Virtualized pfsense, now AES is having no effect on OpenVPN performance

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
E

eroji

Active Member
Dec 1, 2015
276
52
28
40
j_h_o said:
My transfers across the tunnel are performant now.

I have Hyper-V (2012 R2) running on an E5-2620 and a E3-1230v3 across a 1GbE link. I was seeing around 30MB/s, and I'm hitting 100MB/s now.

I'll go shove in my 10GbE switch sometime, and attach SFP+ DACs, but that won't be a few months before I get back to this DC.
Click to expand...
What did you have to do to gain the speed?
 
J

j_h_o

Active Member
Apr 21, 2015
644
180
43
California, US
Yup, I see the performance I said above, 100MB/s (maxxing out 1GbE) across OpenVPN now. Confirmed again with a Veeam backup across the tunnel, in addition to SMB traffic and SCP traffic.

I twiddled the System>Advanced>Misc>AESNI, then in the OpenVPN server/client, enabled BSD cryptodev engine, with AES-256-CBC. I'm running 2.2.5 on both VMs on the E5-2620 and E3-1230v3 as I said. Both boxes are running 2012 R2.

(I'm positive I twiddled these before, but on an earlier version of pfSense.)
 
E

eroji

Active Member
Dec 1, 2015
276
52
28
40
Well, I'm leaning towards Server 2 isn't behaving properly. I was planning to replace the USB boot drive in it and add a X520-DA2 anyway, so I guess I'll just go ahead and do a fresh reinstall along with reinstall of pfsense (perhaps back on a dedicated box) this weekend when I am over there so see how it goes.
 
S

sthsep

Member
Mar 7, 2016
72
10
8
eroji said:
Is this when you select cryptodev in the OpenVPN configuration or when you turn on AES-NI in Advanced > Misc?

I'm not seeing any new entries in /var/log/openvpn.log, but this is interesting... (on Server 2)
Code: 
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
Feb 29 12:00:11 pfsense2 openvpn[10534]: write UDPv4: No buffer space available (code=55)
BTW, you guys are awesome. Thanks for taking the time to reply to this.
Click to expand...
I also have this on my pfsense VPN box if I do some traffic ~100Mbit. Found also not a solution for this but maybe someone other here. Maybe we can just make this buffer bigger? Or maybe it is because my ping gets very high when I use about 100Mbit (Nearly 10times more RTT) and it can't so fast send the packages?
 
E

eroji

Active Member
Dec 1, 2015
276
52
28
40
I am not sure what it is still. The errors may just be bogus. I tried converting both pfsense back to physical and the speed did not change. So it's either something in the config, which I don't think is the case. Or one of the ISP is throttling the traffic.
 
JimPhreak

JimPhreak

Active Member
Oct 10, 2013
553
55
28
eroji said:
I am not sure what it is still. The errors may just be bogus. I tried converting both pfsense back to physical and the speed did not change. So it's either something in the config, which I don't think is the case. Or one of the ISP is throttling the traffic.
Click to expand...
Have you tried testing an OpenVPN client connection to a VPN provider such as AirVPN/PIA? I believe they offer free trials so you could try setting up a connection to one of their servers and see if you're still having speed issues. Just another troubleshooting option.
 
E

eroji

Active Member
Dec 1, 2015
276
52
28
40
No, I have not. That is a good idea. I am going to be building both pfsense again with C2558 so I will give it a shot after that is done.
 
JimPhreak

JimPhreak

Active Member
Oct 10, 2013
553
55
28
eroji said:
No, I have not. That is a good idea. I am going to be building both pfsense again with C2558 so I will give it a shot after that is done.
Click to expand...
That's the exact CPU I'm running in my pfSense box that acts as a server for a 100Mbps site-to-site connection to another pfSense box running on a Celeron J1900. I get full speed and the CPU never goes above 15-20% on the C2558 and not beyond 25% on the J1900.
 
  • Like
Reactions: eroji
E

eroji

Active Member
Dec 1, 2015
276
52
28
40
JimPhreak said:
That's the exact CPU I'm running in my pfSense box that acts as a server for a 100Mbps site-to-site connection to another pfSense box running on a Celeron J1900. I get full speed and the CPU never goes above 15-20% on the C2558 and not beyond 25% on the J1900.
Click to expand...
Yea, seems like that's the golden setup for pfsense with quickassist support upcoming. I found 2 boards used and pretty cheap. So I figured it's better sell off some other parts I had been using for this purpose which were just too overpowered and not efficiently utilized.
 
kroem

kroem

Active Member
Aug 16, 2014
252
44
28
38
canta said:
Do not know on esxi in detail...

on proxmox ( or linux KVM), you need to pass real cpu to VM since hardware acceleration not supported in Virtual CPU.
I change processor to real processor. AES kicks in on openvpn

you should see a big differences on cpu processing when AES disabled or enabled by assuming your openvpn is using AES encryption.

the other to consider, openvpn is running single thread, so highest processor has better performance on through put....
Click to expand...
Hey there! Do you mean you changed the cpu typ to whatever is actually on baremetal?

I'm having issues not getting OPNSense seeing AES-NI inside a Proxmox VM....
 
You must log in or register to reply here.
Top Bottom