It is good that OpenSSL and OpenVPN can use AES-NI, but I was referring to that OpenVPN by default uses Blowfish and not AES, which is not supported by AES-NI if I am not mistaken. So in order to use the hardware engine one would have to manually change the config to use "cipher aes-128-cbc" or a similar supported cipher.
My transfers across the tunnel are performant now. I have Hyper-V (2012 R2) running on an E5-2620 and a E3-1230v3 across a 1GbE link. I was seeing around 30MB/s, and I'm hitting 100MB/s now. I'll go shove in my 10GbE switch sometime, and attach SFP+ DACs, but that won't be a few months before The most important hardware component for VPN speed is CPU. OpenVPN heavily depends on the CPU for encryption/decryption of traffic. Other components such as memory, network interfaces or disk are far less important. Here's a checklist for choosing VPN hardware. CPU must support AES-NI; OpenVPN software is unable to utilize multi-core CPUs. Consumer and business customers will quickly appreciate that this product packs a serious punch with the factory edition of pfSense® software, world-class price-performance, elegant packaging, and an unbeatable low price. Nov 14, 2016 · This is still very slow. Try loading cryptodev and you should see time under 1 second per test ie: openssl speed -evp aes-256-cbc Doing aes-256-cbc for 3s on 16 size blocks: 479995 aes-256-cbc\’s in 0.16s The AES instruction set is an extension of Intel CPUs with the goal to speed up encryption and decryption (E/D) performance. OpenSSL, the SSL library used with OpenVPN, is compatible with those instructions. I assume this does have a notable effect on connection speeds as the
Considering the compatibility and versatility, this Netgate device is supportive towards IPsec, OpenVPN, IPV6, NAT, BGP, and many more formats. The device employs the Intel Atom CPU Quad Core 2.2 GHz which is providing you with utmost high performance and enhances the AES-NI performance effectively.
OpenVPN is a critical set of protocols used to provide secure communication through the Internet. There are many different cipher suites that can be used depending on the requirements of the user. The configuration used may impact the performance and therefore the throughput of the devices in the network. Jan 18, 2019 · Kudos to OpenVPN team for this. 1. Just like lzo, it should be clear that there isn’t much use to lz4 in place of lz4-v2 except for compatibility with older clients. Cipher algorithm and size. Different ciphers have different speeds in different hardwares (ie an AES-NI capable CPU). This is a hard topic to cover as it is up to you to decide
The AES-NI instruction set extensions are used to optimize encryption and decryption algorithms on select Intel and AMD processors. Intel announced AES-NI in 2008 and released supported CPUs late 2010 with the Westmere architecture. AMD announced and shipped AES-NI support in 2010, starting with Bulldozer.
Hi all, I just upgraded from OpenSSL 0.9.8o to 1.0.1 hoping to get AES-NI support for OpenVPN that way. But using 'openssl speed' I found that AES-128-CBC throughput dropped from 242 MB/s to 102 MB/s. Hi, Thanks for your reply. I know that OpenVPN is single-threaded. But I expect more than 5MB/s on a CPU with 1,6/2,6 GHz and AES-NI support though. Consider that the OpenSSL speed benchmark showed that it's able to encrypt between 100 and 300 MB/s, even in the virtualized environment. Oct 03, 2018 · The second tweak made was to relink OpenVPN 2.1.4 using the OpenSSL 1.0.0a libraries with the Intel AES-NI patch applied. This patch is included by default in Fedora 12 and higher. Previously it was reported that the Intel AES-NI patch caused the performance on non-AES-NI capable hardware to improve by a factor of 2. OpenVPN¶ To take advantage of acceleration in OpenVPN, choose a supported cipher such as aes-128-cbc on each end of a given tunnel, then select BSD Cryptodev Engine for Hardware Crypto. Similarly, if the system employs the VIA Padlock engine, choose an appropriate cipher and select VIA Padlock for Hardware Crypto. It has AES-NI enabled as shown on the System Information "AES-NI CPU Crypto: Yes (active)". Also shows "Hardware Crypto: AES-CBC,AES-XTS,AES-GCM,AES-ICM". I have OpenVPN setup with "Hardware Crypto" under the OpenVPN server config set to "No Hardware Crypto Acceleration" as there is no other option. Sep 21, 2016 · Could someone remind me of the status of the H3 crypto engine, both hardware (capabilities, aes-ni ?) and software (mainline or vanilla kernels) ? I've been testing openvpn on an amlogic s905 box (still need to fix my beelink x2 problems) and as expected i'm hitting a cpu bottleneck. OpenSSL ＋ AES-NIパッチを使用する 次のチューンナップとして、OpenVPN 2.1.4とIntel AES-NIパッチ適用済のOpenSSL 1.0.0aをリンクさせてみます。このパッチはFedora 12以降にはデフォルトで組み込まれています。