wikiThomas-Krenn OPNsense Firewall Performance
The free firewall solution OPNsense can be used for a lot of different devices and server. To find the suitable hardware for your purpose, the systems are subject to comprehensive performance tests. This article shows tabular results of Thomas-Krenn Low Energy Server (LES) devices and further fanless devices. The chart is permanently expanded with more systems after testing. An overview for performance data of Rack server can also be found in Thomas-Krenn-Wiki.
| Important: These tests were carried out under laboratory conditions. Real values in production environments may differ. The tested models may have already been replaced by new versions. The latest hardware selection can be found in the online shop of Thomas-Krenn. |
Testing results
The following chart shows available results so far:
| Server | invalid id
(note: tests with OPNsense 19.7) |
Edge 4L
(note: tests with OPNsense 22.7.2) |
LES v4
(note: tests with OPNsense 22.7.10_2, except WireGuard) |
LES network 6L
(Version 1, Intel Core i5-8250U) (note: tests with OPNsense 22.7_4-amd64) |
LES network 6L
(Version 2, Intel Core i5-10210U) (note: tests with OPNsense 23.1) |
LES network 6L (Version 4, Intel Core i5-1235U) (note: tests (ecxept for Zenarmor Test) with OPNsense 25.1.6_4-amd64) |
FWA-1112VC-4CA1S
(Intel Atom C3558) (note: tests with OPNsense 25.1.5_5-amd64) | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hardware equipment used for testing | RAM | 2 GB | RAM | 2 GB | RAM | 32 GB (RAM maximum demand was 11 GB (IPS Test)) | RAM | 4 GB | RAM | 16 GB | RAM | 16 GB | RAM | 8 GB | |||||||||||||||
| settings
(exact test settings listed below) |
performance | last (CPU time in %) | performance | load (CPU time in %) | performance | load (CPU time in %) | performance | load (CPU time in %) | performance | load (CPU time in %) | performance | load (CPU time in %) | performance | load (CPU time in %) | |||||||||||||||
| Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | Upload | Download | ||||
| Routing |
|
not tested | not tested | not tested | not tested | 2,35 Gbit/s | 2,35 Gbit/s | 10 | 11 | not tested | not tested | ||||||||||||||||||
| (note: 2,5 Gbit/s NIC maxed out) | |||||||||||||||||||||||||||||
| Firewall |
|
not tested | 942 Mbit/s | 942 Mbit/s | 31 | 29 | 2,35 Gbit/s | 2,35 Gbit/s | 19 | 20 | 940 Mbit/s | 941 Mbit/s | 15 | 18 | 2,35 Gbit/s | 2,35 Gbit/s | 17 | 18 | 2,35 Gbit/s | 2,36 Gbit/s | 12 | 13 | 8,3 Gbit/s | 6,6 Gbit/s | 96,8 | 74,4 | |||
| (note: 1 Gbit/s NIC maxed out) | (note: 2,5 Gbit/s NIC maxed out) | (note: 1 Gbit/s NIC maxed out) | (note: 2,5 Gbit/s NIC maxed out) | (note: 2,5 Gbit/s NIC maxed out, therefore routing not tested) | (note: very high throughput, but CPU almost fully utilized) | ||||||||||||||||||||||||
| Firewall and IDS |
|
not tested | 941 Mbit/s | 941 Mbit/s | 51 | 58 | 2,35 Gbit/s | 2,35 Gbit/s | 51 | 52 | 942 Mbit/s | 942 Mbit/s | 15 | 18 | 2,35 Gbit/s | 2,35 Gbit/s | 19 | 20 | 2,35 Gbit/s | 2,36 Gbit/s | 14,5 | 12,5 | 6,7 Gbit/s | 5,2 Gbit/s | 99 | 87,8 | |||
