Inlägg

Inlägg som teklager har skrivit i forumet
1 2 3 4 5
Wireguard i custom router
Av teklager
Permalänk
Skrivet av gonace:

@teklager Om du har möjlighet någon gång att köra tester för pfsense och deras WireGuard in-kernel implementation så hade det varit mycket intressant att se!

Gå till inlägget

Hey, I'll try to run some tests during the weekend and report back!

This is off-topic, but there are several issues with the new pfSense 2.5.0 release, ranging from USB installation problems to performance degradation and lockup issues, even on Netgate's official hardware.

Nevertheless, I'll play around with Wireguard to see what performance is achievable.

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av No_Jah:

What CPU is that, and did you perform the same test using OpenVPN, if so what speed did you then get?

Gå till inlägget

That was `i7-4510U` CPU. I remember running a similar test with OpenVPN and NordVPN about 2 years ago. At that time I believe I got 700Mbit/s but suspect the limitation was on the NordVPN side or the ISP side (not verified though).

Skrivet av improwise:

Har inte riktigt haft tid för detta men nu börjar det klia i fingrarna vad är bästa OS för att köra WG på en Custom Router I dagsläget? Open WRT har fungerat riktigt bra men är hyfsat less på att interface och annat känns så begränsat och rörigt. Antar att det fortfarande är rätt dött lopp mellan pfsense och opnsense? Initialt var det väl samma kodbas men vet inte hur mkt dom skiljer sig åt idag annat än UI.

Gå till inlägget

I have some thoughts on this: https://teklager.se/en/pfsense-vs-opnsense/

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av box4mm:

Would this mini-pcie card work with TLSense i5 or i7? I guess so
http://www.commell.com.tw/Product/Peripheral/PCI%20Express%20...

Gå till inlägget

In principle, it should work. It runs on a PCI interface that is present in the TLSense i5/i7 box.
I have not tested this specific card so I can't guarantee that it's compatible, but as far as I can tell, it should be fine.

Skrivet av box4mm:

Edit: Do you still have the testsetup running?
Would be interesting to try bidirectional iperf with wireguard on opnsense / openwrt, the reason is that they are both userspace and not in kernel like ubuntu, so would be nice to know if its possible in those, since in windows for example its not, doesnt matter what my hardware is

Gå till inlägget

I can run some more tests this weekend

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av box4mm:

Awesome job your doing, makes me want to support you guys just for that
Yeah the i5 probably also does gigabit both ways, i guess i will have to wait however many weeks until its in stock

Gå till inlägget

Thanks for your kind words! Yeah, i5 should be back in stock in about 2-3 weeks.

Skrivet av box4mm:

In the meantime ill be checking out opnsense, openwrt and other router OS you have listed.
OPNSense has a really nice UI indeed but it seems abit to much for simple homenetworking.

Gå till inlägget

Not sure if OPNsense is "too much". To me, it seems quite intuitive to use. Maybe other users can also comment on this?

Skrivet av box4mm:

I do like however, that u can see the firewall log in realtime, are there similar feature with openwrt?

Gå till inlägget

I think this is where OpenWRT is lacking. Firewall logs aren't enabled by default, and it's not super straightforward to get a log of dropped packets. It's possible to do, but the user experience is far from OPNSense in this area.

Skrivet av box4mm:

Thanks again for testing, I am correct in assuming i will have to wait for i5 correct?

Gå till inlägget

Yes, some patience is required here

Skrivet av box4mm:

EDIT: My plan is to use my current Asus 86u in AP-mode for wifi, i read openwrt is best for those kind of things?

Gå till inlägget

If you plan to use your Asus as an access point, then you can use any router OS.
If you would want to have WiFi inside of the main router than I would recommend OpenWRT because it has much better WiFi support.

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av box4mm:

Yes, with 40% CPU maybe the i7 is overkill, i understand these tests are for sure time consuming.
With Ubuntu its probably the case that its so well implemented that the cpu does way less work then windows for example, or even openwrt/opnsense (just guessing).

Gå till inlägget

I used Ubuntu because I had two boxes with already installed OS. I believe OpenWRT will have the same performance. In fact, I have one APU2 with OpenWRT so I can run another test quickly... more about this below.

Skrivet av box4mm:

My initial thoughts is, i work in IT etc, but im not sure i will be savvy enough to handle Ubuntu as a mainrouter is it a modified version in some way for just alittle bit more usefriendly? Or maybe basic configuration is something that would be included somehow?

Gå till inlägget

I would not recommend Ubuntu on a router to anyone I used it only for benchmarking purposes. I suggest using OpenWRT for wireguard. It has a relatively nice web UI for configuring everything. There's no need to mess with the terminal. I find it pleasant to use.

