"Small AirVPN Thingy"?

[agunymous 2]

Hi there,

 

I´m switching from a Tomato router to an AVM Cable Router (https://en.avm.de/products/fritzbox/fritzbox-6490-cable/technical-data/) with stock firmware which sadly does´t support OpenVPN but rather relies on IPSec.

 

To  keep the AirVPN functionality, I am thinking about getting a small dedicated device (like RasPi, NUC ,...) that will channel all WAN traffic through AirVPN servers to all devices that are connected to the AVM router.

 

Do you have any suggestions for a capable, user-friendly device, that will have enough power to facilitate the full AirVPN-Speed while being energy-efficient and 100% quiet (no fans)?

 

Looks like a RasPi 2 is not sufficient for full speed (e.g. when torrenting) and pfsense-hardware would be just too expensive?

 

Do you have any suggestions?

Maybe just using a NUC with Linux?

 

Thanks for your help, I´m thankful for any input.

[zhang888 1066]

Define expensive. If you want to use high speed broadband internet, and have the same speed with VPN on, you will

have to get hardware that can support it. Otherwise you will be paying for your ISP for something you can never get.

[go558a83nk 362]

pfsense sells hardware that I believe is quite capable of running openvpn over 100mbit/s if i understand correctly.  or you can probably build your own cheaper.

[dj77 6]

Why you dont add the tomato Router behind the avm Modem/Router?

 

You can Check the Linksys wrt 1200ac v1 or 1900acs v1

 

I read on ddwrt Board wrt1200ac should give 70Mbps openvpn speed

[iwih2gk 93]

Any suggestions for something that would handle 150 meg (maybe 200)?  My budget is not unlimited but I can see I have to spend a little more money than I did in the past.  Currently I get just shy of 150 but within a year or two I am betting my pipe will be near 200 around here.  Open to almost anything that doesn't require me to sell my first born.  On some days that would be negotiable too!

[zhang888 1066]

Any suggestions for something that would handle 150 meg (maybe 200)?  My budget is not unlimited but I can see I have to spend a little more money than I did in the past.  Currently I get just shy of 150 but within a year or two I am betting my pipe will be near 200 around here.  Open to almost anything that doesn't require me to sell my first born.  On some days that would be negotiable too!

 

There are many threads on the pfSense forums where people discuss their own custom hardware builds.

Here is one example:

https://forum.pfsense.org/index.php?topic=75415.0

 

When you want anything beyond 100Mbit you must use x86 hardware, so no consumer router is an option for you.

[go558a83nk 362]

Any suggestions for something that would handle 150 meg (maybe 200)?  My budget is not unlimited but I can see I have to spend a little more money than I did in the past.  Currently I get just shy of 150 but within a year or two I am betting my pipe will be near 200 around here.  Open to almost anything that doesn't require me to sell my first born.  On some days that would be negotiable too!

 

did you check out the pfsense store as I suggested?  I refuse to hold hands so you're going to have to do the legwork on your own.

[agunymous 2]

Wow, thanks for all the replies & sorry for getting back to you so late!

 

I only got a 100mbit/s connection, so maybe the Linksys wrt 1200ac v1 or 1900acs v1 would be actually sufficient... the price for the 1200ac v1 looks tempting... especially since I already know the Tomato interface and wouldn't have to familiarize myself to a new router/firewall os.

 

A custom hardware build is a nice idea, but I´d rather stick to a preassembled consumer product... I just don't have the time to tinker with electronics right now. ;-)

 

I just checked the pfsense store and the stuff they got there looks really nice and rock solid, but the prices are just too high for me since I only use AirVPN in my spare time and as a hobby.

 

So I guess that for openvpn speeds between 70-100mbit/s, I´ll just look into consumer routers a little more... if anyone has any (DD-WRT-, Tomato-, pfsense-) hardware-recommendations besides the two LinkSys routers, I´d be happy to hear from you!

 

Thanks again for all your input!

[zhang888 1066]

You will be lucky if you manage to max out 30Mbit from any Linksys router.

[agunymous 2]

Ah, this doesn't sound too encouraging. ;-) So you think the mentioned 70mbit/s using a wrt 1200ac are not a real-world-scenario? Too bad... looks like I´ll have to spend more money then... 

