Wintun performance results

Wintun performance results

[Lev Stipakov]

[-- Attachment #1.1: Type: text/plain, Size: 1626 bytes --]

Hi guys,

I made openvpn3 (required changes will be incorporated into main branch at
some point) work with wintun and did performance testing in AWS.

Client:    c5.xlarge, Windows Server 2016, patched openvpn3 test client and
OpenVPN Connect 2.7.1.103 (uses tap-windows6, based on openvpn3).

Server:  c5.xlarge, Ubuntu 18.04, openvpn 2.4.4

Client and server instances are in the same VPC and placement group.

iPerf3 running on server:

> iperf3 -s -B 0.0.0.0 -V

iPerf3 running on client:

> iperf3 -c 10.8.0.1 -V (server VPN address)
> iperf3 -c 10.0.0.18 -V (server VPC address)

Results:

- no vpn

[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec  8.67 GBytes  7.45 Gbits/sec                  sender
[  4]   0.00-10.00  sec  8.67 GBytes  7.45
Gbits/sec                  receiver
CPU Utilization: local/sender 61.4% (5.6%u/55.8%s), remote/receiver 33.9%
(1.7%u/32.2%s)

- tap-windows6

[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   404 MBytes   339 Mbits/sec                  sender
[  4]   0.00-10.00  sec   404 MBytes   339
Mbits/sec                  receiver
CPU Utilization: local/sender 4.6% (0.3%u/4.3%s), remote/receiver 21.4%
(2.2%u/19.2%s)

- wintun

[ ID] Interval           Transfer     Bandwidth
[  4]   0.00-10.00  sec   536 MBytes   449 Mbits/sec                  sender
[  4]   0.00-10.00  sec   536 MBytes   449
Mbits/sec                  receiver
CPU Utilization: local/sender 2.9% (0.1%u/2.8%s), remote/receiver 10.1%
(0.7%u/9.3%s)

As you see, wintun performs 30% better comparison to tap-windows6 and
incurs significantly less CPU usage.

-- 
-Lev

[-- Attachment #1.2: Type: text/html, Size: 2487 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Илья Шипицин]

[-- Attachment #1.1: Type: text/plain, Size: 2207 bytes --]

it will most probably get lost in mailing list.
can we add it to https://openvpn.net website ? something like "performance
testing" with full configs provided ?

ср, 15 мая 2019 г. в 18:49, Lev Stipakov <lstipakov@gmail.com>:

> Hi guys,
>
> I made openvpn3 (required changes will be incorporated into main branch at
> some point) work with wintun and did performance testing in AWS.
>
> Client:    c5.xlarge, Windows Server 2016, patched openvpn3 test client
> and OpenVPN Connect 2.7.1.103 (uses tap-windows6, based on openvpn3).
>
> Server:  c5.xlarge, Ubuntu 18.04, openvpn 2.4.4
>
> Client and server instances are in the same VPC and placement group.
>
> iPerf3 running on server:
>
> > iperf3 -s -B 0.0.0.0 -V
>
> iPerf3 running on client:
>
> > iperf3 -c 10.8.0.1 -V (server VPN address)
> > iperf3 -c 10.0.0.18 -V (server VPC address)
>
> Results:
>
> - no vpn
>
> [ ID] Interval           Transfer     Bandwidth
> [  4]   0.00-10.00  sec  8.67 GBytes  7.45
> Gbits/sec                  sender
> [  4]   0.00-10.00  sec  8.67 GBytes  7.45
> Gbits/sec                  receiver
> CPU Utilization: local/sender 61.4% (5.6%u/55.8%s), remote/receiver 33.9%
> (1.7%u/32.2%s)
>
> - tap-windows6
>
> [ ID] Interval           Transfer     Bandwidth
> [  4]   0.00-10.00  sec   404 MBytes   339
> Mbits/sec                  sender
> [  4]   0.00-10.00  sec   404 MBytes   339
> Mbits/sec                  receiver
> CPU Utilization: local/sender 4.6% (0.3%u/4.3%s), remote/receiver 21.4%
> (2.2%u/19.2%s)
>
> - wintun
>
> [ ID] Interval           Transfer     Bandwidth
> [  4]   0.00-10.00  sec   536 MBytes   449
> Mbits/sec                  sender
> [  4]   0.00-10.00  sec   536 MBytes   449
> Mbits/sec                  receiver
> CPU Utilization: local/sender 2.9% (0.1%u/2.8%s), remote/receiver 10.1%
> (0.7%u/9.3%s)
>
> As you see, wintun performs 30% better comparison to tap-windows6 and
> incurs significantly less CPU usage.
>
> --
> -Lev
> _______________________________________________
> Openvpn-devel mailing list
> Openvpn-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/openvpn-devel
>