Skrivet av box4mm:

EDIT: I see TLSense i5 out of stock, so ye then maybe "APU4C4" is the best next test :), or either APU maybe if they perform the same, then we would get a good idea of how the range from APU -> i5 -> i7 is in terms of performance

Gå till inlägget

Yeah, the i5 are out, but they should be back in about 2 weeks. See this performance comparison for different models: https://teklager.se/en/knowledge-base/apu-vs-tlsense-cpu-perf... I believe i5 will run at gigbit both ways as well.

I executed a quick test with OpenWRT as a wireguard server. The download throughput was 750Mbit/s - more than I expected. The upload was at ~520Mbit/s. Interestingly, it's not identical. I suppose encryption is more performant than decryption. These tests weren't executed simultaneously. If I run upload and download at the same time, the numbers drop by half. I think this is a great result for a router that consumes 6W of power

https://i.imgur.com/kIlExH8.png

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av box4mm:

Great thank you, im interested in a router that can do wireguard 1000/1000 both directions simultaneously, wireless (dont need high speeds but need wireless)

edit: im guessing APU1-4 cant? if you can specify OS also for tests

Gå till inlägget

Hey @box4mm,

finally, I found some time to run the wireguard throughput test for you.

I took two TLsense i7 routers, installed Ubuntu on both of them and configured a Wireguard connection between them. Here's how it looks like

https://i.imgur.com/zL6C8B7.jpg

And here's how the topology looks like. As you see it's very simple - two routers connected with a cable.
This should be roughly equivalent to a typical client-server connection between your router at home and server somewhere on the internet (Mullvad or similar).

https://i.imgur.com/zlro8XI.png

I opened 3 terminals for each router (6 in total).
On wireguard-server I executed
1. `iperf3 -s -p 5000` (first iperf server for download)
2. `iperf3 -s -p 5001` (second iperf server for upload test)
3. `htop` (to see memory/CPU utilization)

On wireguard-client I executed
1. `iperf3 -c 10.10.0.1 -t 100 -p 5000` (download test)
2. `iperf3 -c 10.10.0.1 -R -t 100 -p 5001` (reverse / upload test)
3. `htop` (to see memory/CPU utilization)

To summarize, I'm testing upload and download speed at the same time. Both connections are running through a wireguard tunnel.

The results are excellent. I'm getting a full gigabit in both directions simultaneously, with about 40% CPU utilization.
In practice, the upload/download speed is at 890-900Mbit/s in both directions due to the VPN overhead. That, of course, can't be helped, as this is how VPN works.
Without Wireguard, the throughput is 940Mbit/s in both directions. The "missing" 40-50Mbit/s is the encapsulation overhead from Wireguard.

I made a screenshot of the 6 terminals while the test was running.

https://i.imgur.com/2QgGNev.png

The server is on top, and the client is on the bottom.

I planned to run this test again on APU, but it takes quite a lot of time to set it up, so it will have to wait until next weekend.

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av box4mm:

Hello

This post is from more then 6months ago but.
When you say "On TLSense routers you will get full Gigabit on WireGuard", are there graphs or somewhere i can read about this? And is this Gigabit in both directions at the same time, full duplex, bidirectional?

Thank you

Gå till inlägget

Hi @box4mm
It's been more than a year since I've executed these tests and I don't have the data anymore. I'll run another test tomorrow and come back to you with the performance data and some charts

Best,
Pawel

Citera
Gå till inlägget
Konfiguration av 2.4/5 GHz OpenWrt
Av teklager
Permalänk
Skrivet av KAD:

Bra fråga!

Jag tycker vi kallar in @Teklager (Pawel) som får svara!

Jag har två wifi-kort i min APU, ett wle900vx som du också har (dual band) och ett wle600vx (som du inte har). Jag kör ett nät på vardera kortet, 5GHz respektive 2.4GHz. Jag vill minnas att jag och Pawel diskuterade det hela när jag köpte min burk och kom fram till att det krävdes två kort för att kunna köra två band samtidigt.

Frågan är alltså ifall om man kan köra 2.4GHz och 5GHz samtidigt på ett wle900vx och hur man i så fall konfigurerar det.

Gå till inlägget

Thanks for pinging me! It's really cool to see that so many people around here drive Open Source routers!

It's true what you say. To have both 2.4Ghz and 5Ghz networks, you need two WiFi cards.
APU2D0 model has wle900vx which is suitable for 2.4 and 5ghz, but not simultaneously - you have to choose the band.

