We are taking a short break between November 18 and 24. Orders made during this period will be delayed in shipping.

APU2 / APU3 / APU4 - OpenVPN and Wireguard Performance benchmark

This article has been last updated on July 28, 2019

APU2/3/4 boards have a solid VPN performance due to the native support for AES-NI instructions in the CPU. Encryption happens on the CPU level instead of the software level. 

pfSense OpenVPN performance

APU routers achieve about 100 Mbit/s continuous throughput on OpenVPN on pfSense 2.4.4. Hardware should be able to achieve much more, but OpenVPN isn't multithreading and the throughput is limited to single core per connection.

Throughput shown on the screenshot below is about 112Mbit/s, but the acutal VPN throughput will be a bit lower (100Mbit/s) because of VPN tunnel overhead.  

The CPU load during this test was 34%. One out of 4 cores is hard at work.

 

We have tested APU2C2 with NordVPN client and pfSense configured using AES-128-GCM cipher. It achieved about 100Mbit up, 100Mbit/s down.

See screenshot from http://www.bredbandskollen.se/en/ below. 

 

Here's a session from iperf3 showing the actual VPN throughput.

sniku@homedesktop:~$ iperf3 -c 192.168.5.50 
Connecting to host 192.168.5.50, port 5201
[  5] local 10.0.8.2 port 36574 connected to 192.168.5.50 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  12.9 MBytes   108 Mbits/sec   37   48.6 KBytes       
[  5]   1.00-2.00   sec  12.5 MBytes   105 Mbits/sec   19   41.1 KBytes       
[  5]   2.00-3.00   sec  11.7 MBytes  98.4 Mbits/sec   23   38.6 KBytes       
[  5]   3.00-4.00   sec  11.9 MBytes   100 Mbits/sec   28   49.8 KBytes       
[  5]   4.00-5.00   sec  12.5 MBytes   105 Mbits/sec   28   53.6 KBytes       
[  5]   5.00-6.00   sec  12.5 MBytes   105 Mbits/sec   35   47.4 KBytes       
[  5]   6.00-7.00   sec  12.5 MBytes   105 Mbits/sec   27   36.1 KBytes       
[  5]   7.00-8.00   sec  11.4 MBytes  95.3 Mbits/sec   30   46.1 KBytes       
[  5]   8.00-9.00   sec  12.1 MBytes   102 Mbits/sec   22   52.3 KBytes       
[  5]   9.00-10.00  sec  12.3 MBytes   103 Mbits/sec   32   46.1 KBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   122 MBytes   103 Mbits/sec  281             sender
[  5]   0.00-10.00  sec   122 MBytes   102 Mbits/sec                  receiver

iperf Done.

This test was performed on pfSense 2.4.4, on APU2 with BIOS v4.9.0.3.

Note, throughput will be heavily dependant on the cipher you use. We strongly suggest AES-GCM because it's more secure AND more performant. See comparison below

 Cipher  Throughput
 AES-128-GCM / SHA-1  ~103 Mbit/s
 AES-128-GCM / SHA256   ~ 99 Mbit/s
 AES-256-GCM / SHA256   ~ 99 Mbit/s
 AES-128-CBC / SHA256  ~ 70 Mbit/s
 AES-256-CBC / SHA256  ~ 68 Mbit/s

 

OpenWRT OpenVPN performance

OpenWRT is based on Linux (while pfSense is based on OpenBSD). Linux has much better OpenVPN performance.

In our tests OpenWRT outperforms pfSense by about 40%. We have performed the same throughput benchmark on OpenWrt 18.06.4. And the result can be seen on a screenshot below. 

OpenWrt delivers about 145 Mbit/s on OpenVPN.

 

WireGuard VPN throughput

Wireguard is the next generation, modern VPN that performs way better than OpenVPN or IPSec.

Here's a simple test we ran between two APU3 routers running on debian. 

root@debian:~/wg# iperf3 -c 10.0.0.1
Connecting to host 10.0.0.1, port 5201
[ 4] local 10.0.0.2 port 36568 connected to 10.0.0.1 port 5201
[ ID] Interval Transfer Bandwidth Retr Cwnd
[ 4] 0.00-1.00 sec 68.5 MBytes 574 Mbits/sec 66 1.41 MBytes 
[ 4] 1.00-2.00 sec 79.5 MBytes 667 Mbits/sec 0 1.55 MBytes 
[ 4] 2.00-3.00 sec 74.9 MBytes 628 Mbits/sec 36 1.17 MBytes 
[ 4] 3.00-4.00 sec 74.1 MBytes 623 Mbits/sec 0 1.24 MBytes 
[ 4] 4.00-5.00 sec 76.2 MBytes 640 Mbits/sec 0 1.28 MBytes 
[ 4] 5.00-6.00 sec 81.2 MBytes 680 Mbits/sec 0 1.31 MBytes 
[ 4] 6.00-7.00 sec 76.2 MBytes 640 Mbits/sec 20 1003 KBytes 
[ 4] 7.00-8.00 sec 78.5 MBytes 658 Mbits/sec 0 1.04 MBytes 
[ 4] 8.00-9.00 sec 77.5 MBytes 651 Mbits/sec 0 1.07 MBytes 
[ 4] 9.00-10.00 sec 73.3 MBytes 614 Mbits/sec 0 1.10 MBytes 
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bandwidth Retr
[ 4] 0.00-10.00 sec 760 MBytes 638 Mbits/sec 122 sender
[ 4] 0.00-10.00 sec 757 MBytes 635 Mbits/sec receiver
- - - - - - - - - - - - - - - - - - - - - - - - -

Wireguard uses all 4 CPU cores, and beats OpenVPN over 6x times! More than 600Mbit/s is trully amazing! 

Hopefully we will see Wireguard included in pfSense and other popular router OSes soon.

OpenWRT already ships with WireGuard!

 

TLSense OpenVPN throughput

See the router comparison table for TLSense OpenVPN throughput.