| (note: 1 Gbit/s NIC maxed out, but significantly increased load compared to pure firewalling) | (note: 2,5 Gbit/s NIC maxed out, but significantly increased load compared to pure firewalling) | (note: 1 Gbit/s NIC maxed out) | (note: 2,5 Gbit/s NIC maxed out, only minimal increased load compared to pure firewalling) | (note: 2,5 Gbit/s NIC maxed out, only minimal increased load compared to firewalling test with block lists) | (note: very high throughput, but CPU almost fully utilized) | ||||||||||||||||||||||||
| Firewall and IPS |
|
not tested (not recommended, CPU too weak) | 606 Mbit/s | 420 Mbit/s | 62 | 41 | 770 Mbit/s | 630 Mbit/s | 44 | 33,5 | 942 Mbit/s | 942 Mbit/s | 21 | 19 | 2,35 Gbit/s | 2,30 Gbit/s | 23 | 18 | 2,35 Gbit/s | 2,37 Gbit/s | 10 | 12 | - | - | |||||
| (note: CPU and software the limited factor, not 1 Gbit/s NIC anymore) | (note: 1 Gbit/s NIC maxed out, load slightly higher than for IDS) | (note: 2,5 Gbit/s NIC maxed out in the upload, download slightly less throughput, slightly increased load compared to IDS) | (note: 2,5 Gbit/s NIC maxed out) | (note: test results not plausible, faster than IDS) | |||||||||||||||||||||||||
| Firewall and Zenarmor |
|
not tested (not recommended, CPU too weak) | 769 Mbit/s | 825 Mbit/s | 36 | 47 | 893 Mbit/s | 941 Mbit/s | 32 | 33 | 940 Mbit/s | 942 Mbit/s | 17 | 19 | 2,35 Gbit/s | 2,35 Gbit/s | 16 | 21 | 2,35 Gbit/s | 2,37 Gbit/s | 10 | 8,5 | not tested | ||||||
| (note: 1 Gbit/s NIC maxed out, load slightly higher than for IDS) | (note: 2,5 Gbit/s NIC maxed out, settings: MongoDB data base, routed mode with native netmap) | (note: 2,5 Gbit/s NIC maxed out, test with OPNsense 25.1.7) | |||||||||||||||||||||||||||
| OpenVPN Tunnel |
|
84 Mbit/s | 114 Mbit/s | 33 | 33 | 145 Mbit/s | 175 Mbit/s | 36 | 34 | 435 Mbit/s | 436 Mbit/s | 28 | 27 | 470 Mbit/s | 462 Mbit/s | 17 | 16 | 997 Mbit/s | 788 Mbit/s | 17 | 14 | 986 Mbit/s | 632 Mbit/s | 9,9 | 7 | 188 Mbit/s | 252 Mbit/s | 32,7 | 33,6 |
| IPsec VPN Tunnel |
|
403 Mbit/s | 324 Mbit/s | 70 | 53 | 746 Mbit/s | 479 Mbit/s | 75 | 48 | 1,77 Gbit/s | 1,3 Gbit/s | 64 | 43 | 825 Mbit/s | 847 Mbit/s | 17 | 19 | 1,87 Gbit/s | 1,74 Gbit/s | 20 | 21 | 2,03 Gbit/s | 2,01 Gbit/s | 16,2 | 15,3 | 1,26 Gbit/s | 1,3 Gbit/s | 80,1 | 75,9 |
| WireGuard VPN Tunnel |
|
178 Mbit/s | 171 Mbit/s | 89 | 86 | 296 Mbit/s | 331 Mbit/s | 82 | 80 | 896 Mbit/s | 849 Mbit/s | 70 | 74 | 865 Mbit/s | 889 Mbit/s | 48 | 45 | 1,35 Gbit/s | 1,26 Gbit/s | 49 | 50 | 2,25 Gbit/s | 2,25 Gbit/s | 23,5 | 23 | 1,15 Gbit/s | 1,6 Gbit/s | 87 | 98,6 |
| (note: WireGuard tests were performed with OPNsense 22.7.11-amd64) | (note: Tested with wireguard-go and OPNsense-23.1.1_2) | (note: 2,5 Gbit/s NIC maxed out, consider overhead of WireGuard protocol) | (note: results very strong, but with extremely high CPU load) | ||||||||||||||||||||||||||
Setup of performance tests
The following table shows further components of firewall tests. The firewall, which should be tested, is always marked as firewall 2. To test the maximum performance, a server based on a Supermicro H12SSL-NT Mainboard was selected as performant remote station (Firewall Site 1):
| purpose | hardware | BIOS information | software |
|---|---|---|---|
| Firewall Site 1 |
|
|
|
| Firewall Site 2 |
|
||
| Clients to 2023 | |||
| Client Site 1 |
|
|
|
| Client Site 2 |
|
| |
| Clients since 2024 (two new identic and more performant last clients were procured) | |||
| Client Site 1 and 2 |
|
|
|
Benchmark tools
The performance tests were made with iperf.