[-- Attachment #1.2: Type: text/html, Size: 3433 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Lev Stipakov]

[-- Attachment #1.1: Type: text/plain, Size: 367 bytes --]

I think so, but before we need to incorporate wintun support into
openvpn2/3 masters.

ke 15. toukok. 2019 klo 17.49 Илья Шипицин (chipitsine@gmail.com) kirjoitti:

> it will most probably get lost in mailing list.
> can we add it to https://openvpn.net website ? something like
> "performance testing" with full configs provided ?
>

-- 
-Lev

[-- Attachment #1.2: Type: text/html, Size: 806 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[David Sommerseth]

[-- Attachment #1.1.1: Type: text/plain, Size: 2771 bytes --]

On 15/05/2019 16:49, Илья Шипицин wrote:
> it will most probably get lost in mailing list.
> can we add it to https://openvpn.net website ? something like "performance
> testing" with full configs provided ?

Good idea, but maybe not the official corp web pages just yet.  But we should
definitely have some wiki pages under https://community.openvpn.net/ related
to how to prepare a good setup for performance testing.


-- 
kind regards,

David Sommerseth
OpenVPN Inc


> ср, 15 мая 2019 г. в 18:49, Lev Stipakov <lstipakov@gmail.com
> <mailto:lstipakov@gmail.com>>:
> 
>     Hi guys,
> 
>     I made openvpn3 (required changes will be incorporated into main branch at
>     some point) work with wintun and did performance testing in AWS.
> 
>     Client:    c5.xlarge, Windows Server 2016, patched openvpn3 test client
>     and OpenVPN Connect 2.7.1.103 (uses tap-windows6, based on openvpn3).
> 
>     Server:  c5.xlarge, Ubuntu 18.04, openvpn 2.4.4
> 
>     Client and server instances are in the same VPC and placement group.
> 
>     iPerf3 running on server:
> 
>     > iperf3 -s -B 0.0.0.0 -V
> 
>     iPerf3 running on client:
> 
>     > iperf3 -c 10.8.0.1 -V (server VPN address)
>     > iperf3 -c 10.0.0.18 -V (server VPC address)  
> 
>     Results:
> 
>     - no vpn
> 
>     [ ID] Interval           Transfer     Bandwidth
>     [  4]   0.00-10.00  sec  8.67 GBytes  7.45 Gbits/sec                  sender
>     [  4]   0.00-10.00  sec  8.67 GBytes  7.45 Gbits/sec                  receiver
>     CPU Utilization: local/sender 61.4% (5.6%u/55.8%s), remote/receiver 33.9%
>     (1.7%u/32.2%s)
> 
>     - tap-windows6
> 
>     [ ID] Interval           Transfer     Bandwidth
>     [  4]   0.00-10.00  sec   404 MBytes   339 Mbits/sec                  sender
>     [  4]   0.00-10.00  sec   404 MBytes   339 Mbits/sec                  receiver
>     CPU Utilization: local/sender 4.6% (0.3%u/4.3%s), remote/receiver 21.4%
>     (2.2%u/19.2%s)
> 
>     - wintun
> 
>     [ ID] Interval           Transfer     Bandwidth
>     [  4]   0.00-10.00  sec   536 MBytes   449 Mbits/sec                  sender
>     [  4]   0.00-10.00  sec   536 MBytes   449 Mbits/sec                  receiver
>     CPU Utilization: local/sender 2.9% (0.1%u/2.8%s), remote/receiver 10.1%
>     (0.7%u/9.3%s)
> 
>     As you see, wintun performs 30% better comparison to tap-windows6 and
>     incurs significantly less CPU usage.
> 
>     -- 
>     -Lev


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Jan Just Keijser]

Hi David, *

On 15/05/19 19:32, David Sommerseth wrote:
> On 15/05/2019 16:49, Илья Шипицин wrote:
>> it will most probably get lost in mailing list.
>> can we add it to https://openvpn.net website ? something like "performance
>> testing" with full configs provided ?
> Good idea, but maybe not the official corp web pages just yet.  But we should
> definitely have some wiki pages under https://community.openvpn.net/ related
> to how to prepare a good setup for performance testing.
>
>
a community wiki page on how to prepar a good setup for performance 
testing sounds like a good plan.
However, if I am not mistaken the version of OpenVPN used in the test 
was a *Windows* build of OpenVPN3 with a wintun patch included. That is 
not open source, is it?  I'd *not* be in favour of writing community 
wiki pages on the non-open source version of OpenVPN.

JM2CW,

JJK

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Lev Stipakov]

[-- Attachment #1.1: Type: text/plain, Size: 466 bytes --]

Hi,

However, if I am not mistaken the version of OpenVPN used in the test
> was a *Windows* build of OpenVPN3 with a wintun patch included.


