18 replies to this topic

[doubledip]

 Hello,

 

OpenVPN seems to be an old version.

root@spycatminiplus:~# opkg list | grep openvpn
openvpn - 2.3.2-r0.0 - A full-featured SSL VPN solution via tun device  A full-featured SSL VPN

Is it possible to update OpenVPN to a newer version on the Feed?

 

doubledip

[WanWizard]

No. The version of OpenEmbedded used dictates the version of OpenVPN. and adding a newer version is quite a bit of work.

 

What functionality are you exactly looking for, besides a bigger binary and a higher version number?

[doubledip]

I want to buy an account from Mullvad VPN.

 

I read that on the Mullvad FAQ page

Connection Speed – Why is it so slow?

...

For OpenVPN users

Please update your OpenVPN version to 2.4.0 or later. Older versions do not perform as well, Especially versions older than 2.3.10

and on OpenATV Feed they have 2.4.3

 

That's why I asked for a newer vesion.

Edited by doubledip, 31 October 2017 - 22:05.

[WanWizard]

2.4.x has some speed improvements, but they are irrelevant on the box, as it simply doesn't really have the CPU for multi-core AES calculations.

[doubledip]

Thanks for the explanation. I´ll try with OpenVPN 2.3.2 from the feed.

[WanWizard]

Ok. Let me know how things go, if it really doesn't, pass us any error messages, and I can see if I can get it on the todo list.

[doubledip]

OpenVPN version from feed will work. I already tried it a few months ago with another VPN provider, but speed was unconvincing. Had no error messages or whatorever.

 

I´ll try with Mullvad and give some feedback. I´ll also check VPN Config Changer Plugin by seidy on OpenPLi, which makes it easy to change server configs.

https://www.opena.tv...er-auswahl.html

[WanWizard]

Speed will never be convincing, the CPU of most boxes simply don't have the power. Only the latest ARM based SoC's are a bit more generous in the CPU department. The CPU in de SoC is designed to power a simple GUI for watching TV, not for complex AES calculations.

 

If you serously need a VPN, run it on a router, not on the box.

[littlesat]

Even 'low cost' routers could be too slow.... Here on Mipsel boxes I tried openvpn (on an ET10K) with 'down convert'.... with 5 Mbps no issue... the box could do it... And that time even with an 'older' OpenVPN...

[WanWizard]

Yup, for low-cost routers, the same restrictions apply.

 

Usually, problems with VPNs (especially when talking about streaming, which I assume this is about) or Internet connection in general, are not related to bandwidth at all, but are related to latency and jitter.

[rsync]

My feedback, Openvpn on Openpli 4 final, run very well. VU+ SoloSe v2

[Erik Slagter]

Actually most of the data is transmitted using a not-so-heavy symmetric cipher. The negotiation of the keys for that is done using assymmetric ciphers and these are heavy on the CPU, but they only need to be done on initial connection and rekeying interval (mostly one hour).

[Pippin]

Not to start a endless discussion (again) but other reasons to keep things updated is vulnerabilities, compatibility between endpoints, bugs, new features, feature improvements,.....

 

In my opinion it should be removed or updated, I would prefer the latter.

[Erik Slagter]

There are no known vulnerabilities in OpenVPN. Just make sure your openssl library is up to date.

 

I don't think one should always want to have the latest bugs.

 

Anyway the discussion is moot, because the version of OE determines what version is used.

Edited by Erik Slagter, 3 November 2017 - 16:19.

[doubledip]

OpenVPN version from feed will work. I already tried it a few months ago with another VPN provider, but speed was unconvincing. Had no error messages or whatorever.

 

I´ll try with Mullvad and give some feedback. I´ll also check VPN Config Changer Plugin by seidy on OpenPLi, which makes it easy to change server configs.

https://www.opena.tv...er-auswahl.html

Short feedback:

- OpenVPN 2.3.2 works without problems on my SpycatMini+

- Mullvad has fast servers

- VPN Config Changer Plugin by seidy also works with OpenPLi and is very useful

Edited by doubledip, 4 November 2017 - 12:32.

[daveraver]

There are no known vulnerabilities in OpenVPN. Just make sure your openssl library is up to date.

I don't think one should always want to have the latest bugs.

Anyway the discussion is moot, because the version of OE determines what version is used.

So libraries for vpn use, ssl, libcrypto, etc.. I dont know which/how much libraries... they are updated by default or we have to put our interest on update them by our hands??? I am talking to use openvpn 2.3.2. thanks mates!

[Erik Slagter]

If there is a blatant vulnerability in one of the security related libraries, they will be patched.

[UnimatriX]

OpenVPN version from feed will work. I already tried it a few months ago with another VPN provider, but speed was unconvincing. Had no error messages or whatorever.

I´ll try with Mullvad and give some feedback. I´ll also check VPN Config Changer Plugin by seidy on OpenPLi, which makes it easy to change server configs.
https://www.opena.tv...er-auswahl.html

Short feedback:
- OpenVPN 2.3.2 works without problems on my SpycatMini+
- Mullvad has fast servers
- VPN Config Changer Plugin by seidy also works with OpenPLi and is very useful

Works fine on a Vu+Solo2 and NordVPN.
Also VPN Config Changer plugin works fine if you don’t use spaces in folder names and after setting ‘755’ to .crt and .key files in those folders.

[MiLo]

Rather than speculating, you can actually just ask the box to do a benchmark:

root@et8000:~# openssl speed aes-128-cbc aes-256-cbc
...
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc      18948.61k    20757.61k    21286.31k    21431.64k    21424.81k
aes-256 cbc      14635.85k    15657.57k    15776.21k    15823.21k    16072.70k

So the 1200MHz MIPS in the et8000 can encrypt (or decrypt) about 20 megabytes per second.