# PFSense VPN speeds



## puma99dk| (May 11, 2019)

Earlier this week I got a PFSense box home from PCEngine APU2C4 specs: AMD GX-412TC Jaguar 1GHz Quad-Core, 4GB DDR3-1333 RAM, 16GB SSD storage with 3xIntel I211AT ethernet ports and more: https://pcengines.ch/apu2c4.htm


I am using OpenVPN to connect this router to a VPN service I use for personal matters, and I tested with the following settings:

AES-256-GCM | SHA256
AES-128-GCM | SHA1

with these 2 encryption methods I get the same speeds through it like 15/50 Mbit and if I under advanced add these 3 lines:
fast-io
sndbuf 524288
rcvbuf 524288 

I reach 80/50Mbit on both encryptions methods above and CPU load maks out at max 20-25% while testing speeds with the VPN what I find weird is that I don't see a higher throughput using AES-128-GCM | SHA1 than with AES-256-GCM | SHA1 and I got told that lowering the encryption method doesn't nessarly means better speeds 

I am on a 200/200Mbit connection at the moment and I would really like to be able to put some load on this small box and get better vpn throughput and yes I got told that OpenVPN only is a single threaded application so if this is what holds it back I would really like to know what I can use instead.


----------



## silentbogo (May 11, 2019)

Installation - WireGuard
					






					www.wireguard.com


----------



## puma99dk| (May 11, 2019)

silentbogo said:


> Installation - WireGuard
> 
> 
> 
> ...



WireGuard is currently under development, and therefore any installation steps here should be considered as experimental. 

It's not a finished product and it would be nice if it had a gui for PFSense.


----------



## silentbogo (May 11, 2019)

puma99dk| said:


> WireGuard is currently under development, and therefore any installation steps here should be considered as experimental.


But stable enough to be considered for inclusion in 5.2 kernel. Not sure if their FreeBSD port became any better, but so far that's the only decent alternative.





						WireGuard Sent Out Again For Review, Might Make It Into Linux 5.2 Kernel - Phoronix
					






					www.phoronix.com
				




Other than that - cross your fingers and hope that at some point maintainers and the dev. community finally decide to re-write OpenVPN from scratch, cause even on the official website there is a whole page dedicated to shortcomings of current approach and why is it so hard to fix it.


----------



## puma99dk| (May 11, 2019)

@silentbogo to be honest, it's not the installation or setup that worries me of this it's more the long term use of how stable and easy it will be to upgrade because my experience with PFSense from work is that installing anything that's not in the package manager won't run proper for a longer period of time specially tried the UniFi controller for Ubiquiti's devices the controller works and suddenly out of no where with no high usage both the PFSense and UniFi Controlle crashes or is just not responding and a reboot doesn't always fix this.


----------



## bug (Jun 6, 2019)

puma99dk| said:


> @silentbogo to be honest, it's not the installation or setup that worries me of this it's more the long term use of how stable and easy it will be to upgrade because my experience with PFSense from work is that installing anything that's not in the package manager won't run proper for a longer period of time specially tried the UniFi controller for Ubiquiti's devices the controller works and suddenly out of no where with no high usage both the PFSense and UniFi Controlle crashes or is just not responding and a reboot doesn't always fix this.


Wait for it to be mainlined first then. Shouldn't be long now.


----------



## newtekie1 (Jun 6, 2019)

You have to realize too that the VPN throughput is also going to rely very much on how fast the VPN service can provide to you.  And even a lot of paid services struggle to give you more than 50Mbps.


----------



## puma99dk| (Jun 6, 2019)

my vpn provider doesn't have an issue giving me 200/200Mbps far from that, it's just the openvpn in pfsense that's not good enough for that.

I want to use OpenConnect but it doesn't have a package for PFSense and my experience with applications that doesn't have a package in the package manager are that they work fine for some times then suddenly out of no where they don't anymore.

This I tested on different setups from Pentiums, i3, i5 and i7 and some AMD APU's anywhere from 512MB ram to 12GB same deal. Also with HDD's and SSD's.


----------

