IPSec Performance?

[PolynomialDivision]

@jeff wrote that on a mips soc the performance for an ipsec-tunnel is very low. Does this still applies?
Could u give me some number that the performance is? (ESP-Tunnel)

MIPS optimized IPsec crypto modules (mcespi) on Archer C7

Assembler or C, a typical MIPS-based SoC is never going to be fast for VPN. Depending on the VPN bandwidth you need and security requirements, I’d put the end point back on the mini-server, in a VM, or on another device with appropriate hardware and crypto support. I’d also evaluate your cipher list if you stay with IPSec

I just made the test
time ssh root@<router> time dd if=/dev/zero bs=500000 count=200 > /dev/null
and 800/time(sec).
It was 50 MBit/sec, so quiet low? And if I have multiple ipsec connections, it will become even slower?

[pwned]

@PolynomialDivision

It was 50 MBit/sec, so quiet low?

In general those "consumer" CPUs are not made for high performance VPN usage scenarios. In best case you have two or more CPU cores (1,5 GHz+) nowdays instead just one for all and hardware offload (if supported) is enabled in favor over SQM. Given you have a 1GB WAN connection you could gain with one of the "high end routers" ~750-900MB without encryption and with nat offlaod enabled (for some devices). As soon as you enable encrytion and disable nat offloading you will drop into range of ~250MB with those routers (under optimal cricumstances). For your C7 the numbers (~50MB) are looking plausible to me. It is an old ar71xx/ath79 device with just one core @ 750MHz. You cannot gain performance over years.

@PolynomialDivision

And if I have multiple ipsec connections, it will become even slower?

Ofc. They are sharing the same ressources (cpu, ram, data uplink bandwidth).