VPN on router vs devices

[Scarparoo]

Hi guys

I have Nordvpn.

Works great on individual devices. I get good speeds. I decided to try it out on my new router.
When I use it on the router I get about 20% max of what I get on an individual device. Is there maybe something obvious I'm missing?

Router is Asus XT8 mesh system. Is it because the router is not powerful enough?

If anyone has any suggestions that would be great.

Thanks

 

[Rainmaker]

Hi guys

I have Nordvpn.

Works great on individual devices. I get good speeds. I decided to try it out on my new router.
When I use it on the router I get about 20% max of what I get on an individual device. Is there maybe something obvious I'm missing?

Yes...

Router is Asus XT8 mesh system. Is it because the router is not powerful enough?

Bingo. A little plastic consumer 'router' will have a puny (often single or dual core) MIPS CPU, with very limited processing power - often just a few hundred MHz. They simply can't keep up with encrypting and decrypting packets, especially for something single threaded and heavy, like OpenVPN. Answer is build an x86 router, or run VPN per device as you've discovered.

 

[Scarparoo]

Thanks for confirming. Guessed it was that. Didn't realise they were so underpowered though. I'll stick with individual devices. Cheers

 

[andy_mk3]

I have an Intel G4400 in my router, using NordVPN on it but on my 500Mb connection it can easily use 60-70% of that CPU. A consumer router wont be anywhere as powerful as that. I've got an i5 coming for it to upgrade as that CPU usage is higher than I would like.

 

[Avalon]

I have an Intel G4400 in my router, using NordVPN on it but on my 500Mb connection it can easily use 60-70% of that CPU. A consumer router wont be anywhere as powerful as that. I've got an i5 coming for it to upgrade as that CPU usage is higher than I would like.

This is going to be awkward.

Firstly a consumer router without the ability to do hardware acceleration will struggle, doing encryption in software sucks, openVPN being single threaded renders multi-core largely pointless, the few consumer routers that happen to support hardware acceleration on the CPU actually do a few hundred mbit assuming you use a supported encryption type.

That brings us to the awkward part... your G4400 has AES-NI aka hardware acceleration, it should do line speed near enough on your connection your VPN encryption settings properly, but as OpenVPN is single threaded, that i5 is likely a waste of time and money vs what you have - you just need to set it up properly. Sorry.

 

[andy_mk3]

This is going to be awkward.

Firstly a consumer router without the ability to do hardware acceleration will struggle, doing encryption in software sucks, openVPN being single threaded renders multi-core largely pointless, the few consumer routers that happen to support hardware acceleration on the CPU actually do a few hundred mbit assuming you use a supported encryption type.

That brings us to the awkward part... your G4400 has AES-NI aka hardware acceleration, it should do line speed near enough on your connection your VPN encryption settings properly, but as OpenVPN is single threaded, that i5 is likely a waste of time and money vs what you have - you just need to set it up properly. Sorry.

The i5 has much higher clock speeds and is a generation newer with higher ipc. You're also assuming I bought the cpu only for that reason, it is not.

So no, not awkward at all.

 

[Avalon]

The i5 has much higher clock speeds and is a generation newer with higher ipc. You're also assuming I bought the cpu only for that reason, it is not.

So no, not awkward at all.

I don't think we have the same definition of 'assume'.

I have an Intel G4400 in my router, using NordVPN on it but on my 500Mb connection it can easily use 60-70% of that CPU.

Is it really 'assumption' when someone specifically states CPU in router, VPN usage, connection speed to router and CPU utilisation of router? I mean you're the one specifically telling us what you have, what you use it for and what you got, it's only after it's pointed out that the only way those numbers add up is if you are doing things in software that normally get done in hardware, then you suddenly remember that something else is eating your CPU that you not only forgot to mention in the original reply, but also the follow up. That seems a little... well I wouldn't want to assume

The IPC uplift you mention was circa 1% from Sky Lake to Kaby Lake (and i'm being generous), they're both 14nm parts with essentially the same architecture, heck it was only 10% from Haswell to Kaby Lake. I used an an old G4400 as a router for a while on a 300Mbit connection, funny thing is I had it doing 2-3 site to site VPN's, PBR over a fourth tunnel and Suricata amongst other things as I was chasing the UTM dragon, I don't remember it 'easily' using 60-70% of the CPU. I had to do something amazingly stupid to do that, like trying to do 10Gb software switching (Tip: BAD IDEA) or software encryption on multiple VPN tunnels. If you're looking for an up-side, the i5 gives you twice the cores/threads and the clock speed up-lift, but again based on a connection twice as fast and using 6th-7th gen i3's (2c/2t) in my routers under UT/*Sense and recently *WRT, you'd certainly have to be doing something pretty amazing one way or another.

 

[philip2009]

Hi guys

I have Nordvpn.

Works great on individual devices. I get good speeds. I decided to try it out on my new router.
When I use it on the router I get about 20% max of what I get on an individual device. Is there maybe something obvious I'm missing?

Router is Asus XT8 mesh system. Is it because the router is not powerful enough?

If anyone has any suggestions that would be great.

Thanks

Typically dedicated routers only tend to do IPsec VPN hardware acceleration if you're looking for high performance OpenVPN then you're typically looking at running a router distro on a PC. Wireguard is becoming more popular and can deliver good performance without dedicated hardware acceleration but I'm not sure how it performs on the kind of CPUs you find in home routers.