Slooooow vpn speeds on AC88U router

[unclebuk]

Did a speed comparison with AC88U router vpn Client and Shimo vpn client on a macbook;

I used the identical ovpn file and the macbook achieved 71Mb/32Mb while the Asus AC88U could only deliver 14Mb/32Mb speeds.

Totally dismall performance on the AC88U router. I have tried many different server locations, ovpn ciphers, etc, no difference, this router is ABYSMAL with respect to openVPN performance!

The macbook cpu is 2.2, router cpu is 1.4 GHz

What to do?
bUk

 

[RMerlin]

14/32 Mb/s is about normal for that router if using SHA256 or AES-256-CBC. You are comparing a router's specialized embedded CPU with a full blown desktop CPU that has hardware-based crypto support. Two totally different beasts.

 

[unclebuk]

Yeah, okay, Thanks. I guess thats just the way it is with these routers. So, my plan is to build a system with the same "full blown desktop CPU that has hardware-based crypto support"....i know there are some details about this on the forum but I cannot find it. Can you point me to the forum that addresses this please. I am interested to build a system with sufficient processor speed to replicate the macbook openvpn speeds.

Thank you,
bUk

 

[RMerlin]

Look for a pfsense solution (searching by this keyword might bring you some pointers).

As for the computer itself, look for Qotom. Their i3 product should be more than capable for this.

 

[unclebuk]

you recommend the pfsense hardware? I will look into it and this Qotom-i3....
Thank you very much.

 

[CaptainSTX]

you recommend the pfsense hardware? I will look into it and this Qotom-i3....
Thank you very much.

I bought a mini PC from Qotom. I over bought on the processor and went with an I7 to be sure that I could max my speeds running a VPN client.

Just be sure that whatever processor you order that it supports AES-NI and that the Ethernet ports are Intel.

Qotom will flash the unit with Pfsense. While you should be able to get it running as a basic router using Pfsense in a couple of hours, to get it running with advanced features such as VPN will take considerably longer. You will need a manual about Pfsense to get you started. Be sure than any You Tube videos you find regarding Pfsense are talking about the version you are using. Don't expect any help from Qotom as they are a Chinese hardware vendor and most VPN providers either don't have a clue or won't bother to assist.

The first part of the setup of Pfsense on the Qotom is done in the console mode so you will need a keyboard and a monitor or TV. Once the basic setup is done you can finish setting it up using the GUI.

One VPN provider, PIA, offers some help for setting up Pfsense. They have a setup tutorial on their web site for getting a VPN client running using their service in Pfsense. Also PIA seems to one of the few or only VPN providers that can support high speed VPN connections. Depending on the time of day I get 140 - 160 Mbps VPN speeds on my 170 - 180 ISP connection.

 

[unclebuk]

I bought a mini PC from Qotom. I over bought on the processor and went with an I7 to be sure that I could max my speeds running a VPN client.

Just be sure that whatever processor you order that it supports AES-NI and that the Ethernet ports are Intel.

Qotom will flash the unit with Pfsense. While you should be able to get it running as a basic router using Pfsense in a couple of hours, to get it running with advanced features such as VPN will take considerably longer. You will need a manual about Pfsense to get you started. Be sure than any You Tube videos you find regarding Pfsense are talking about the version you are using. Don't expect any help from Qotom as they are a Chinese hardware vendor and most VPN providers either don't have a clue or won't bother to assist.

The first part of the setup of Pfsense on the Qotom is done in the console mode so you will need a keyboard and a monitor or TV. Once the basic setup is done you can finish setting it up using the GUI.

One VPN provider, PIA, offers some help for setting up Pfsense. They have a setup tutorial on their web site for getting a VPN client running using their service in Pfsense. Also PIA seems to one of the few or only VPN providers that can support high speed VPN connections. Depending on the time of day I get 140 - 160 Mbps VPN speeds on my 170 - 180 ISP connection.

Thanks for the insight Captain,

I will look into Qotom, can you send me details of the Qotom i7 you are using please and where you purchased it? I live in SE Asia and unsure about availabilty of the specific model you refer to.

Regards,
Buk

 

[CaptainSTX]

Thanks for the insight Captain,

I will look into Qotom, can you send me details of the Qotom i7 you are using please and where you purchased it? I live in SE Asia and unsure about availabilty of the specific model you refer to.

Regards,
Buk

Qotom's selection of what they have to offer seems to depend on what parts they have on hand to build a mini PC with. I found there web site disorganized but in dealing with Sunny Lau he came up with the configuration I needed. They also have a store on the Chinese equivalent of Amazon.