If you need to drive some legacy hardware that can't talk on 5Ghz band, you can install additional WiFi card in the remaining mPCIe slot. I suggest wle200nx. The good part about having an open-source device is that you can rebuild or extend it!

1. Open the router (there are 4 screws on the side). It will look similar to this:

https://i.imgur.com/gErWEXF.png

2. Install an additional card in the marked space.

3. Drill two 5.5mm holes on the side of the top chassis. See where it should be drilled:

https://i.imgur.com/8C88w4U.png

4. Connect the pigtail cables to the card, and to the drilled holes.

5. Assemble the chassis and screw in the antennas. It should look similar to this:

https://teklager.se/media/filer_public_thumbnails/filer_public/f...

If you have any questions, feel free to ping me

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av tudz:

Were those tests done on Linux or BSD? Performance will be a lot lower on BSD since it runs in userspace instead of kernel.

Gå till inlägget

There's a little section about Wireguard performance on APU2 at the end of this article: https://teklager.se/en/knowledge-base/apu2-vpn-performance/

I ran this test on Linux. I have not tried on BSD yet. I also think that the performance will be lower, but I'm not sure by how much.

Citera
Gå till inlägget
TekLager.se
Av teklager
Permalänk
Skrivet av reverend benny:

@teklager:
Would you say there are any difference in quality from the Celeron and I5 kit, it seems like its from 2 different manufacturers?

The i5 obviously has a lot more of everything, but apart from that things like building quality, quality of components and if you have had many faulty devices is always interesting to know.

Gå till inlägget

From the quality perspective, I think they are equivalent. Both of these boxes are well built and perform well.

TLSense i5 will have a lot more horsepower for IDS/IPS/VPN. If these are not very important to you then you won't see a difference in regular routing.

TLSense J3P4 has really small form factor which I think is cool

https://teklager.se/media/filer_public_thumbnails/filer_public/4...

From the left: TLSense i7 6P, TLSense i5, J3P4, APU4C4, APU2D4, APU2D0.

Cheers!

Citera
Gå till inlägget
TekLager.se
Av teklager
Permalänk
Skrivet av reverend benny:

Thanks for a very quick reply, and on a weekend as well

Gå till inlägget

I run TekLager as a hobby business, so I usually answer during weekends and after regular office hours

Skrivet av reverend benny:

One of the reasons why I was a bit uncertain about Vilfo is what you pointed out, I am depending on them to deliver updates and support. Not saying they won't but at least with this solution I won't have to worry about that.

Gå till inlägget

I'm a little torn on this because I support what Vilfo is trying to achieve (secure personal routing), but I have a hard time trusting proprietary software since I can't really verify that it's truly secure.
On the other hand, I understand why they didn't open source the Vilfo OS. This software is their competitive advantage, so it's a business decision.
I wish there was a way for them to open source it, and keep the competitive edge.

Skrivet av reverend benny:

I have one more question that probably should be more aimed toward the OS manufacturer, but that maybe you could answer is:
I want to setup so some devices use VPN and some don't via the router either via VLAN or IP. Is that possible?
Also thinking of maybe mess around using two VPN providers.

Gå till inlägget

I have not tried this, but I believe that it should be quite easy in pfSense/OPNsense. Once you have a VPN provider configured, you will have a virtual VPN WAN interface, and your regular WAN interface. Then it should be possible to route some clients to regular WAN and some clients to VPN-WAN. I believe you can do this based on IPs or VLANs in pfSense by going to Firewall-> NAT -> Outbound -> create Manual Outbound NAT rule.

Best,
Pawel

Citera
Gå till inlägget
Ny router för 500mbit+ / (Läs kraven!)
Av teklager
Permalänk
Skrivet av andreas_dock:

Intressant !!
Skall helt kolla upp deras hemsida och kanske kontaktar @TekLager då vid frågor etc

Gå till inlägget

Hey there! If you have any questions, I'm happy to help or advise!

Citera
Gå till inlägget
TekLager.se
Av teklager
Permalänk
Skrivet av reverend benny:

Ok, so was just about to put in an order for a Vilfo router when I stumbled over this thread.
Have had a good readup on PfSense/OpnSense and the different types of routers teklager offers.

I have a few questions to @teklager

1. I have a 1000/250 internet connection and want to use VPN, to reach those speeds it seems like i need to get the TLsense i5 right?
2. I also saw that you have a "new" product, TlSense j3p4 (celeron) what performance can
be expected from that hardware?

If i'm new to both OpnSense and PfSense what would you recommend I go for?

Cheers

Gå till inlägget

Hi!

Vilfo seems like nice hardware! I've been looking at it for a while, but in the end, decided not to re-sell it because the software is not fully open source. My concern with closed-source OS is that it will stop being updated with security patches, and will make hardware obsolete.

