN performance of the RT-AC88U is it same as RT-AC86U ?

    RT-AC88U have 8 port which what i need
     
  7. joegreat

    joegreat Very Senior Member

    Joined:
    Jan 9, 2013
    Messages:
    1,706
    Location:
    Vienna, Austria
    Nope, the AC86U is much faster - as discussed at the beginning of this thread! :rolleyes:
     
    JoeBee likes this.
  8. steven168

    steven168 Occasional Visitor

    Joined:
    Mar 4, 2014
    Messages:
    47
    woh that bad
     
  9. penguin22

    penguin22 Regular Contributor

    Joined:
    Jan 22, 2014
    Messages:
    143
    There appears to be general uncertainty and potential subjectivity with some of the custom values for OpenVPN connections; I reviewed this and many other threads across multiple forums, along with the OpenVPN 2.4 Manual found here and performed testing with my AC86U on a 100Mbps Comcast connection connected over a good distance through a media-bridge on a 20MHz 2.4GHz connection (specifying this as it means I will not get close to the 200Mbps connection some of you may in your experiences).

    Results shown for DL only (in Mbps), average of 3 tests using SpeedOf.Me; PIA VPN, TUN, UDP, AES-256-CBC, SHA256:
    Understanding that there are many permutations, I did the compression tests with the buffer and fast-io values enabled as I found them to not negatively affect performance on the AC86U, likely due to the fact that the CPU never broke a sweat.

    Compression: Disabled (72) LZO (80), LZO Adaptive (84), LZ4 (91)

    In my testing, Compression LZ4 consistently yielded the best results with buffers set to 524288 and fast-io enabled.

    With Compression set to LZ4 and the following settings removed, I resulted in an average of (77).
    Code:
    sndbuf 524288
    rcvbuf 524288
    push "sndbuf 524288"
    push "rcvbuf 524288"
    fast-io
    For now, I'm keeping these settings along with recommended settings per VPN provider and will see how things perform over time.
    Code:
    tls-client
    remote-cert-tls server
    auth-nocache
    mute-replay-warnings
    disable-occ
    pull-filter ignore "auth-token"
    pull-filter ignore "ifconfig-ipv6"
    pull-filter ignore "route-ipv6"
    persist-key
    persist-tun
     
    JoeBee, Kingp1n, Marin and 1 other person like this.
  10. ewokuk

    ewokuk Occasional Visitor

    Joined:
    Mar 5, 2017
    Messages:
    40
    Got my AC86 a couple of weeks ago and I consistently get the full 220mb download on my 220mb connection over openvpn client 1, AES256-GCM. CPU was about 85% and 65% for the 2 cores I think so it feels like it could do more. No special settings, aiprotection is on, I have not set anything to do with buffers or fast-io. I get the same over cat5 as I do over 5ghz wifi (using a PCE-AC88 pcie card in the pc about 1m from the router). Using latest Merlin fw.

    I like this router :p shame it can't do wireguard.
     
    JoeBee likes this.
  11. joegreat

    joegreat Very Senior Member

    Joined:
    Jan 9, 2013
    Messages:
    1,706
    Location:
    Vienna, Austria
    Why should it support an unfinished project when it comes to security - where the creator warns to use it: :rolleyes:
     
  12. codera

    codera New Around Here

    Joined:
    May 16, 2018
    Messages:
    2
    Before buying RT-AC86U i would like a confirmation. I have a 300/300Mbps connection from my ISP.
    Currently i have a small Hyper-V box with OpenVPN applicane VM, that can do around 45/25Mbps and also a Synology NAS with Intel CPU, that does 35/30Mbps on a tunnel connection.

    Can a RT-AC86U router allow me to get better connection speed running a OpenVPN server?
     
  13. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    33,261
    Location:
    Canada
    Expect around 200 Mbps for Openvpn, 300 for IPsec.

    Sent from my P027 using Tapatalk
     
    JoeBee, Geraner and codera like this.
  14. codera

    codera New Around Here

    Joined:
    May 16, 2018
    Messages:
    2
    Thank You for a fast response!
     
  15. Nodoze

    Nodoze New Around Here

    Joined:
    Jun 4, 2018
    Messages:
    2
    This is an inspiring thread and I want to first thank Merlin for his work and everyone else for their testing/feedback/help. This has been an incredible read!

