1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

RT-AC86U OvenVPN client issue with the Custom Configuration section

Discussion in 'Asuswrt-Merlin' started by Ian Macdonald, Dec 24, 2017.

  1. Ian Macdonald

    Ian Macdonald Occasional Visitor

    Joined:
    Apr 14, 2016
    Messages:
    22
    I have purchased an AC86U to replace my AC88U, primarily because of the superior VPN performance of the new chipset in this unit.

    To prepare the new box, I installed 382.1_2 on it, the same version already running on my AC88U.

    After configuring the new router to be identical to the old one, I noticed a problem with my OpenVPN client tunnels. Some are working, some are not, and some are not behaving entirely as expected.

    After some time troubleshooting, I noticed the (probable) cause of the problem. When I upload the .ovpn files to the AC86U, many of them are truncated in the process. Only the first 200 characters or so of directives are making it into the Custom Configuration section of the client config.

    Even stranger is that when I try to add the missing directives by hand, I'm not allowed to type in the Custom Configuration section. I can delete characters, but I cannot add any; not even the same number that I have just deleted.

    I really hope this is just an obscure bug, and that the Custom Configuration section for the AC86U doesn't have some absurdly low limit on the amount of text it can accept. This has never been a problem on the AC88U.

    I was able to get most of my client configs to work by changing the order of the directives, so that the less important ones were those that got truncated when the files were uploaded. This is a far from ideal solution, of course.
     
  2. Martineau

    Martineau Part of the Furniture

    Joined:
    Jul 8, 2012
    Messages:
    2,481
    Location:
    UK
    In the interim (if this is indeed an obscure RT-AC86U bug), you can of course exploit the openvpnclientX.postconf scripts to include your 'missing' directives.
     
    Last edited: Dec 24, 2017
  3. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    31,563
    Location:
    Canada
    382.1_2 limits the Custom field to 170 characters due to limitations in the HND platform (255 chars max, has to be base64 encoded to be properly stored, which cuts things down to 170 characters).

    382.2 will increase that limit to 510 characters.
     
  4. Ian Macdonald

    Ian Macdonald Occasional Visitor

    Joined:
    Apr 14, 2016
    Messages:
    22
    That explains it. Thanks a lot.

    As usual, the devil is in the details. I did notice upon booting for the first time that the AC86U has less NVRAM than the AC88U, but the difference didn't seem large enough to cause a problem, so I ruled it out.

    It turns out that my ExpressVPN configs are the worst hit, as those produce approximately 300 characters of Custom Configuration. I've temporarily remedied this by taking @Martineau's advice (thanks for the tip!) and placing the entire custom configuration section in a openvpnclientX.postconf script.

    For example:

    Code:
    #!/bin/sh
    
    # ExpressVPN Iceland
    
    CONFIG=$1
    
    cat <<EOF >> $CONFIG
    up /jffs/scripts/ovpn_masq_up
    down /jffs/scripts/ovpn_masq_down
    
    fast-io
    remote-random
    pull
    tls-client
    verify-x509-name Server name-prefix
    ns-cert-type server
    route-method exe
    route-delay 2
    tun-mtu 1500
    fragment 1300
    mssfix 1450
    keysize 256
    sndbuf 524288
    rcvbuf 524288
    EOF
    
    It works, but I'd rather have the entire config accessible via the GUI. For that reason, I look forward to the release of 382.2. 510 bytes ought to be enough for anyone, right? :)

    Merry Christmas from Amsterdam.
     
  5. Ian Macdonald

    Ian Macdonald Occasional Visitor

    Joined:
    Apr 14, 2016
    Messages:
    22
    I can verify that this issue is now fixed in 382.2_beta1.
     
    Geraner likes this.
  6. jeff3820

    jeff3820 Regular Contributor

    Joined:
    Dec 9, 2016
    Messages:
    100
    How is your OpenVPN performance on the 86U compared to the 88U?
     
    RobbieBlok likes this.
  7. RobbieBlok

    RobbieBlok Occasional Visitor

    Joined:
    Dec 23, 2017
    Messages:
    12
    Hi, I am curious about this also, I plan to replace my 3200 with the 86U...
     
  8. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    31,563
    Location:
    Canada
  9. Ian Macdonald

    Ian Macdonald Occasional Visitor

    Joined:
    Apr 14, 2016
    Messages:
    22
    @RMerlin linked to the thread that is the best source for this information at the moment. I generally don't tax my VPN connections hard enough to run up against any limits and therefore haven't yet noticed any immediate differences.
     
  10. RobbieBlok

    RobbieBlok Occasional Visitor

    Joined:
    Dec 23, 2017
    Messages:
    12
    The strangest thing is, that my DSL speed is already slow, without VPN. I live at the end of the telephone line, with a download speed of 8 Mbps tops... :-(
    When using the VPN client it slows down to 5 - 6 Mbps. Tested various VPN servers from Windscribe.
    I am getting a fiber connection this year, :) (500 up / down) and want things to go as smoothly as possible... Ordered the 86U, to replace my 3200.
    I have to keep my kids happy... :)
     
  11. unclebuk

    unclebuk Regular Contributor

    Joined:
    Dec 6, 2016
    Messages:
    167
    excuse me for buttin in...
    I use 88U and now 86U, both using identical ovpn files, (torguard vpn) cipher strength,(AES-GCM128) wifi signal, Merlin FW, etc, everything same same and the 86U can achieve 150 mb download speed, the 88U struggles to reach 40Mb speed. I am connected to a server approx 1,000 kms from my location in SE Asia.
    On expressVPN (AES-CBC256) the speed on the 86U is about 70Mbs, the 88U is about 30Mbs.

    Seems the 86U is much better at processing VPN encryption.
     
    Xentrk likes this.
  12. Jack Yaz

    Jack Yaz Part of the Furniture

    Joined:
    Apr 20, 2017
    Messages:
    2,472
    86U has hardware accelerated crypto, 88U does not.
     
    skeal and unclebuk like this.
  13. unclebuk

    unclebuk Regular Contributor

    Joined:
    Dec 6, 2016
    Messages:
    167
    Well, I WILL be dipped in monkey shit....(just joking).
    is dat sumptin like IntelĀ® AES-NI?
    whatever it is, it has noticable impact on the vpn encryption function/performance.
     
  14. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    31,563
    Location:
    Canada
    Yes, it's AES-related acceleration at the CPU level.