3 ms·

Is there by any chance a speed comparison against IPSec (IKEv2) i.e. strongSwan with AES-NI? I haven’t used OpenVPN in many years, so such a comparison would b

Is there by any chance a speed comparison against IPSec (IKEv2) i.e. strongSwan with AES-NI? I haven’t used OpenVPN in many years, so such a comparison would be much more interesting.

chrisper 9y ago
From experience I can tell you that IPSec is much faster than OpenVPN. I have no issues getting Gbit over IPSec (Strongswan), but with OpenVPN I always maxed out around ~400Mbit. EDIT: Looks like I misunderstood your comment and it seems like you want a comparison to Wireguard... oops
- hultner 9y ago
  Yeah that’s my experience as well. That’s why I wanted a comparison. My router at home easily handles gigabit over IPSec even though the CPU is at least 8 years old.
nopcode 9y ago
It's extremely fast, the benchmarks I've seen show that it's even faster than the IPSec config you describe.
- jsjohnst 9y ago
  > the benchmarks I've seen I think GP was asking for links to that, able to share?
  - ludde 9y ago
    There are some benchmarks here https://www.wireguard.com/performance/ https://www.wireguard.com/performance/
aaronmdjones 9y ago
Preliminary benchmarks are available on the website. https://www.wireguard.com/performance/ https://www.wireguard.com/performance/ EDIT: Note these are obviously for the reference implementation, not TunSafe.
- hultner 9y ago
  Interesting, haven’t run IPSec under Linux, is this expected performance? Seems rather low compared to what I’ve experienced under FreeBSD. An i7 Ivy Bride & Broadwell and should be aleast comparable to my almost decade old Nehalem-EP Xeon, shouldn’t it?
  - aaronmdjones 9y ago
    Well, there are a few mitigating factors. First, these are the mobile variants of the CPUs, which are usually slower than their desktop counterparts out of the box, and clock lower more often due to thermal management kicking in a lot, too. Secondly, a gigabit network card was used, which sets a low ceiling for the benchmark. Thirdly, these were results averaged over 30 minutes (which again may cause heat issues in some laptops), not burst performance; I doubt OpenVPN would even register on a graph of burst performance of, say, 3 seconds. Lastly, from what I hear, the Linux IPsec stack is a lot more complicated than is typical. Granted, they're all complicated, but still ...

Is there by any chance a speed comparison against IPSec (IKEv2) i.e. strongSwan with AES-NI? I haven’t used OpenVPN in many years, so such a comparison would be much more interesting.

chrisper 9y ago

From experience I can tell you that IPSec is much faster than OpenVPN. I have no issues getting Gbit over IPSec (Strongswan), but with OpenVPN I always maxed out around ~400Mbit. EDIT: Looks like I misunderstood your comment and it seems like you want a comparison to Wireguard... oops

hultner 9y ago
Yeah that’s my experience as well. That’s why I wanted a comparison. My router at home easily handles gigabit over IPSec even though the CPU is at least 8 years old.

nopcode 9y ago

It's extremely fast, the benchmarks I've seen show that it's even faster than the IPSec config you describe.

jsjohnst 9y ago
> the benchmarks I've seen I think GP was asking for links to that, able to share?
- ludde 9y ago
  There are some benchmarks here https://www.wireguard.com/performance/ https://www.wireguard.com/performance/

aaronmdjones 9y ago

Preliminary benchmarks are available on the website. https://www.wireguard.com/performance/ https://www.wireguard.com/performance/ EDIT: Note these are obviously for the reference implementation, not TunSafe.

hultner 9y ago
Interesting, haven’t run IPSec under Linux, is this expected performance? Seems rather low compared to what I’ve experienced under FreeBSD. An i7 Ivy Bride & Broadwell and should be aleast comparable to my almost decade old Nehalem-EP Xeon, shouldn’t it?
- aaronmdjones 9y ago
  Well, there are a few mitigating factors. First, these are the mobile variants of the CPUs, which are usually slower than their desktop counterparts out of the box, and clock lower more often due to thermal management kicking in a lot, too. Secondly, a gigabit network card was used, which sets a low ceiling for the benchmark. Thirdly, these were results averaged over 30 minutes (which again may cause heat issues in some laptops), not burst performance; I doubt OpenVPN would even register on a graph of burst performance of, say, 3 seconds. Lastly, from what I hear, the Linux IPsec stack is a lot more complicated than is typical. Granted, they're all complicated, but still ...