Now, to your questions:
1. That's correct. You will need a CPU with good single-core performance to reach high OpenVPN throughput because OpenVPN is single-threaded. TLSense i5 will give you about 600-800Mbit/s.
2. I have not tested it myself yet, but I've heard from one customer that he reached about 180Mbit/s on OpenVPN on this hardware. This is lower than I expected, so I'll need to test it myself (hope to do this within the next week).

If you are completely new to OPNSense/pfSense then I recommend pfSense because it has more documentation and tutorials online.

Let me know if you have any other questions.

Best,
Pawel

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk

@Smack Jack: It looks like Mullvad published a short tutorial on how to set up OpenWRT with WireGuard https://mullvad.net/en/guides/running-wireguard-router/

I think APU2 with a new BIOS version can do a little more than 600Mbit/s with WireGuard. The new BIOS enabled CPU boost to 1.4Ghz (from 1.0Ghz). I haven't tested this myself yet, so take this with a grain of salt

Citera
Gå till inlägget
Wireguard i custom router
Av teklager
Permalänk
Skrivet av improwise:

OpenWRT iom att det är det enda OS som har stöd för WireGuard (iaf senast jag kollade). @TekLager finns här som användare också, dock lite si och så med svenskan

Gå till inlägget

@Smack Jack My Swedish is still far from great, so I'll answer in English. Hope that's OK!

OpenWRT works well with WireGuard as @improwise says. I believe OPNSense added WireGuard support in the latest "Development" version. I know it's there, but I haven't tested how well it works.

On APU2 you will get about 600Mbit+ on Wireguard (only about 140 Mbit/s on OpenVPN )
On TLSense routers you will get full Gigabit on WireGuard (and about 600-900Mbit/s on OpenVPN).

Let me know if you have any more questions!

Citera
Gå till inlägget
VPN för höga hastigheter (1 Gbit)
Av teklager
Permalänk

@improwise: which cipher are you using?

OpenVPN with AES-256-GCM should give you about 700Mbit/s on the hardware you have. Of course, Wireguard will be much faster.

GCM is more performant and more secure than CBC, so if you are using CBC, consider switching

Citera
Gå till inlägget
pfsense router med AES-NI, vart köpa i Sverige?
Av teklager
Permalänk
Skrivet av monoleg:

@teklager är aktiva på forumet också ifall du har några frågor.

Gå till inlägget

Thanks for pinging me!

I'm happy to answer any questions about this hardware - hope it won't get me banned Rules on this forum are rather strict "no marketing of any kind".

Router linked by @Nima2001 has Intel J1900 CPU, without AES-NI. It won't be supported by pfSense 2.5 (which will be released soon). So if you are planning on using pfSense, I don't recommend it.

@stefaneriksson123 I need to do new VPN test to verify the OpenVPN speed. Recent BIOS update enabled CPU-boost to 1.4Ghz on APU, which should significantly improve VPN performance. There' s more information about it in our "Knowledge Base"

Citera
Gå till inlägget
TekLager.se
Av teklager
Permalänk

For those who are running APU routers with pfSense, we have some good news
New BIOS with some configuration changes, allow pfSense to route at 1Gbit on all APU routers. Read this article for details:
https://teklager.se/en/knowledge-base/apu2-1-gigabit-throughp...

@Undie: Price increase was rather small, but the reason is that manufacturer increased prices of parts, and PostNord increased prices for shipping.

Citera
Gå till inlägget
Ny router utan wifi eller pfSense + köpråd
Av teklager
Permalänk
Skrivet av monoleg:

Saxat från hemsidan:
All our routers allow installation of any operating system, including pfSense®, OPNSense, OpenWRT, Sophos and others.
Hardware assembly and basic OS installation is always free of charge.

https://teklager.se/en/products/routers/

Har lager i Stockholm, och har varit aktiva här på SC

Gå till inlägget

Thanks for linking to us!
I'll be here if anyone has any questions about these routers.

Citera
Gå till inlägget
HELT plötsligt sämre WIFI?
Av teklager
Permalänk

@swenorth1: it's possible that your neighbor just purchased a new router and is using exactly the same channel as you are, so you are getting interference. Try installing "WiFi analyzer" on your phone to see which WiFi channels are congested and which are open. Once you know it, you can reconfigure your router.

It's also possible that your access point is dying... but that's probably less likely.

Citera
Gå till inlägget
1 2 3 4 5
Senaste nyheterna
Hårdvara
Mjukvara
Övrigt
Nytt i forumet
Datorkomponenter
System
Ljud, bild och kommunikation
Spel och mjukvara