Upgrade or update my too-slow-VPN router

I have a FritzBox 7490, it has a well problem, a slow processor which means it can't do VPN at a half decent speed. I actually have three or four FritzBoxes with site-to-site VPNs running between them for backups and file access. I'm lucky to get 3 to 5 Mbps between sites, even on a 20Mbps FTTC upload connection. We're doing off-site backups of large files and they take too long.

I could buy a faster better router. Which? It has to be able to do fast VPN! Also, I like the FritzBox as it has gigabit LAN, WiFi, DECT and VoIP phone all in the one box. But this will cost a few hundred quid per site so a bit of a cost.

Or I could buy a Ubiquiti ER-X EdgeRouter X or four for less than £50 each. Then I need to learn how to do static routes and have it handle the VPN. Will it have a decent VPN throughput, maybe even future proof for FTTP?

Or suggest another cunning plan for me to consider

[No extra points for noting I've been moaning about this for ages, things have now got to the stage I need the VPN speed!]

I am starting to like the Ubiquiti series ...

If you go for their Edge router, then get a Dream Machine Pro for the FTTP (when it arrives) and it will interface nicely on a PPPoE direct to the ONT with IPv4 & v6.

Add in a couple of their WAPs and easy to manage from a single window!

In reply to a post by MHC:

Dream Machine Pro

I'm finding the Ubiquity range confusing. Some of it seems to be designed for you to run a wifi based ISP business. My gaff ain't big enough or hard enough to need more than one wifi transmitter!

Also, if/when FTTP turns up, the ONT is the 'modem', I can connect any router to that, can't I?

I was advised it would not be ideal and the DM-Pro was the way to go. And slowly getting to understand the various capabilities.

In reply to a post by MHC:

slowly getting to understand the various capabilities.

I'll call your bluff! What's the difference between the UniFi routers and the Edge routers? When confronted by too much choice in the jam section I end up buying marmite. Unless there's a Vegemite choice, then I get green marmalade.

In reply to a post by Woolwich:

[No extra points for noting I've been moaning about this for ages, things have now got to the stage I need the VPN speed!]

How much VPN grunt you need?

The reasonably newish CCR 2000-series MikroTik’ers with the fandangly AL32400 (ARM 64-bit cpu clocked @ 1700 MHz) system on a chip, specifically the 2004 will shift 3.4 Gbps though a single IPsec tunnel.

Definitely future proof. Might be a touch overkill at £330 odd though 😀

In reply to a post by Pheasant:

Definitely future proof. Might be a touch overkill at £330 odd though 😀

Trouble is you need one at each end. I have four ends. Then I'm going to have to get a Very Fat leased line. Times four. But any VPN that'll do 80Mbps (as fast as our current fastest download) would do for a while.

The Cloud Core Routers are serious bits of tin, and the CCR2004 is the daddy when it comes to VPN performance. You probably don’t really need that level of grunt to be fair (or the 25G interface options!). They have more modest kit, but the bang for the buck really is quite astounding.

I did say I am getting use to it ...


And if te green marmalade is too expensive, do you buy honey, or some strawberries and sugar?

In reply to a post by Pheasant:

The Cloud Core Routers are serious bits of tin, and the CCR2004 is the daddy when it comes to VPN performance. You probably don’t really need that level of grunt to be fair (or the 25G interface options!). They have more modest kit, but the bang for the buck really is quite astounding.

The RB4100 can do a fair bit as well, also the routerOS learning curve is a bit steep if you are new to the platform.

If you want cheap and Cheerful the HAP Ac2 can do a few hundred Mbit of IPSEC VPN.

Edited by dragon2611 (Wed 30-Jun-21 09:50:47)

I can highly recommend the commercial hardware for pfSense. I just installed 6 for a group of garages so the can communicate to their central server at higher speeds.

Thanks
Dan

Yes and yes. RouterOS is a veritable Swiss army knife, I'd agree on the learning curve, but mitigated I think by the GUI front end of WebFig and WinBox.

In reply to a post by Pheasant:

Yes and yes. RouterOS is a veritable Swiss army knife, I'd agree on the learning curve, but mitigated I think by the GUI front end of WebFig and WinBox.

Yes rather easy to set it up in an insecure config if you're not careful though.
They're cheap and powerful but sometimes a bit buggy (although I would think with the features the OP is likely to use they'd be unlucky to run into those kind of bugs, it' usually when you start doing more complex configurations that happens)

In reply to a post by Pheasant:

RouterOS is a veritable Swiss army knife, I'd agree on the learning curve, but mitigated I think by the GUI front end of WebFig and WinBox.

In reply to a post by dragon2611:

Yes rather easy to set it up in an insecure config if you're not careful though.
They're cheap and powerful but sometimes a bit buggy (although I would think with the features the OP is likely to use they'd be unlucky to run into those kind of bugs, it' usually when you start doing more complex configurations that happens)

I did have a quick look at the MikroTik website and felt as if I'd just gone to another supermarket selling the same complex selection of various colour jams in a slightly different jar. I'm willing to give them a go if it appears the documentation and support is clear and easily available. I'm not too sure that's true of Ubiquity.

The MikroTik community forum is also very helpful

I've had a look around MikroTik, it's them or Ubiquity...

The Number One reason I'm here is to upgrade my VPN site-to-site connections. The only help I can find to do that is on YouTube from MikroTik and it looks blinking complex. The vid is over an hour [censored]! https://www.youtube.com/watch?v=n5_Af2vllOA

Is Ubiquity going to be any simpler? I'm used to the GUI settings in the FritzBox and it takes care of everything other than the IP addresses for the connections.

The MikroTik hAP ac2 seems to do all the Ubiquity Edgerouter X does but is available to buy (the Ubiquity is out of stock everywhere).

(Interesting to see the forum censors the TLA for flips sake...)

Qnap did put out a load of SD-WAN boxes recently, no idea if they're any good however as not tried one.

https://www.qnap.com/en-uk/product/qhora-301w

Edit: It's somewhat buried in the specifications but they claim 300Mbit/s VPN throughput

Edited by dragon2611 (Wed 30-Jun-21 16:57:51)

If you don't mind building your own, there are plenty of options for running pfSense/OPNSense.

A decent low cost option is an HP T620+ thin client which crop up on ebay fairly frequently.
These will do gigabit routing and OpenVPN of ~300mbit all for <£100 and around 10w.

https://www.servethehome.com/hp-t620-plus-thin-clien...

Edited by smouty (Thu 01-Jul-21 08:41:32)