finding a router with OpenVPN support

Jump to latest Follow Reply
W

wco81

Ars Legatus Legionis
28,661
  • #1
    wco81 said:
    I’m thinking about a new router as well. Currently using a the T Mobile Cellspot router.
    Click to expand...
    I use Open VPN, iOS and Mac clients.

    With the latest iOS apps, it's no longer liking the certificates generated by the Cellspot router because it uses an old or insecure hash algorithm to generate the certificate file.

    So my iOS 3.4.1 apps no longer connect as of a month ago but my Mac OS 3.4.2 client still does.

    I figure the router is old and Asus isn't updating the firmware to support more secure certificate generation methods.

    Can I assume that routers which are a year or two old should have Open VPN servers and more secure certificate generation?
     
    Andrewcw

    Andrewcw

    Ars Legatus Legionis
    18,129
    Subscriptor
  • #2
    Just buy a real Asus model that MerlinWrt supports.

    Home | Asuswrt-Merlin

    www.asuswrt-merlin.net www.asuswrt-merlin.net

    the model you have they dropped support over 6 years ago. Merlin dev dropped support when Asus requested so because they were being dumped on the open market from T-mobile at below cost.
    And this is the payment to allow the Dev work on firmware without being DCMA'ed.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #5
    Just get whatever $50 wifi 5 or wifi 6 router has good support for the firmware you want and live with it for the next couple years. Wifi 7 (much like 6) is an incremental upgrade that really only makes sense once you have a majority of your client devices supporting it. It will take a few upgrade cycles for the benefits to really be visible to most people.
     
    V

    versitron

    Smack-Fu Master, in training
    1
  • #7
    Unfortunately, upgrading to a newer router seems like the most reliable solution to your OpenVPN certificate issue. While waiting for Wifi 7 might be tempting, it's likely several years away from impacting most users significantly.

    While flashing firmware like MerlinWrt or FreshTomato might work, Asus dropped official support for your model and T-mobile branded models can be tricky to flash.

    As for OpenVPN clients, Passepartout could be an alternative, but user experience reports are limited.
    Therefore, investing in a new router with good firmware support for OpenVPN and secure certificate generation.
    Remember, newer routers offer not only compatibility with modern security standards but also potential performance improvements and future-proofing your network.
     
    B

    bkaral

    Ars Tribunus Militum
    2,646
  • #10
    tiredoldtech

    tiredoldtech

    Smack-Fu Master, in training
    84
    Subscriptor++
  • #12
    wco81 said:
    Thanks. Interest in Wireguard is that it might offer better throughput than OpenVPN.

    FreshTomato is mainly available on older routers isn't it?

    I'm going to look for at least Wifi 6 or 6E.
    Click to expand...
    Actually, it does support several newer ASUS units, including the TUF-AX3200_V2, RT-AC5300, RT-AC3200, and the NetGear R8000. Would any of those suffice?
     
    W

    wco81

    Ars Legatus Legionis
    28,661
  • #13
    Looked up some of those models. Some are not available in the US or no longer available as used.

    RT-AC3200 was first sold on Amazon in 2015.

    Performance-wise, probably still a big upgrade for me but still at $200, I have to see if more recent models have better processors.

    All the ASUS seems to have Wireguard VPN server support already, either with the original firmware or through a firmware update.

    So the only way getting an older router and flashing Redtomatoes would make sense would be if an older router costs much less than new Wifi 6 or 6E routers.
     
    Last edited:
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #14
    tiredoldtech

    tiredoldtech

    Smack-Fu Master, in training
    84
    Subscriptor++
  • #15
    wco81 said:
    Looked up some of those models. Some are not available in the US or no longer available as used.

    RT-AC3200 was first sold on Amazon in 2015.

    Performance-wise, probably still a big upgrade for me but still at $200, I have to see if more recent models have better processors.

    All the ASUS seems to have Wireguard VPN server support already, either with the original firmware or through a firmware update.

    So the only way getting an older router and flashing Redtomatoes would make sense would be if an older router costs much less than new Wifi 6 or 6E routers.
    Click to expand...
    Apologies for everyone's confusion- you had stated in this thread that you were looking for newer units AND in the same series of statements, looking (specifically) at 6 and 6E support, while also referencing that FreshTomato main focus is on older units (clearly not entirely true). Tomato/FreshTomato started off with older units as that is when it was simply the Tomato firmware starting in 2006. Since then, it has definitely evolved (Fresh Tomato was the reboot of this in 2020, thus- including older units would be easiest at first to migrate over, then include the newer ones as it progressed- as they pointedly had done so). Now, FreshTomato may not be for you (as it was suggested by others on the thread as an option), but there are options.

    You also failed to specify a target price-point. It's like stating you want Ferrari performance, but at the cost of a VW Passat when options are presented to you.

    There are many options out there to explore for WiFi speed and routed connection to ISP speed (even when adding the complexity of VPN speed and built in support over said connection). However, there are costs associated with said options, so keep that in mind- as sometimes, going for the lower cost goes to lower stability/options/quality/capacity. Best is to chart out what are your musts, like-to-haves, and hard stops- and then go from there. It will give a clearer definition of what your end goal is and what you can get for your expectations and what you are willing to trade-off to find a satisfactory solution.
     
    W

    wco81

    Ars Legatus Legionis
    28,661
  • #20
    Paladin said:
    Nothing can significantly change (improve) the performance of your internet connection. At best, a different VPN encoding/encryption type might mean less of a loss of performance but when you're talking about 24 megabit tops, a few percent means almost nothing.
    Click to expand...
    I tried a DOCSIS 3.1 router, learned that Comcast doesn’t support their higher upload service so returned and got one that did.

    So I now get 100 Mbps uploads.

    Then I went to a spot where I get way over 1 Gbps on 5G, pretty solid. So I turned on VPN to connect to my router back home and the speed test only gets me 30/20 speeds over OpenVPN.

    Now interested in trying a WiFi 6 or 6E router, one of the reasons being whether I might get better OpenVPN or Wireguard performance.

    Current router is very old, probably 10 years or more. Even at home, I get about 300/100 speeds on WiFi. But will now get 900/100 through an ethernet connection to the router.

    At a minimum, WiFi speeds at home should improve and I presume WPA3 will be “better” and more secure than WPA2.

    Wifi 7 routers are way more than I want to spend. my budget is about $200. Anyone buy recently around this price?
     
    X

    Xelas

    Ars Praefectus
    5,444
    Subscriptor++
  • #23
    wco81 said:
    I guess there are gaming routers. Are those using faster CPUs?
    Click to expand...
    Not necessarily. Sometimes it's just a skin in the GUI, and a fancy or alien-looking case with LEDs and a couple more Wi-Fi antennas, none of which will have anything to do with VPN throughput.
    OpenVPN is fairly CPU intensive compared to Wireguard, but Wireguard may or may not be more work to set up depending on if the router has some sort of automation or "wizard" to do the behind-the-scenes work or generating keys, adding client profiles to wireguard, etc. Neither OpenVPN or Wireguard have ASICs or hardware implementations. IPSec can be accelerated in hardware, but it's a PITA to set up and not typically found on consumer-grade routers.
    Another alternative may be to find an always-on PC or something and run OpenVPN or Wireguard on that. Some NAS devices support that, etc.
     
    W

    wco81

    Ars Legatus Legionis
    28,661
  • #24
    Bought the ASUS AX86U Pro, a Wifi 6 router with a 2.5 Gbps port.

    Had to also get a Cat 8 cable to hook up to the cable modem for that 2.5 Gbps port.

    It replaced a 10 year old T-Mobile Personal Cellspot router, the AC1900.

    Immediately I got full Comcast speeds, 1100-1200/120 Mbps. Before on wireless it was 600 at best, 90-100 up.

    One thing that is a letdown is that my old IoT devices struggled to connect to the 2.4Ghz network I set up. So Wifi lighting, an old Brother printer, MyQ garage door opener Wifi hub.

    Found a setting to enable 802.11b legacy mode, then I could connect all these old devices. I also reverted from WPA2 to WPA/WPA2 mode because my printer and the MyQ was not connecting at all, no matter how many times I changed the password.

    As a result, the 2.4 Ghz network has under 10 Mbps speeds. Ugh.

    I don't know if IoT devices are any better about newer than 802.11b and WPA support. I think some newer printers claim 802.11n support.

    But the main goal was better VPN server performance. This Asus lets you run multiple different VPN server protocols, so I enabled both OpenVPN and Wireguard.

    I went to a place with great 5G performance, over 1100 Mbps down, 50-60 Mbps up.

    With OpenVPN, I got 105/18 to the router.

    With WireGuard, I got 49.6/11.8 to the router.

    I didn't expect these results, thought WG would be faster. On the old router, the vest I could get on OpenVPN was 30/23.9.

    Only advantage of WG was that it connected a lot faster than OpenVPN, like instant authentication.


    Oh one other thing I observed. Initially I tried WPA3 on the 5 Ghz network. I think only my Macs and iPhone and iPad support WPA3. But the speeds were a couple hundred lower on WPA3 vs. WPA2 so I switched it to WPA2 for now.

    For greater security from WPA3, I may use take the performance hit on wireless inside the home.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #25
    Just in case it ever becomes important to you, Cat5e cables will do 2.5 Gbit just fine as long as they are in good physical condition. Cat8 cables are not really much use in the real world, they basically are for marketing. Anything 10 Gigabit or more is best on fiber or direct attach cables, though you can get away with 10Gbase-T over Cat5e or Cat6a without too much issue in most situations (relatively short cable runs, up to 50 meters or so for Cat5e or the regular max 100 m for Cat6A, assuming a good cable install).

    I actually bought a few of those Cat8 cables myself because they look fancy and seem durable for putting in a laptop bag etc. They're mostly a novelty at this stage because there is no equipment that will actually link using them for 40 Gbps (which is their claimed raison d'être).

    And yes, WPA3 is often slower than WPA2 in my experience and not well supported yet. I am guessing it is low CPU encryption performance for whatever devices might be involved.
     
    • Like
    Reactions: tucu
    W

    wco81

    Ars Legatus Legionis
    28,661
  • #26
    Only reason I got Cat 8 was that it was about the same price as Cat 6 cables.

    Paid $6 plus tax for a six-footer.

    Yeah I've heard that WPA3 may not be a lot more secure than WPA2 either. Otherwise, within the home I have plenty of Wifi throughput and there are a lot of other neighborhood networks.

    That is why I might have been interested in the 6E or 7 routers with 6 Ghz support but not worth hundreds more for it at this time.
     
    • Like
    Reactions: pasorrijer and Paladin
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #27
    Yup, same here. The Cat 8 cables are cheap enough if you only need one or two short ones.

    I tried WPA3 on a Cisco access point and saw the same kind of slowdown as I did on an Asus home router so I think it might be the client that is at least part of the issue. My phone and laptop both seemed to top out about half the speed compared to WPA2 and the security is not that important to me since both are basically just for internet access and there is nothing particularly important that is accessible on either wifi network. (home or work)

    I'll try again in a few years with wifi7 once there are a lot more devices that support it and the routers are sub $100 or so. The penetration of 6ghz is not enough to make it viable for a lot of setups outside of very specific environments so I don't worry about that too much for general use.
     
    continuum

    continuum

    Ars Legatus Legionis
    94,897
    Moderator
  • #28
    wco81 said:
    I don't know if IoT devices are any better about newer than 802.11b and WPA support. I think some newer printers claim 802.11n support.
    Click to expand...
    Pretty sure the Chamberlain MyQ works fine on 802.11n, not sure why you had to drop down to 802.11b. o_0 Might be some other incompatibility there. Have you tried switching to AsusWRT-Merlin?
     
    W

    wco81

    Ars Legatus Legionis
    28,661
  • #29
    continuum said:
    Pretty sure the Chamberlain MyQ works fine on 802.11n, not sure why you had to drop down to 802.11b. o_0 Might be some other incompatibility there. Have you tried switching to AsusWRT-Merlin?
    Click to expand...
    My model would only let me pick 2.4 GHz network and would fail to connect until I enabled legacy 802.11b mode on the router settings and go from WPA2 to WPA/WpA2 mode.

    Its the older black model, not the newer white model.

    in any event, I needed to also connect some smart home lighting and my old printer.



    not to mention my HomePod Mini only connects to 2.4ghz. :rolleyes:


    I can upgrade the printer and maybe try the newer MyQ.

    may be worth it but these cheap WiFi lights probably won’t support newer Wif I or security.

    Maybe with Matter devices, the situation will change.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #30
    I've noticed that either my wifi bulbs (color) and smart outlets only do 2.4 ghz or simply can't get enough 5ghz where they are to make use of it. Probably the first. There's no need for a light bulb or outlet that basically needs a couple of KB of data every few weeks or so to have an 800 megabit wifi link. Which is actually great, I'd rather they stay on 2.4 ghz and my devices that actually need bandwidth stay on the 80mhz channels on 5 ghz.
     
    continuum

    continuum

    Ars Legatus Legionis
    94,897
    Moderator
  • #31
    wco81 said:
    My model would only let me pick 2.4 GHz network and would fail to connect until I enabled legacy 802.11b mode on the router settings and go from WPA2 to WPA/WpA2 mode.

    Its the older black model, not the newer white model.
    Click to expand...
    Ah, maybe that is it. I thought I had the older black model, but checking my order history I have both... not sure which I am currently using.
     
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #33
    That is usually how it works, the guest network is isolated from the main wifi network. Some things will still work like IoT items that use a cloud integrated management app (the app on your phone talks to the cloud and the IoT device gets the configuration changes or triggers from the cloud) because they don't talk directly to each other. Things like a printer might not work at all unless you use an app or remote printer software to do the printing via a cloud integration as well.
     
    W

    w00key

    Ars Praefectus
    5,907
    Subscriptor
  • #34
    There's always an option to create a separate network for IoT crap, with a separate physical AP. That way you can run n/ax for phones and laptops and drop to b/g/n compatibility mode on a different channel.


    I have a main network with Wifi 6, OFDMA etc enabled, 2.4 Ghz extended range disabled (low data rate like 1 Mbps) so clients don't try to hold onto a far away AP for too long.
    Separate SSID for IoT, 2.4 only, no OFDMA, extended range / low data rate enabled. "Smart" power plugs are rather bad at roaming and it's better they connect than have an optimal signal, data is measured in kbps anyway.
     
    Last edited:
    Paladin

    Paladin

    Ars Legatus Legionis
    32,552
    Subscriptor
  • #36
    If you're worried about that:

    1. Get new IoT devices that work with modern wifi because they probably have a ton of security issues as well.
    2. Get a router/firewall and switches and/or APs that handle VLANs so you can segment your network to meet your security worries.

    A used Fortigate (just got a 60E the other day for $50 shipped) or a cheap machine running PFSense or something similar can be had for under $100, managed switches start around $30 or so these days and a couple of used WiFi access points can be had as low as $25 each or so as well.

    It will take some work to get it all running the way you want but it should provide a very controlled network and a good learning experience.
     
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply