News for hackers. Stuff that matters.

A comment on Ask HN: What VPN service are you currently using?. Parent comment

Re:Ask HN: What VPN service are you currently using? by whocares123 on Monday February 25, 2019 @03:20AM (#19243973)
I have 1GB fiber, do they offer 1GB speeds? How badly would using them as my VPN affect my speed?
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by _jcwu on Monday February 25, 2019 @05:19AM (#19244516)
If you have 1GB, then forget anything OpenVPN. Use IPSec or Wireguard.

With OpenVPN you will bottleneck at ~300Mbit\s. With IPSec and Wireguard I have had no issues getting ~900Mbit\s to my own server.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by dspillett on Monday February 25, 2019 @05:55AM (#19244659)
> you will bottleneck at ~300Mbit\s.

Any idea where the bottleneck was there? CPU use? Protocol latency? I'd be interested to see some test results around that if you know of any that have been published.

A little anecdotal information: some years ago I did a CPU-load test with OpenVPN on a diminutive Atom-based netbook as the client, and it maxed out at around 95mbit/s on a 100mbit/s network (actually a gbit network, but the netbook only had a 100mbit NIC itself) while just doing simple bulk transfers.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by chrisper on Monday February 25, 2019 @06:14AM (#19244749)
You could start here:

https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_...

>It is easily possible to saturate a 100 Mbps network using an OpenVPN tunnel. The throughput of the tunnel will be very close to the throughput of regular network interface. On gigabit networks and faster this is not so easy to achieve. This page explains how to increase the throughput of a VPN tunnel to near-linespeed for a 1 Gbps network.

I think the protocol just wasn't designed for such high speeds.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by eptcyka on Monday February 25, 2019 @08:23AM (#19245403)
Have you read the code? It's woefully unparallelisable and is written to support more platforms rather than work better on any single one of them.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by dspillett on Monday February 25, 2019 @10:03AM (#19246076)
> woefully unparallelisable

It certainly doesn't use multiple cores for a single connection, though I've never tested (or reviewed the code) to see if it does manage to spread the computational load of multiple connections over more CPU resource.

I've not read the above linked article in detail (no time ATM) but there seems to be mention of offloading AES calculations to compatible hardware, so the bottleneck would appear to be CPU use.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by cbhl on Monday February 25, 2019 @12:15PM (#19247254)
Does using multiple cores on a single NIC actually speed up a network connection? If you're doing gigabit with 1500 byte packets, you get 12 ms to encrypt and process each packet -- I'd expect any cross-CPU synchronization to easily blow through that.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by 05 on Monday February 25, 2019 @12:41PM (#19247523)
If the bottleneck is encryption speed, then you can definitely improve perf by spreading packets across the cores. Inter-core synch isn’t that expensive, and 12us is 24000 cycles on a 2GHz CPU. cmpxchg costs ~20 cycles (https://stackoverflow.com/questions/4187914/average-latency-...).

PS. And you don’t need to submit/receive packets to NIC one by one, either; those things support DMA scatter/gather.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by cbhl on Monday February 25, 2019 @12:47PM (#19247590)
That's a really helpful response; thanks!
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by vel0city on Monday February 25, 2019 @12:09PM (#19247170)
Earlier you claim you will only ever hit ~300Mbit, but then you link to an article where the author hit 885Mbit throughput after tweaking a few settings and ensuring OpenSSL was using AES-NI.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by chrisper on Tuesday February 26, 2019 @12:39AM (#19252240)
Yes. But that article never worked for me.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by saosebastiao on Monday February 25, 2019 @12:37PM (#19247483)
Do you have any recommendations for wireguard providers? I'd love to try it out, but I don't want to host my own server.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by Jonnax on Monday February 25, 2019 @03:43AM (#19244065)
IPsec at 1gbps needs a powerful router.

A Juniper SRX 320 that I have can only can reach about 500mbps.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by fgonzag on Monday February 25, 2019 @02:11PM (#19248418)
PFSense on a cheapish high clockspeed server will easily get there. Total cost about a grand, a bit more if you want to use a low power no fan solution.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by arcaster on Monday February 25, 2019 @01:50PM (#19248227)
Oh man, I've been wanting to pick one of those routers up for some time. What did licensing cost you for your SRX 320?
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by system2 on Monday February 25, 2019 @05:59AM (#19244678)
I doubt they cost $3 per month though.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by yawniek on Monday February 25, 2019 @07:28AM (#19245116)
a pcengines apu does just fine, you'll get 900mbps+ easily with ipsec
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by pault on Monday February 25, 2019 @09:31AM (#19245829)
I've been using PIA with gigabit fiber for two years, and anecdotally I've not noticed a difference.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by flyingfences on Monday February 25, 2019 @03:37PM (#19249215)
I had the same experience when I had such a good connection a couple years ago.
[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by usx on Monday February 25, 2019 @03:47AM (#19244081)
I would like to know a bit more about this as well.

I often play online multiplayer games, my main issue with using a vpn full time would be the performance impact here.

I'm also curious if PIA has a way where if I launch certain apps, it would pause itself while that application is running? Or some way to automate on/off state of the VPN.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by mrweasel on Monday February 25, 2019 @05:08AM (#19244475)
I doubt it would affect your speed much. How often are you able to utilise 1Gbps anyway?

Sure in theory you'd see a slow down, but given that most of the sites and service you use aren't able to deliver 1Gbps to you directly, the decrease in speed is most likely lower than you'd think.

[ Parent | on HN ]
Re:Ask HN: What VPN service are you currently using? by chrisper on Monday February 25, 2019 @05:21AM (#19244532)
>but given that most of the sites and service you use aren't able to deliver 1Gbps to you directly

You would be surprised how wrong this statement is.

Especially if you are a gamer, almost any platform can max out a Gbit connection easily.

Besides at those speeds you start seeing all kinds of issues (like OpenVPN implementation being very inefficient).

[ Parent | on HN ]