I over built my mini PC for two reasons, first to be sure I would get max speed and if that didn't work I would use the PC as a mini desk top running windows.

The base model Qotum-Q370G4 with 8G ram and a 64G SSD drive was US $331. Pfsense was installed. Shipping was $32. The PC was shipped from Hong Kong and arrived in three days. They say they ship anywhere in the world. The power adapter supplied will be the appropriate one for your location.

If you are going to run Pfsense you just need a PC with a processor that supports AES-NI (Faster is better ), 4 Ethernet ports on an Intel board. (Pfsense very strongly recommends using the Intel boards.) . You will also need an HDMI or monitor port along with an USB port for a keyboard so you can start the setup in a console mode.

One adjustment you probably will want to make on receipt of the device is move the jumper on the mother board so the PC boots when power is applied. This makes recovery automatic. Otherwise you would need to push the on/off button after power is restored.

My PC has been running non stop with no issues since May of this year with no issues.

Good luck.

P.S. I used to live in Evanston, IL just around the corner from where they filmed the movie Uncle Buck.

 

[unclebuk]

Thanks for the insight Captain,

I will look into Qotom, can you send me details of the Qotom i7 you are using please and where you purchased it? I live in SE Asia and unsure about availabilty of the specific model you refer to.

Regards,
Buk

Qotom's selection of what they have to offer seems to depend on what parts they have on hand to build a mini PC with. I found there web site disorganized but in dealing with Sunny Lau he came up with the configuration I needed. They also have a store on the Chinese equivalent of Amazon.

I over built my mini PC for two reasons, first to be sure I would get max speed and if that didn't work I would use the PC as a mini desk top running windows.

The base model Qotum-Q370G4 with 8G ram and a 64G SSD drive was US $331. Pfsense was installed. Shipping was $32. The PC was shipped from Hong Kong and arrived in three days. They say they ship anywhere in the world. The power adapter supplied will be the appropriate one for your location.

If you are going to run Pfsense you just need a PC with a processor that supports AES-NI (Faster is better ), 4 Ethernet ports on an Intel board. (Pfsense very strongly recommends using the Intel boards.) . You will also need an HDMI or monitor port along with an USB port for a keyboard so you can start the setup in a console mode.

One adjustment you probably will want to make on receipt of the device is move the jumper on the mother board so the PC boots when power is applied. This makes recovery automatic. Otherwise you would need to push the on/off button after power is restored.

My PC has been running non stop with no issues since May of this year with no issues.

Good luck.

P.S. I used to live in Evanston, IL just around the corner from where they filmed the movie Uncle Buck.

Yeah, Uncle Buk was quite the guy!

have looked carefully at the Qotum PC line-up and the i7 may or may not be available. The i5 model (Qotum-Q355G4} seems suitable in lieu of the i7.

One issue: can the Qotom network and openVPN client be distributed wirelessly and by LAN with an asus router connected to the Qotom LAN, if so, whats the basic set-up?

Seems like a slightly complicated process to formulate pfsense and openVPN on a Qotom PC but very interesting nontheless for the IT challenged like myself.

Thanks a bunch Capt'N
Buk

 

[RMerlin]

Amazon Canada sells some of the Qotoms, so I assume it will also be available in other countries through Amazon. I would check there before going through direct sales.

Also note that nothing prevents you from running something else than pfsense on it. You could roll your own using CentOS + Shorewall for instance, or use any of the numerous Linux firewall distros out there. That's the benefit of having standard PC hardware.

 

[CaptainSTX]

Yeah, Uncle Buk was quite the guy!

have looked carefully at the Qotum PC line-up and the i7 may or may not be available. The i5 model (Qotum-Q355G4} seems suitable in lieu of the i7.

One issue: can the Qotom network and openVPN client be distributed wirelessly and by LAN with an asus router connected to the Qotom LAN, if so, whats the basic set-up?

Seems like a slightly complicated process to formulate pfsense and openVPN on a Qotom PC but very interesting nontheless for the IT challenged like myself.

Thanks a bunch Capt'N
Buk

It doesn't hurt to contact their sales support CS team by e-mail and see if they can find the hardware you desire. They seem to monitor it 24/7 and respond quite promptly.

To do what you want you can easily connect an ASUS router to a LAN port and use it as an AP. All routing will be handled by the Pfsense box and you can determine on a connected device basis if it is routed using the VPN or your local ISP. I would suggest that you buy your Qotum with four Ethernet ports. In the basic setup one will be assigned to the WAN and another to the LAN. You then can configure the other two to be either LAN or WAN ports. This give you the utmost flexibility and will allow you to set up port related VLANs etc. The ports on the ASUS router you are planning to use as an AP can also be used as LAN ports. Be sure to get an Intel board for the Ethernet ports. If you go with Realtek and need help getting something to work on your box, the knee jerk reaction will be to blame the Realtek board.