[zhang888 1066]

Mentioned where? OpenVPN in AES-256 mode is intensive, without an AES-NI capable CPU you won't have much luck on those arm/mips routers.

[go558a83nk 362]

Mentioned where? OpenVPN in AES-256 mode is intensive, without an AES-NI capable CPU you won't have much luck on those arm/mips routers.

 

dj77 said it above in this thread.

[agunymous 2]

Mentioned where? OpenVPN in AES-256 mode is intensive, without an AES-NI capable CPU you won't have much luck on those arm/mips routers.

Talking about AES-NI capable CPUs... this just reminded me, that I´m using a rather new Synology DS 716+ (Datasheet). The NAS is only used by max. 2 devices simultaneously and it´s running idle most of the time. I think that the NAS would be ok for running OpenVPN in AES-256 mode... but probably the NAS would be the only device able to use the OpenVPN connection, right? Or would I be able to somehow route the "encrypted connection" back into the router and make the openvpn connection usable by other devices on the network? Sorry if this is a stupid question but I´m a novice regarding OpenVPN & networks.

 

Thanks for your help!

[dj77 6]

 

Mentioned where? OpenVPN in AES-256 mode is intensive, without an AES-NI capable CPU you won't have much luck on those arm/mips routers.

dj77 said it above in this thread.

Correct read here post 1, 4 and 7

 

https://www.dd-wrt.com/phpBB2/viewtopic.php?t=290786&sid=683ed01179dd530d8783b9e951c41c82

[zhang888 1066]

was able to successfully setup openvpn to connect to privateinternetaccess, using my computer my speed goes up to 90MB UP/DOWN but with my router it only goes up to 8MB UP/DOWN

 

You should re-read the first post and the replies. There is no way a consumer router will reach those speeds even with AES-128 OpenVPN.

Post 7 is not a realistic test - maybe on a local LAN network and using iperf. You can't have this on 1333Mhz arm without AES-NI.

I would be happy to see any proof for that.

[dj77 6]

Read what Kong say he is Developer i think you can Trust him

 

I Tested wrt1200ac and i have fullspeed with ovpn.to 50Mbps aes256 + sha512 + tls cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384

 

I Tested Kong Build not Brain slayer

 

Wrt1200ac and 1900acs use Marvel CPU Looks like they Are faster then broadcom

[zhang888 1066]

This is not about trust, it's simple hardware and a little math. 50Mbit might be more realistic, but nowhere around the numbers you mentioned above.

You can use the openssl benchmark to estimate your throughput:

openssl speed -elapsed -evp aes-256-cbc

 

The actual tunnel speed will be a little lower than the average number in these tests.

[dj77 6]

You mean what Kong mentioned

 

And it Looks wrt 1200ac have hw encryption but Kong didnt added the Feature in his build

 

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=287177&postdays=0&postorder=asc&start=0

 

This Benchmark results Tested with older ddwrt Firmware

[iwih2gk 93]

 

Any suggestions for something that would handle 150 meg (maybe 200)?  My budget is not unlimited but I can see I have to spend a little more money than I did in the past.  Currently I get just shy of 150 but within a year or two I am betting my pipe will be near 200 around here.  Open to almost anything that doesn't require me to sell my first born.  On some days that would be negotiable too!

 

did you check out the pfsense store as I suggested?  I refuse to hold hands so you're going to have to do the legwork on your own.

 

 

I am reading and investigating the expense vs performance, which will take a bit to conclude.  In the meantime I removed the encryption from the router, pass directly through via ethernet, and I crunch the tunnel math in a high end laptop as a linux host on a vpn1 scenario.  Air is my #1 server before other hops.

 

In this mode vpn1 pulls at least 50 even with a ssl tunnel wrapper in place over the first hop.

 

If I hit the Powerball this will all be moot, but for now $$ is a factor.  Same for almost all of us!

[agunymous 2]

Hi guys, I think I found an interesting link regarding OpenVPN-Speeds on varying hardware: http://www.firewallhardware.it/en/pfsense_selection_and_sizing.html

 

Actually I was thinking about getting this board (pre-assembled for around 180,-EUR), but it looks like even with this AES-enabled CPU, you will only get a throughput of about 50mbit/s... hmmmm.