Question

I am looking for a Gigabit VPN (IPv6 capable) Router primarily using ethernet but also having WiFi and LTE support would be useful provided that the basic RUTX engine performance metrics are suitable.
So far, when comparing various brand routers while on the surface they appeared to be suitable - only on reviewing all performance metrics and feature sets did it become apparent that some models (& even brands) were totally unsuitable for what I am looking for.
I have been very impressed with the Teltonika products - in particular RUTX11 provided that I am able to determine its actual performance metrics.
Specifically I am after Max NAT throughput Mbps, Max IPSEC VPN Throughput Mbps, Max SSL VPN Throughput Mbps, Max concurrent VPN's, Max Concurrent IPSEC VPN's,  Max Concurrent SSL VPN's, Max Simultaneous NAT Sessions. These parameters (or a variation thereof) are typically quoted by other Router Manufacturers.
While I don't anticipate running the router at full capacity knowing what it is at least capable of will be very helpful.

geoff

rutx11  rutx08 performance  vpn

Comments

If there's going to be an official response to this, then Zerotier throughput numbers would be good as well.

[sorry this should have been a comment not an answer]

Answer 1

Greetings,

Thank you for your question.

Here are some of the test results that were done on our RUTX series devices:

• NAT: maximum ~450Mbps throughput on 7.2 FW and 7.0 FW
• IPSec: average ~137.8Mbps throughput on 7.00.923, ~62Mbps on 2.06.1 FW
• ZeroTier: maximum ~30Mbps throughput on 7.2.2 FW and ~70Mbps on 2.6.1 FW
• SSL VPN - OpenVPN - maximum ~25.1 mbps throughput on 7.1.8 FW, ~22.6 on 7.2.3 FW
• Max Concurrent IPSEC VPN's: 700. Can achieve more if given enough setup time, but highly discouraged. IPsec was configured in a 1-to-1 configuration, where we have a VPN instance on both ends. The clients managed to go up to 700, however the time required to wait for the setup to complete is exceeding 30mins, which is unreasonable. Clients can connect when given enough time, but if a network service or the device itself is required to restart, it will require the same setup time and will create very long downtime.
• Max Concurrent SSL VPN's - OpenVPN - Max 180.

Please let me know if you need any additional information.

Best regards.

Comments

Thanks - that has been helpful ...but also letting me know that I need to place some practical limits around some of the questions too.

I've also re-asked the last question as that that was not answered. I.m not sure that the time taken to establish a new NAT session will increase appreciably in time - in which case a single figure for an absolute maximum value is fine.

Could you re-answer these last few questions please  - as no-one in practical terms is going to want to wait 30 minutes for a new VPN session to establish.? If the already captured performance metrics don't record the vpn establishment time at those values please specify what metrics you do have in that area that will allow a practical limit on maximum VPN's where the VPN establishment time does not exceed a certain number of seconds to be approximated from existing recorded performance metrics.

What is the maximum concurrent IPSEC VPN's carried through the router as a whole that can be established where the setup establishment time is not to exceed 10 secs, 20secs, 30secs ?

What is the maximum concurrent SSL VPN's carried through the router as a whole that can be established where thesetup establishment time is not to exceed 10 secs, 20secs, 30secs

What is the maximum concurrent NAT connections carried through the router as a whole that can be established where the setup establishment time is not to exceed 10 secs, 20secs, 30secs

Thanks for your help with this.

geoffc

---

Greetings,

Thank you for clarification.

Regarding VPNs, unfortunately, such data is not available, as tests were carried out with an emphasis on maximum client count and not setup establishment time. This is because this kind of testing would not be accurate in view of the fact that VPN clients might be idle, might be active as well as somewhere in between.

As for NAT, tests were carried out with 3 multiconnections, also without an emphasis on setup establishment times, hence no data regarding your questions were carried out.

I apologise for any inconvenience.

Best regards.