OpenWrt Forum Archive

Topic: openvpn on openwrt

The content of this topic has been archived on 19 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I presume many of you have tried using openvpn with openwrt boxes
from linksys and so on. Any one care to let me know how's the
performance ? Assuming a non vpn has a latency x, will adding vpn
layer causes a latency of 2x ? How about CPU utilization ?

Regards.

It depends on the openvpn usage you have to. On the internet the VPN bottleneck ist most probably routing delay. I connect a WRT with another 80Mhz router through openvpn (running on both boxes) and perceive no significative delay.

CPU usage is very low, except during rekeying. I got then 2-4 seconds service interruption.

latency should´t be a problem.
I tried to ping my router at home, and the respond-time is 50ms over an unencrypted connection and about 60ms over an openvpn-connection. so I get a delay of 10ms over the encrypted channel

but I disagree with rAndy: cpu-utilistation is quite high.

with a "normal" broadcom-cpu with 200 MHz you get about 200-300 kByte/sec if you use AES-128.
I think blowfish is a little bit faster but don´t expect more than 500 KByte/sec, and you will have 100% CPU-utilisation.
It is not possible to use the crypto-engine of the wifi-device, and afaik there are no linux-drivers for the hardwarecryptoengine which is integrated in some newer broadcom-cpus (the wl-500g premium has such a chip).

If you need better performance you can look for a router with a faster cpu, or for a minipci-hardware-acceleration-module (I think soekris sell some with linux-support) and replace your wifi-module (if your router has a minipci-slot)

eleon216 wrote:

but I disagree with rAndy: cpu-utilistation is quite high.

with a "normal" broadcom-cpu with 200 MHz you get about 200-300 kByte/sec if you use AES-128.
I think blowfish is a little bit faster but don´t expect more than 500 KByte/sec, and you will have 100% CPU-utilisation.

Of course if you want such throughput a 200 Mhz cpu is definitively not enough. Here the hardware ist the bottleneck, not openvpn. wl500gp has crypto hardware, but, afaik, no usable linux driver, see http://forum.openwrt.org/viewtopic.php?id=5032

The discussion might have continued from here.