VPN Server Performance

[jrmtz85]

Hi there,

I tried searching for this, but the word "VPN" is too short and gets omitted from searches here.
Trying to figure how enabling VPN server may impact performance on my network.

Internet
1000/50 over DOCSIS 3.1

Router:
86U on 384.7_2
AI Protect enabled
QOS enabled
Diversion
Skynet
typical RAM usage is 93-95%

So, with this little amount of RM available, will enabling the VPN server impact performance.
I frequently do max the gigabit down, so I don't want to lose that. Primarily looking to remote in to connect to my Synology.

Thoughts?

Thanks!

 

[Xentrk]

Hi there,

I tried searching for this, but the word "VPN" is too short and gets omitted from searches here.
Trying to figure how enabling VPN server may impact performance on my network.

Internet
1000/50 over DOCSIS 3.1

Router:
86U on 384.7_2
AI Protect enabled
QOS enabled
Diversion
Skynet
typical RAM usage is 93-95%

So, with this little amount of RM available, will enabling the VPN server impact performance.
I frequently do max the gigabit down, so I don't want to lose that. Primarily looking to remote in to connect to my Synology.

Thoughts?

Thanks!

I run OpenVPN Server on three routers I support remotely and no one complained about impact on their LAN performance. 2 x RT-AC88U and 1 RT-AC86U. But I have never tested when doing gigabit download.

 

[Odkrys]

50

Your upload throughput is client download throughput.
So it will consume 20% of 2nd core.

 

[jrmtz85]

I run OpenVPN Server on three routers I support remotely and no one complained about impact on their LAN performance. 2 x RT-AC88U and 1 RT-AC86U. But I have never tested when doing gigabit download.

I suppose I could activate then run tests to see how its working. Any advice on best server settings? Once again, having a hard time searching for VPN here.

 

[jrmtz85]

Your upload throughput is client download throughput.
So it will consume 20% of 2nd core.

Oh yeah, I know I'd be limited to my upload for the client. I meant the impact to local connections from having the server running in the background on the router.

 

[Xentrk]

I suppose I could activate then run tests to see how its working. Any advice on best server settings? Once again, having a hard time searching for VPN here.

Here is the link to the tutorial I wrote: https://x3mtek.com/openvpn-server-setup-instructions-for-asuswrt-merlin/

Just as with OpenVPN clients, the primary setting that impacts performance on the server side is the cipher. The GCM ciphers perform the best from my testing. The higher the number the harder the CPU has to work.

 

[jrmtz85]

Here is the link to the tutorial I wrote: https://x3mtek.com/openvpn-server-setup-instructions-for-asuswrt-merlin/

Just as with OpenVPN clients, the primary setting that impacts performance on the server side is the cipher. The GCM ciphers perform the best from my testing. The higher the number the harder the CPU has to work.

Thank you. Interestingly, I don't see Push LAN to Clients, Direct Clients to Redirect Internet Traffic, nor Respond to DNS as options. Have they been removed??

 

[Xentrk]

Thank you. Interestingly, I don't see Push LAN to Clients, Direct Clients to Redirect Internet Traffic, nor Respond to DNS as options. Have they been removed??

Looks like you are right. I failed to notice the update.

384.5 (13-May-2018)

- CHANGED: Revised OpenVPN server options:
o Removed "TLS Reneg time" (rarely used, can manually
be set as a custom option)
o Removed "Server Poll" (which didn't work
properly), and reimplemented watchdog service,
hardcoded to 2 mins frequency.
o Removed "Push LAN" and "Redirect Gateway",
replaced with new Client Access setting
o Removed Firewall setting (firewall rules are now
always created, and the broken External mode
was fixed and integrated into the new Client
Access setting). You can now use the postconf
script to override it.
o Removed option to respond to DNS queries - enabling
the option to Push DNS will also handle it
o Added new Client Access setting to select between
three types of access: LAN only, WAN only (will
block access to the LAN, including the router
itself) and LAN + WAN.
o Keys and certificates can now be up to 7999
characters long.

I will need to update the blog post. One more thing on my to-do list. Ugh.

 

[doczenith1]

I don't think available RAM has much to do with your WAN<>LAN speeds. I run Diversion and a VPN server and still achieve full WAN<>LAN speeds.