Configuration for old CPU (WRT54GL) on Tomato

Netsurfer

Hi guys, I'm a newbie in knowledge and I hope you can clarify some things to me 🙂
I have some experience with OpenVPN but I never really studied how it works.
I need to set an old Linksys WRT54GL (with Fresh Tomato) as client in order to make it connect to my VPS where I have OpenVPN installed.
I did it and it works.
Considering in this case I'm NOT interested in security (I just need to reach this router that is behind another 4G router which lacks vpn features), I'd like to boost it up a little.
So, what I wanna know is: which is the most important parameter that impacts on its CPU?
I think it's the encryption of the channel but please just explain it to me.
1) On Tomato I have in the first page the Authorization Mode, the TLS control channel and the Auth digest settings: do they only have to do with the initial connection? Or do those settings really impact the performances?
2) In the second page I have Cipher Negotiation, the legacy/fallback cipher and the Compression. Even if I have everything disabled (yea I know what it means, just experimenting here) it's still very slow.
Please, can someone kindly do a little recap for me and tell me what I might change? I tried to reduce the RSA key in vars, I had to make some modifications in Debian and SSL too... but ok, please just explain if you can. Thanks 🙂

TinCanTech

Netsurfer wrote I tried to reduce the RSA key in vars, I had to make some modifications in Debian and SSL too... but ok, please just explain if you can.

That will not help because it is only used for one very specific check.

Netsurfer wrote On Tomato I have in the first page the Authorization Mode, the TLS control channel and the Auth digest settings: do they only have to do with the initial connection? Or do those settings really impact the performances?

They can effect performance .. if you leave them at default they generally work well.

Netsurfer wrote In the second page I have Cipher Negotiation, the legacy/fallback cipher and the Compression. Even if I have everything disabled (yea I know what it means, just experimenting here) it's still very slow.

Generally, this probably means that your old Linksys is crap and that is all it can do.

You can try --data-cipher CHACHA-POLY... but it will be slower than no cipher at all..

You can try disabling compression because most data is pre-compressed (not all but most).

Don't use legacy or fallback ciphers if you can avoid them. They offer no better performance because they are old and most have proven weaknesses.

Netsurfer

Hi, thanks for your answer.
Yea, I know it's crap lol, just wanna understand how all the things work 😛
Please, can you tell me which is the setting that is used during ALL the session and most of all affects CPU?
I read on airvpn forum this:
"the main load on the CPU is the encryption/decryption on the data channel".
So, do your answer and this answer mean that "no cipher at all" is absolutely the lightest setting in this matter?
Does it mean that ALL THE DATA go out and come back in "clear text" (just to understand each other, please spare me the sniffing job :lol: ).
Then, about what you said before: what I read in the first page is related to all the session or only to the beginning?
Thanks really for your help 🙂

Netsurfer

Please let me understand this: when you use
cipher none
auth none
what does that mean for vars in easy-rsa?

TinCanTech

That means nothing to easy-rsa

Netsurfer

I'm gonna start from the scratch.
If I do this on the server
dev tun
auth none
ifconfig 10.0.0.1 10.0.0.2

and

dev tun
auth none
remote ip_server
ifconfig 10.0.0.2 10.0.0.1
on the client

without doing anything else it just works and performances are very good (considering).

Now, despite any iptables or route rules, what can I do in order to add a simple authentication still keeping the connection this way?

After that I'm gonna check performances again and then I'm gonna think, eventually, about a little hardening but it's not necessary.

I just wanna understand how it works.

Thanks!

Netsurfer

TinCanTech wrote That means nothing to easy-rsa

I don't understand, sorry.
I can find a lot of examples where cypher and auth are none but there are certificates and keys in play.
When you say "nothing" do you mean there is no use of easy-rsa (as in my example above) or that I can/have to create crt, key etc without changing anything in vars?
If I don't change anything aren't default values used?
I really would like to understand how it works 😛
btw I'm reading the guide more carefully XD

TinCanTech

Certificate and keys are only used to verify each node. Once that is done then only data and control packets are encrypted and transmitted.

Encryption and decryption of these packets is the most CPU intensive process.

You are not using any encryption therefore your device is going as fast as it can.

Netsurfer

Thank you, yea I was reading on the guide that a control is done every hour or so (if you don't change it I think), so that might impact the cpu too but not much. Yea, I'm understanding now more or less how it works XD

Please, can you tell me if HMAC signature is used on every packet in all the session or only at the beginning?

I've been reading this of course

HARDENING OPENVPN SECURITY
One of the often-repeated maxims of network security is that one should never place so much trust in a single security component that its failure causes a catastrophic security breach. OpenVPN provides several mechanisms to add additional security layers to hedge against such an outcome.

tls-auth

The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. It can protect against:

DoS attacks or port flooding on the OpenVPN UDP port.
Port scanning to determine which server UDP ports are in a listening state.
Buffer overflow vulnerabilities in the SSL/TLS implementation.
SSL/TLS handshake initiations from unauthorized machines (while such handshakes would ultimately fail to authenticate, tls-auth can cut them off at a much earlier point).
Using tls-auth requires that you generate a shared-secret key that is used in addition to the standard RSA certificate/key:

but it's not clear to me.
Is it referred only to the initial handshakes or every packet does it?
Considering the "auth" part impacts the cpu I'm inclined to think it goes on during all the session but when I read about the"handshakes" I'm confused...
Sorry for my stupid questions 🙂
Thank you!

TinCanTech

Netsurfer wrote Sorry for my stupid questions 🙂

These are not stupid questions and you are studying the documentation .. which is good 🙂

Netsurfer wrote
The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS.

but it's not clear to me.
Is it referred only to the initial handshakes or every packet does it?

In UDP mode, every packet has the HMAC signature. I am not 100% sure how TCP is effected.

I agree that the man page could be improved. We are always asking people to help 😉

300000

Your linksys have cpu 400mh too slow so not really expect run fast . You can buy very cheap raspberry and install openvpn client . It run faster than linksys router and can do everything