 

[doczenith1]

Mr. buk, I'm not trying to steer you away from a high power Pfsense piece of kit but I just wanted to say that 70 Mbps is achievable on an AC88U if using SHA1 and AES-128-CBC over UDP. I've done it using PIA.

Perhaps there are other factors with your VPN provider that are causing the speed issues. Have you had a chance to read through the "How to Setup a VPN client including Policy Rules for PIA and other VPN providers 380.68 / 09.12" thread? All 501 posts unfortunately There may be some info there that might help you get some more speed out of your provider.

 

[unclebuk]

Hello there,

I guess the first question is: what is your ISP speed pkg. you subscribe to, or what was the speed of the connection you tested to AC88U on? Or does it matter what the ISP conection speed is, ie: 70 Mbps is the MAX with the AC-88U router?

Also, I have tried every available cipher from "no cipher", BF-CBC, AES/128/265|CBC, AES-GCM, etc; all ports, however the speeds on the two vpn's I use seldom achieve 20% of stated ISP speed (100/20) in my case. I have not tried PIA as of yet. I have tried to research this on the forum here and due to the plethora of suggestions, comments, advise, guides it becomes a work in progress but still cannot tweak the routers I use to speed up openVPN connections.

Appreciate your input, I will soldier on with this.

Regards,
Buk

 

[Xentrk]

Keep in mind that geo location from VPN server will impact speed test results. Last time I tested, I could got 90 Mbps if using Bangkok server. But once I change to west coast of USA, I get between 5 and 15 Mbps. However, my video streaming is great e.g. no buffering. My web pages load fine. So I stopped worrying about it.

I plan on purchasing a new pfSense once pfSense 2.5 is out. I am also looking at the Qotom. You can buy them on Aliexpress website. Free shipping to Thailand!

 

[doczenith1]

Hello there,

I guess the first question is: what is your ISP speed pkg. you subscribe to, or what was the speed of the connection you tested to AC88U on? Or does it matter what the ISP conection speed is, ie: 70 Mbps is the MAX with the AC-88U router?

My ISP speed is 1000 Mbps up and down via fiber. I have also done some testing with PIA using their windows client and saw around 250 Mbps down and 450 Mbps up so the 70 that I was getting on the router was definitely limited by the router.

 

[joegreat]

Only the newest routers have ARM CPUs with hardware acceleration (AES instruction set) for faster VPN processing - read here!

 

[gpz1100]

Picked up a qotom Q355G4 about 2 months ago. Got it from amazon with 8GB ram and 30gb ssd and i5 5250u cpu for ~$335USD shipped. The 30gb ssd was running too hot for my tastes - ~60C under idle conditions. I replaced it with a 2tb 5400rpm mechanical drive. Way overkill but that's what I had on hand.

The intention was to run pfsense. I then came across sophos utm (free home edition, up to 50 ip's) firewall/router software. It's a direct competitor to pfsense but more user friendly for a novice to set up. Been running it for over a month now. At some point I'll give pfsense a try too.

The base os is vmware's exsi 6.5. This consumes about 1.5GB of ram. The rest is allocated @ 4GB for the firewall and 1.25GB for freepbx. Pipe here is 330/25 mbps. No issues pulling full bandwidth even with intrusion protection enabled and web scanning on. I haven't been able to do a proper vpn test due to not having a sufficiently fast enough 2nd pipe. Cell phone tops out at 8mbps which is what it's throttled at by the service provider.

Note, the lan ports are out of order on this box. They're not 0 1 2 3 (left to right), but rather 0 2 3 1. This is not a software issue, just the way they're wired internally. With esxi, I did remap them accordingly so physical port 1 to 4 corresponds to vmnic0...vmnic3.

 

[RMerlin]

The 30gb ssd was running too hot for my tastes - ~60C under idle conditions. I replaced it with a 2tb 5400rpm mechanical drive. Way overkill but that's what I had on hand.

That's odd. When I replaced my 5400 rpm HDD with an used OCZ Agility 3 in my Zotac a few years ago, my overall temperature dropped, causing fan noise to also drop.

Might be because the SSD model they chose had poor power management - it can vary between controllers. M.2 might also require PCI-Express level power management to be enabled/supported by the BIOS.

 

[gpz1100]

^^They included an intel 525 30GB ssd. It's a rather old ssd model. The box has been running in the above configuration for almost 2 months now. According to SMART, hd temp is around 35-38C depending on ambient temp.