4 ms·

The Biggest problem I have found with VPN providers is bandwidth. I just installed DD-WRT on my router to use OpenVPN client on the router, the bandwidth speed

by 47 13y ago

The Biggest problem I have found with VPN providers is bandwidth. I just installed DD-WRT on my router to use OpenVPN client on the router, the bandwidth speed drops to a level that makes the setup totally useless. It might be because of consumer grade router[1] have low computing power, but the speed is so low that I highly doubt it. Yes I have tried multiple VPN providers. I have yet to find a VPN provider that can provide all of the following: - Guarantee Bandwidth - Take Privacy Seriously[2] - Support consumer grade router (with DD-WRT or alternative) - Do not cost more than my actual internet connection [1] ASUS RT-N16 [2] http://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition-130302/ http://torrentfreak.com/vpn-services-that-take-your-anonymit...

rdl 13y ago
What kind of performance are you looking for, and what traffic mix? Testing various consumer routers with VPN for performance is on my todo list. I know the WRT54GL is probably fairly antiquated at this point, but I have some newer DD-WRT supported routers like the WNDR3700 to try.
- 47 13y ago
  I am talking about normal every day usage Browsing, Youtube, Netflix, etc from multiple devices at home. Maybe it is hardware as mention in other replies. I haven't done testing with different hardware.
bifrost 13y ago
> I just installed DD-WRT on my router to use OpenVPN client on the router, the bandwidth speed drops to a level that makes the setup totally useless. A fair amount of that has to do with how little CPU is available on your router device, I suspect no manufacturer will support a device that can do a lot of crypto and still be in the consumer price range. That said, I could ship you a device right now that'll do 100Mbps of encrypted traffic all day long, but it doesn't have wifi and its about $500...
- rdl 13y ago
  For "roll your own" with an embedded device, the Marvell Kirkwood is probably the best since it has AES acceleration in hardware. One of the Sheevaplugs has this. It's not really well supported in Linux yet. It ends up being about as fast as an Atom.
  - Wicher 13y ago
    The Kirkwood AES accelerator (mv_cesa) is not exposed to userspace in Linux. It won't accelerate your SSL. You can use it to accelerate dm-crypt, though. I owned a Sheevaplug and own a Dreamplug. They're not nearly as fast as even a 2009 Atom... But power-efficient, yes.
    - rdl 13y ago
      Is that just a driver limitation, or is there a problem with the hardware so the driver is written that way? It also doesn't do DMA, so I've heard bad things about performance with it for small packets.
      - Wicher 13y ago
        If I remember correctly it's a driver limitation, and theoretically it could be modified so it would do what you want, but consider the amount of userspace/kernelspace crossings to be made just to send some ciphertext over the network to some other party. I imagine something like this would take place: SSL does not happen in the kernel. So you need to send a payload to the kernel to encrypt, you get back the ciphertext, wrap it in your packet (add some headers) and then push this data once more to the kernel, which sends it out over the network for you. Receiving ciphertext would go along similar lines. That's probably not very efficient. Contrast this with full disk encryption using dm_crypt (linux). No shuffling back and forth of data. Userspace only really needs to handle the plaintext (and not even directly, but through the FS layer, which is also in the kernel). So maybe it may just not be worthwile to expose the interface to userspace on reasonably powerful platforms? Anything above a tiny MIPS or old 486? The VIA padlock crypto accelerator is (or was at some point) exposed to userspace and OpenSSL could take advantage of it. I wonder how much of a performance increase that yielded, considering the issue I noted above. Also, hardware accelerators typically only support a couple of modes and key sizes. That's fine for full disk encryption, but in a networked world you need more flexibility.
Spittie 13y ago
I'm sure there are many legit VPN provider out of there, which really care about the user and provide some hardware/bandwidth, but most are oversold services (barely scam) with very high price for what they offer. I think the solution is a self-made VPN out of a VPS. VPS nowadays are really cheap, and you can get awesome deals with some very serious providers. Also, you can easily get one outside the USA, for (in my opinion at least) increased security. For anyone interessed, https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install makes installing OpenVPN a breeze. For VPS deals, http://www.lowendbox.com/ http://www.lowendbox.com/ and http://vpsboard.com/ http://vpsboard.com/.
- icelancer 13y ago
  Absolutely agree. For those who have trouble setting up OpenVPN (it's a pain in the ass) and want a simple solution, sshuttle works really, really well: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
- 47 13y ago
  Running your own VPN server means no privacy, as you are only user of the system and all the traffic going in/out of the server is attributed to you. What VPN providers claims is that they do not store logs/ip addresses and they have no way of knowing what traffic comes from client.
buro9 13y ago
Did you try IVPN? http://www.ivpn.net/ http://www.ivpn.net/ I've just purchased an Asus RT-N66U to run an OpenVPN client so that I can encrypt the traffic from all computers, and as I don't do file-sharing I've focused on choosing a provider obsessed by privacy rather than piracy. IVPN looks like it, but I haven't yet tried it so don't yet know how it will perform.
a3n 13y ago
Has anyone set up a Raspberry Pi as a router?
- bifrost 13y ago
  Been there, low performance :(
thaumaturgy 13y ago
You might look at https://torrentfreak.com/which-vpn-providers-really-take-anonymity-seriously-111007/ https://torrentfreak.com/which-vpn-providers-really-take-ano... I've been using one of these, bought with Bitcoin, via Coinbase, set up with a Hushmail account, for a while now. It works great. Bandwidth is diminished somewhat, but not enough to be a problem for normal browsing or other totally legal activities. edit: I'm tired, just noticed you linked to essentially the same TF article I did. Anyway, the service I've been using works with Tomato and DD-WRT (on some routers), is affordable, and is on of the recommended services for taking privacy seriously. They don't guarantee bandwidth, but in practice, there hasn't been a problem so far.

by 47 13y ago

rdl 13y ago

What kind of performance are you looking for, and what traffic mix? Testing various consumer routers with VPN for performance is on my todo list. I know the WRT54GL is probably fairly antiquated at this point, but I have some newer DD-WRT supported routers like the WNDR3700 to try.