Correct.


> That is not open source, is it?  I'd *not* be in favour of writing
> community
> wiki pages on the non-open source version of OpenVPN.
>

That's an open source openvpn3 test client, which is part of library
(openvpn/test/ovpncli/cli.cpp).

We'll incorporate required changes into master branch soon.

-- 
-Lev

[-- Attachment #1.2: Type: text/html, Size: 992 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Lev Stipakov]

[-- Attachment #1.1: Type: text/plain, Size: 1606 bytes --]

Hi,

While wintun support is not yet added to openvpn3 master, I think it would
be beneficial to share my own branch.

https://github.com/lstipakov/openvpn3/tree/feature/wintun-wip#building-the-openvpn-3-client-on-windows


See instructions in README on how to build openvpn3 library and test client
on Windows.

Note that only "topology subnet" is supported (see
https://community.openvpn.net/openvpn/wiki/Topology#Topologysubnet).

I have included test client and wintun driver binaries if someone would
like to try it out (Tested on Windows 10 and Windows Server 2016):

1. Since wintun driver is not signed, you need to enable loading of test
signed code. For that, run

> bcdedit /set testsigning

in admin command prompt and restart Windows.

2. Download and unzip wintun driver
https://github.com/lstipakov/openvpn3/blob/feature/wintun-wip/wintun.7z

3. Open Device Manager (Control Panel\System and Security\System\Device
Manager).
Right click on tree root, select "Add legacy hardware" -> "Next" -> "..
hardware that I manually select from a list" ->
"Next" -> "Show all devices" -> "Have Disk..." -> Locate wintun.inf
unpacked at step 2 -> select "Wintun Userspace Tunnel" ->
"Next" -> "Install this software anyway" (since driver is not signed).

4. Make sure you see "Wintun Userspace Tunnel" under Device Manager ->
Network adapters.

5. Download cli_wintun.exe from
https://github.com/lstipakov/openvpn3/blob/feature/wintun-wip/cli_wintun.exe

6. Open command prompt as an administrator and run:

> C:\Users\Administrator\Downloads>cli_wintun.exe <your_vpn_profile.ovpn>

7. Enjoy!

-- 
-Lev

[-- Attachment #1.2: Type: text/html, Size: 2757 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Lev Stipakov]

[-- Attachment #1.1: Type: text/plain, Size: 423 bytes --]

Hi,

Here you can get the latest binary of openvpn3 test Windows client with
both wintun and tap-windows6 support.

https://ci.appveyor.com/project/openvpn/openvpn3/build/artifacts

To use it with wintun, open admin command prompt and run:

> cli.exe -w profile.ovpn

To use tap-windows6, just omit "-w" switch.

Please note that this is a development tool first of all, not a client to
be consumed by most of users.

-Lev

[-- Attachment #1.2: Type: text/html, Size: 734 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [Openvpn-devel] Wintun performance results

[Lev Stipakov]

[-- Attachment #1.1: Type: text/plain, Size: 996 bytes --]

Hi,

I got some new Wintun (I used version 0.2) performance stats I would like
to share. I have tested openvpn2 and openvpn3 (both with openssl) on the
client against openvpn2 and proprietary openvpn3 server (which is openvpn3
with kernel acceleration). Cipher AES-256-GCM.

Server - proprietary openvpn3
----------------------------------------------------

ovpn3 wintun   1.90 Gbit/s
ovpn3 tap6       890 Mbit/s

ovpn2 wintun    870 Mbit/s
ovpn2 tap6       440 Mbit/s


Server - open source openvpn2
----------------------------------------------------

ovpn3 wintun    670 Mbit/s
ovpn3 tap6       580 Mbit/s

ovpn2 wintun    610 Mbit/s
ovpn2 tap6        450 Mbit/s


As you see, in every case Wintun overperforms tap-windows6 and approaches
mind boggling 2 Gbit/s.

My openvpn2 wintun patch could be found here
https://github.com/lstipakov/openvpn/tree/feature/wintun, and openvpn3 -
https://github.com/lstipakov/openvpn3/tree/fix/wintun-fixes

Jason / Simon - great work on Wintun!

-- 
-Lev

[-- Attachment #1.2: Type: text/html, Size: 1530 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Wintun performance results

[Jason A. Donenfeld]

Nice results! Sounds like Wintun has accomplished one of its goals then.

You mentioned on IRC that you need for the Wintun socket to be
openable by Administrator, not just SYSTEM. Here's some code you can
use to make that possible, without needing to modify the Wintun
source:

https://xn--4db.cc/rDtNikTB/c
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard