Linus prefers IPSec over OpenVPN for networking reasons.
Linus prefers IPSec over OpenVPN for networking reasons.
Hey everyone, I saw Linus mention IPSec during the unboxing at 24:55. That sparked my curiosity about using OpenVPN instead.
I concur, OpenVPN offers greater simplicity, easier administration (especially with an access server web interface), and it's open source.
Why not use IPsec? Many devices support hardware acceleration, making it a well-defined method for point-to-point links. OpenVPN performance relies heavily on software optimization, while enterprise tools like ASA offer robust IPsec capabilities with broader adoption. Directly implementing IPsec on network appliances often provides better efficiency than routing through a hypervisor for all site-to-site needs. The best choice depends on your specific setup.
IPsec might offer lower security because it isn't an open standard, raising worries about potential backdoors from the NSA. It also tends to be less efficient on devices without hardware acceleration, since it adds another layer on top of L2TP instead of using a single protocol like OpenVPN. OpenVPN's simplicity becomes easier on CPUs that support AES acceleration, which is expected to be required for the upcoming pfSense version.
I realize my earlier assessment was off; OpenVPN can be quite demanding on the CPU even with AES-NI support. I noticed my i5-3470T reaches 35% CPU usage at 64Mbit, though the frequency fluctuates, making it hard to predict full performance. Turning on maximum power no longer displays the clock speed on the display, so I’m uncertain if it’s functioning properly. The load appears consistent, which is unexpected given how fast AES-NI should be. In any case, Gigabit Ethernet still seems far beyond its capabilities.
I understand, when I download files I only reach about 30MB/s with gigabit connections. In PFSSL with top running, OpenVPN uses around 23-24% CPU. I have an i7 4790K that would work fine if I upgraded the power supply, but I’m considering a more powerful one just in case.