- iperf was started with the following command on the server page:
iperf -p 5000 -f m -s - The client page connected with the following command to the iperf server:
iperf -p 5000 -f m -c <IP-de-Servers> -t 180 -P 10 - The load on the firewalls was measured on the firewalls: "vmstat -w 180 -c 2"
Upload test
To simulate an upload test, client mode was started on Client Site 2. On Client Site 1, iperf was started with the parameter -s in server mode.
Download test
The directions were reversed for a download test and Client Site 1 was started as client via parameter -c as client and Client Site 2 with -s in server mode.
Test runs
In general, the values in the charts are to be regarded as average values from up to 10 runs. In some tests, when the network socket was busy, the results were not generated in several runs because they were always identical.
Settings
The following settings were made on the OPNsense firewalls. In general, no special optimization steps were carried out. OPNsense was used with default settings. As the settings for individual VPN technologies are also demanding, measured values can certainly be regarded as an absolute minimum.
- Firewall Test
- Spamhaus DROP and EDROP lists on LAN and WAN Interface activated
- EDROP list now integrated in DROP and no longer available, only DROP list used in tests of FWA-1112VC-4CA1S and RI1102-SMXDFH.
- OpenVPN Test (legacy server/Client method)
- Server Mode: Peer to Peer (SSL/TLS)
- Protocol: UDP4
- Device Mode: tun
- TLS Authentication: Enabled - Authentication & encryption
- TLS Shared Key: 2048bit OpenVPN static key
- DH Parameters Length: 4096 bit
- Encryption Algorithm: AES-256-GCM (256 bit key, 128 bit block, TLS client/server mode only)
- Auth Digest Algorithm: SHA512 (512-bit)
- Certificate Depth: Do Not Check
- Compression: Enabled - LZO algorithm (--compress lzo)
- OpenVPN Test (Instances method)
- TLS static key crypt
- 2048 bit Static Key
- cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500
- Data Channel: cipher 'AES-256-GCM', peer-id: 0
- Protocol options: protocol-flags cc-exit tls-ekm dyn-tls-crypt
- IPsec VPN Test (legacy Tunnel Settings method)
- Phase 1
- Authentication method: Mutual PSK
- Pre-Shared Key: yes
- Encryption algorithm: 256 bit AES-GCM with 128 bit ICV
- Hash algorithm: SHA256
- DH key group: 14 (heißt 2048 bits)
- Phase 2
- Protocol: ESP
- Encryption algorithms: aes256gcm16
- Hash algorithms: SHA256
- PFS key group: 14 (2048 bits)
- Phase 1
- WireGuard VPN test
- Shared secret (PSK)
- WireGuard VPN test (Instances)
- Public Keys
- Pre-shared key additionally
 |
Author: Thomas Niedermeier Thomas Niedermeier working in the product management team at Thomas-Krenn, completed his bachelor's degree in business informatics at the Deggendorf University of Applied Sciences. Since 2013 Thomas is employed at Thomas-Krenn and takes care of OPNsense firewalls, the Thomas-Krenn-Wiki and firmware security updates.
|
