Ovpn hardware acceleration

RouterOS General
1

Is there a more up-to-date documentation about which router supports hardware acceleration? I would appreciate
information about ovpn (and other vpn), not just ipsec.

I was looking at https://help.mikrotik.com/docs/display/ROS/IPsec#IPsec-Hardwareacceleration

I tested a hAp ax2 (ARM64 IPQ-6010 cpu) and a Chateau LTE6 (ARM IPQ-6019 cpu) with ros 7.15.3, encryption aes256-cbc, configured vpn connection between these two routers.

IPSEC was hardware accelerated but in case of ovpn only the Chateau LTE6 used hardware acceleration. I would like some more accurate information before I decide which router to use instead of the 20+ RB951 model routers.

Anyway, I tested copying a a larger file through the vpn, from one windows machine to another and I was surprised by the results:

  • fully hw-encrypted ipsec produced 20 megabyte/sec copy speed, hAp ax2 cpu load 16%, Chateau LTE6 cpu load 38%
  • ovpn with only Chateau LTE6 using hw encrytpion produced 9 megabyte/sec, hAp ax2 cpu load 21% Chateau LTE6 cpu load 40%

That’s right, the hw encrypted side had much higher cpu load - no idea why, and cpu load did not depend on hardware encryption.
ovpn.png
ipsec.png

2

Consider moving to Wireguard.
Purely CPU (= no HW offload) and yet WAY faster then all the rest (sometimes even faster then HW offloaded ipsec on same HW)

3

Yes, wireguard seems a good alternative. I tried, the copy speed was about 13 megabyte/sec. Indeed much faster than openvpn without hw. encryption, and in my case that would be enough.