v.7.1.1.1 Bandwith test of several tunnels

RouterOS RouterOS beta
1

I have performed some test using RouterOS v7.1.1, all the devices with Connection Tracking disabled. The topology is:

PC1 ↔ CCR1009 ↔ hAP AC3 ↔ hAP AC3 ↔ RB5009 ↔ PC2

Using iperf3, TCP one stream, performing 3 tests of 10 seconds and getting the average value. With pure routing, the bandwidth is 940 Mbps.

Then the tests have been performed with different tunnels between CCR1009 and RB5009.

The aim of this post is to discuss configuration changes that maybe can help to improve this results. I’m sure that encrypted tunnels can perform better.

IPSec tunnel:   222 Mbps    Simple config of peers, identified by PSK. Default config for phase 1 and 2
Wireguard:      232 Mbps
VXLAN:          350 Mbps
EoIP:           913 Mbps
EoIP-IPSec:     270 Mbps    Using PSK of EOIP interface
IPIP:           927 Mbps
IPIP-IPSec:     261 Mbps    Using PSK of IPIP interface
GRE:            925 Mbps
GRE-IPSec:      300 Mbps    Using PSK of GRE interface


  Mbps
 1000 -
      -  -940-                                   -913-                -927-                     -925-
      -
      -
      -
  500 -
      -
      -                                 -350-             -270-                   -261-                  -300-
      -            -222-      -232-
      -
      +-----------------------------------------------------------------------------------------------------------
        Routing    IPSec    Wireguard   VXLAN    EoIp  EoIP+IPSec      IPIP     IPIP+IPSec       GRE    GRE+IPSec
2

I would expect better performance on wireguard and IPsec…
Test results on both 4011 and 1009, https://mikrotik.com/product/CCR1009-7G-1C-1Splus#fndtn-testresults, https://mikrotik.com/product/rb4011igs_rm#fndtn-testresults , as far as IPsec is concerned, is about 500 Mbps for both, for 512 bytes of packet…

3

Yes, but published data is in both directions (so 1Gbps link would be 2Gbps bandwidth) And my results are only in one direction. I also was expecting better results ‘out-of-the-box’, but looks like some tuning is needed.

4

Could you try it with -P 4?

-P, --parallel n The number of simultaneous connections to make to the server. Default is 1.

It may interesting if reverse id different. You can then test with two client at the same time:

-R, --reverse Run in reverse mode (server sends, client receives).

One client sending, and one receiving.

These are multi-core processors. On my 4011 I get 300+ when single connection and 450+ on multiple connections. Wireguard will do 450+ single and multiple.

My ISP bandwith is 500Mbit/s.

In the title you have stated 7.1.1.1 and that can be confusing to many.

5

Yes, but published data is in both directions

Are you sure ?
I don’t see any reference on that…

6

Forget the theoretical debate nonsense.
Real world connectivity between two EXISTING connections 1gig fibre approx 10K apart same provider.
End1: RB450G Server behind CCR1009 End2: RB4011 Client behind ISP Modem/Router
Wireguard/
Test Ookla speed test origination from End2 using End1 Internet ----> 300 up and 300 down.

Clearly the packets in spain are smart they are taking a side trip along the way to here…
http://bodegasgrant.com/visita

7

Forget the theoretical debate nonsense.

@anav i will disagree on that…
Those tests exist for a reason… If you have no point of reference, then how are you going to compare two things ?
That’s why we mostly take as point of reference an average value of 512 byte of packet…

8

Tests uses 2 streams. In wiki you have more information: https://wiki.mikrotik.com/wiki/Manual:Tools/Traffic_Generator#IpSec_tunnel_performance_test

9

Yes I was being flippant. Concur!

10

I will try this weekend again. I was testing with only one stream because I was interested in TCP file transfer speed.

And sorry, the tile was a mistake and I haven’t found a way to change it. If I perform a new test this weekend, I will start a new thread with correct title.