Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




793 posts

Ultimate Geek


# 259951 1-Nov-2019 17:20
Send private message quote this post

I'm experimenting with a L2TP VPN to an Edgerouter Lite - have setup as per Ubiquiti's instructions here. 

 

Router is on 2Degrees Gigabit Fibre and a speedtest onsite yields around 870/480 which is great. 

 

Have made sure hardware offloading is enabled for IPSEC and gre, but only getting max throughput from a Windows client of around 45mbps (when copying a large file), and this is maxing out the CPU on the Edgerouter so I'm thinking  the traffic is not actually being offloaded. 

 

Has anyone else setup something similar and can comment on the throughput you were able to achieve?

 

Any comments or thoughts appreciated. I'm not expecting miracles but was expecting a bit more than 45mbps. 

 


Edit - I should say I've had a reasonably good look through Ubiquiti's forums but it's a bit hard to sift through the thousands of posts about offloading being broken on the ER-X. 


Create new topic
4357 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  # 2347391 1-Nov-2019 20:12
Send private message quote this post

I thought that the Edgerouter didn't do hardware offloading of VPN traffic? But maybe that was only if using openvpn?

497 posts

Ultimate Geek


  # 2347435 2-Nov-2019 02:00
Send private message quote this post

rscole86: I thought that the Edgerouter didn't do hardware offloading of VPN traffic? But maybe that was only if using openvpn?

 

There are two different things involved here - offloading (where the hardware routes the packets without involving the CPU) and use of the encryption hardware.  They are two different bits of hardware.  An Edgerouter Lite can only do hardware encryption for a limited range of available encryptions.  It does do it for IPSEC, but not for OpenVPN.  For IPSEC, you need to enable it using a "set system offload ipsec" command.  You also need to ensure that hardware offloading of the routing is also happening, using the "set system offload ipv4" and "set system offload ipv6" commands.  The "show ubnt offload" command shows what is enabled.  Here is what I am get from that command:

 

IP offload module   : loaded
IPv4
  forwarding: enabled
  vlan      : enabled
  pppoe     : enabled
  gre       : disabled
  bonding   : disabled
IPv6
  forwarding: enabled
  vlan      : disabled
  pppoe     : enabled
  bonding   : disabled

 

IPSec offload module: loaded

 

Traffic Analysis    :
  export    : enabled
  dpi       : enabled
    version       : 1.480

 

The "bonding" options are new in the last firmware version or two, so I do not know anything about them.  For IPv6 offloading, "vlan" and "pppoe" are mutually exclusive, which is a pain if you want to use IPv6 VLANs and your ISP requires PPPoE.  For IPv4, you can and should have forwarding, vlan and pppoe offloading enabled at all times unless you are trying to debug traffic on your ERL by capturing the packets there with tcpdump, tshark or the like.  Without full offloading, the maximum throughput is pitiful, but the CPU can see all the packets and capture them for you.


 
 
 
 


820 posts

Ultimate Geek


  # 2347438 2-Nov-2019 06:26
Send private message quote this post

wratterus:

 

Has anyone else setup something similar and can comment on the throughput you were able to achieve?

 

Any comments or thoughts appreciated. I'm not expecting miracles but was expecting a bit more than 45mbps.

 

 

 

For the ER3 139-123 Mb/s for IPSEC, depending of en/decryption, load is just below 100%

 

For the ERX 254-199 Mb/s for IPSEC, depending of en/decryption, load is 40-60%

 

For the ER4 446Mb/s for IPSEC for en/decryption, load is about 50%





- ISP1: T-OneBox FTTH modem, 1/.5G, full DS, VLAN7, VoIP + ipTV streaming flat

 

- ISP2: 4G/LTE USB modem + TL-MR3020, 100/40M data plan (wireless fallback)

 

- NET: ZBOX nano router, 2 C2960X-48TS-L, 2 GWN7630, 1 GWN7610, 2 UPS

 

- SVR: E3C236 32G/20T, 2 H2 16G/500G, HC1 5T, N2 128G | HC2 14T, HC2 1T

 

- USR: DeskMini 310, NUC8i7HVK, Aspire E5, EliteBook 840, Galaxy Tab, 4K TV

 

- IoT: 3 public/1 private LoRaWAN gateways, various openHAB bindings (CCU3)

 

- 3D: Ender-3, Ender-3 Pro, Ultimaker 2E+, Ultimaker 3, Ultimaker S5, MP-CNC

 

- ipPBX: GRP2613, GO-Box 100, SPA112 (Fax and W-48, a 1948 Siemens phone)


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Netflix releases 21 Studio Ghibli works
Posted 22-Jan-2020 11:42


Vodafone integrates eSIM into device and wearable roadmap
Posted 17-Jan-2020 09:45


Do you need this camera app? Group investigates privacy implications
Posted 16-Jan-2020 03:30


JBL launches headphones range designed for gaming
Posted 13-Jan-2020 09:59


Withings introduces ScanWatch wearable combining ECG and sleep apnea detection
Posted 9-Jan-2020 18:34


NZ Police releases public app
Posted 8-Jan-2020 11:43


Suunto 7 combine sports and smart features on new smartwatch generation
Posted 7-Jan-2020 16:06


Intel brings innovation with technology spanning the cloud, network, edge and PC
Posted 7-Jan-2020 15:54


AMD announces high performance desktop and ultrathin laptop processors
Posted 7-Jan-2020 15:42


AMD unveils four new desktop and mobile GPUs including AMD Radeon RX 5600
Posted 7-Jan-2020 15:32


Consolidation in video streaming market with Spark selling Lightbox to Sky
Posted 19-Dec-2019 09:09


Intel introduces cryogenic control chip to enable quantum computers
Posted 10-Dec-2019 21:32


Vodafone 5G service live in four cities
Posted 10-Dec-2019 08:30


Samsung Galaxy Fold now available in New Zealand
Posted 6-Dec-2019 00:01


NZ company oDocs awarded US$ 100,000 Dubai World Expo grant
Posted 5-Dec-2019 16:00



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.