    Before finding this thread I ordered the RT-AC68U from Amazon & was getting buyer's remorse wishing I had ordered an RT-AC86U instead... I was very happily surprised that the RT-AC68U I received has an upgraded dual-core 1.4 GHz CPU for the same price ~$140 that I was expecting at most a 1.0 GHz (or even an 800 MHz) for... I did some research and evidently I received the B2 Hardware version of the RT-AC68U as referenced in this forum:

    https://www.snbforums.com/threads/rt-ac68u-rt-ac68p-rt-ac1900-rt-ac1900p.35759/

    Unfortunately there is no model number info listed yet for the 1.4 GHz CPU in the new B2 revision of the RT-AC68U.

    Is there any way to tell if this new 1.4 GHz CPU in the B2 version of the RT-AC68U has hardware enabled AES-NI ?

    So far I have only unboxed the 1.4 GHz RT-ATC68U and used the stock ASUS firmware via the web GUI and android App so I don't know much about it yet. I am new to ASUS routers and I don't know yet if stock can be SSHed into, etc so please factor my newb-ness into any replies...

    So far I have only had time to get it connected via WRT over USB 3.0 to an extra LTE phone but that is all the tinkering I have done so far. I plan to work on some OpenVPN next. If I have time I will try to do some testing on LTE and on my home-office's Fiber Optic ISP but may not have much time between work and travel and family...
     
    Last edited: Jun 4, 2018
  16. Nodoze

    Nodoze New Around Here

    Joined:
    Jun 4, 2018
    Messages:
    2
    OK after doing some research I figured out how to enable the SSH deamon and found the following info on this new 1.4GHz RC-AC68U from Amazon:

    [email protected](none):/tmp/home/root# uname -r -v
    2.6.36.4brcmarm #1 SMP PREEMPT Fri Jun 3 09:56:54 CST 2016
    [email protected](none):/tmp/home/root# cat /proc/cpuinfo
    Processor : ARMv7 Processor rev 0 (v7l)
    processor : 0
    BogoMIPS : 2798.38
    processor : 1
    BogoMIPS : 2798.38
    Features : swp half thumb fastmult edsp
    CPU implementer : 0x41
    CPU architecture: 7
    CPU variant : 0x3
    CPU part : 0xc09
    CPU revision : 0

    Per the following thread it looks to be the same hardware just with a higher clock speed so basically when I ordered a AC-RT68U I essentially received something more like the RC-AC1900 Best Buy exlusive:

    https://www.snbforums.com/threads/asus-rt-ac1900p-dual-band-wireless-ac1900-gigabit-router-reviewed.36368/

    What I really care the most about for my use case is high OpenVPN speeds and it looks like the 1.4 GHz RT-AC68U will get approximately 55 Mbps (per page 3 of the above thread) which isn't terrible but no where near the 200+ Mbps the TR-AC86U can get.

    Thankfully I am still in my return window so, unless someone replies soon to catch a mistake in my above analysis, I may just pay extra and get an 1.8 GHz (with AES-NI) TR-AC86U and return the 1.4 GHz AC-68U.
     
    Last edited: Jun 4, 2018
  17. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    33,261
    Location:
    Canada
    It doesn't. Only the RT-AC86U (BCM4906) and GT-AC5300 (BCM4908) have AES-NI support. The BCM4709C0 used by the RT-AC68U does not.
     
    Geraner likes this.
  18. Neil Harding

    Neil Harding New Around Here

    Joined:
    May 27, 2018
    Messages:
    2
  19. Xentrk

    Xentrk Part of the Furniture

    Joined:
    Jul 21, 2016
    Messages:
    2,890
    Location:
    The Land of Smiles
    The ping time for the Before-22 ms, and After -19 ms metrics are nearly the same. Which makes me wonder if you were connected to the OpenVPN tunnel during the After test. Is the VPN server you are connecting to near your geo location? Verify you are using the OpenVPN tunnel by going to a site such as whatismypublicip.com.
     
  20. Neil Harding

    Neil Harding New Around Here

    Joined:
    May 27, 2018
    Messages:
    2
    Yes the VPN server was a London based one. Also confirmed connection by doing a tracert and could see the route.

    But will double check when I get home