47 13y ago
I am talking about normal every day usage Browsing, Youtube, Netflix, etc from multiple devices at home. Maybe it is hardware as mention in other replies. I haven't done testing with different hardware.

bifrost 13y ago

> I just installed DD-WRT on my router to use OpenVPN client on the router, the bandwidth speed drops to a level that makes the setup totally useless. A fair amount of that has to do with how little CPU is available on your router device, I suspect no manufacturer will support a device that can do a lot of crypto and still be in the consumer price range. That said, I could ship you a device right now that'll do 100Mbps of encrypted traffic all day long, but it doesn't have wifi and its about $500...

rdl 13y ago
For "roll your own" with an embedded device, the Marvell Kirkwood is probably the best since it has AES acceleration in hardware. One of the Sheevaplugs has this. It's not really well supported in Linux yet. It ends up being about as fast as an Atom.
- Wicher 13y ago
  The Kirkwood AES accelerator (mv_cesa) is not exposed to userspace in Linux. It won't accelerate your SSL. You can use it to accelerate dm-crypt, though. I owned a Sheevaplug and own a Dreamplug. They're not nearly as fast as even a 2009 Atom... But power-efficient, yes.
  - rdl 13y ago
    Is that just a driver limitation, or is there a problem with the hardware so the driver is written that way? It also doesn't do DMA, so I've heard bad things about performance with it for small packets.
    - Wicher 13y ago
      If I remember correctly it's a driver limitation, and theoretically it could be modified so it would do what you want, but consider the amount of userspace/kernelspace crossings to be made just to send some ciphertext over the network to some other party. I imagine something like this would take place: SSL does not happen in the kernel. So you need to send a payload to the kernel to encrypt, you get back the ciphertext, wrap it in your packet (add some headers) and then push this data once more to the kernel, which sends it out over the network for you. Receiving ciphertext would go along similar lines. That's probably not very efficient. Contrast this with full disk encryption using dm_crypt (linux). No shuffling back and forth of data. Userspace only really needs to handle the plaintext (and not even directly, but through the FS layer, which is also in the kernel). So maybe it may just not be worthwile to expose the interface to userspace on reasonably powerful platforms? Anything above a tiny MIPS or old 486? The VIA padlock crypto accelerator is (or was at some point) exposed to userspace and OpenSSL could take advantage of it. I wonder how much of a performance increase that yielded, considering the issue I noted above. Also, hardware accelerators typically only support a couple of modes and key sizes. That's fine for full disk encryption, but in a networked world you need more flexibility.

Spittie 13y ago

I'm sure there are many legit VPN provider out of there, which really care about the user and provide some hardware/bandwidth, but most are oversold services (barely scam) with very high price for what they offer. I think the solution is a self-made VPN out of a VPS. VPS nowadays are really cheap, and you can get awesome deals with some very serious providers. Also, you can easily get one outside the USA, for (in my opinion at least) increased security. For anyone interessed, https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install makes installing OpenVPN a breeze. For VPS deals, http://www.lowendbox.com/ http://www.lowendbox.com/ and http://vpsboard.com/ http://vpsboard.com/.

icelancer 13y ago
Absolutely agree. For those who have trouble setting up OpenVPN (it's a pain in the ass) and want a simple solution, sshuttle works really, really well: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
47 13y ago
Running your own VPN server means no privacy, as you are only user of the system and all the traffic going in/out of the server is attributed to you. What VPN providers claims is that they do not store logs/ip addresses and they have no way of knowing what traffic comes from client.

buro9 13y ago

Did you try IVPN? http://www.ivpn.net/ http://www.ivpn.net/ I've just purchased an Asus RT-N66U to run an OpenVPN client so that I can encrypt the traffic from all computers, and as I don't do file-sharing I've focused on choosing a provider obsessed by privacy rather than piracy. IVPN looks like it, but I haven't yet tried it so don't yet know how it will perform.

a3n 13y ago

Has anyone set up a Raspberry Pi as a router?

bifrost 13y ago
Been there, low performance :(

thaumaturgy 13y ago

You might look at https://torrentfreak.com/which-vpn-providers-really-take-anonymity-seriously-111007/ https://torrentfreak.com/which-vpn-providers-really-take-ano... I've been using one of these, bought with Bitcoin, via Coinbase, set up with a Hushmail account, for a while now. It works great. Bandwidth is diminished somewhat, but not enough to be a problem for normal browsing or other totally legal activities. edit: I'm tired, just noticed you linked to essentially the same TF article I did. Anyway, the service I've been using works with Tomato and DD-WRT (on some routers), is affordable, and is on of the recommended services for taking privacy seriously. They don't guarantee bandwidth, but in practice, there hasn't been a problem so far.