How Fast Is An OpenVPN Server on A Raspberry Pi And A Banana Pi?

I've been running an OpenVPN server at home to protect my data traffic for quite some years now, first on an WRT54 Wi-Fi Router and later on a Raspberry Pi thanks to a great article over on ReadWrite. The solution I had so far has been limited to a maximum throughput of 5 Mbit/s as that was the uplink speed of my VDSL line at home. As we have a fiber FTTH line in Paris now with a maximum speed of 264 Mbit/s in the downlink direction and 48 Mbit/s in the uplink direction it was time to relocate my VPN service to that location to lift the 5 Mbit/s limit. It was really time for that as I easily surpass such speeds today while connected via UMTS and LTE. But it turns out the next road block is just around the corner.

And that next road block is the Raspberry Pi. Encryption and Decryption data must be quite computing intensive so the Raspberry Pi's processor is fully loaded at an encrypted line rate of around 10 Mbit/s. Twice as much as I had before but still far from what the fiber line offers. So I decided to move to a Banana Pi with it's much stronger processor. At around €40 without casing it only costs 10 euros more than a Raspberry Pi. And as it turns out the processor can shuffle encrypted OpenVPN data through the Ethernet Interface at a rate of 30 Mbit/s. Not quite the line rate of the FTTH connection but it's not too bad either and to go further I would have to put an Intel NUC or other high power CPU device in place which would cost much more. So the price / value balance of the Banana Pi seems quite right to me, at least for now.

Next on my list of things to do is to make the Banana Pi work as a OpenVPN Client Gateway and Wi-Fi Access Point. I use a Raspberry Pi today today to bundle the data traffic of all my devices while I'm traveling through a single VPN tunnel to my VPN Gateway which is, not surprisingly, also limited to 10 Mbit/s. All the scripts for configuring a Raspberry Pi are on GitHub but I'm running Ubuntu on the BananaPi so some of the things need to be tweaked.

 

October 2014: Three Networks Left In Germany

A little note today so I can search more easily for it in the future that October 2014 was the month when the EU sanctioned merger of Telefonica O2 Germany and KPN's E-Plus was finalized from a contractual point of view. While the networks of the formerly two independent companies are still separate, this effectively reduces the competition from 4 mobile network infrastructures to 3 once O2 starts integrating the two separate networks.

Yes, the EU has put some conditions in place to 'ensure' (in their opinion) continued competition. I doubt, however, that even the most important one in the form of putting a capacity reseller in place for a certain percentage of the united O2 and E-Plus will do much in this regard. The business practices of the company that got the contract in the past has, well lets says, been somewhat unusual and even apart from that, it still doesn't make up for the fact that infrastructure competition is seriously hampered by this move.

So no, I'm not happy about this decision at all and I really hope that I will be proven wrong. But it's only hope as up to today, there aren't too many examples in Europe, if any, where competition with three incumbent network infrastructures in a country have led to a healthy price level and adequate coverage.

So let's see how the mobile landscape will look like in Germany 2 years and 5 years down the road from now.

My First Prepaid LTE Experience

It's taken a long time and still today, at least in Germany, most network operators reserve their LTE networks for their postpaid customers. In recent months, this has somewhat changed in Germany with the fourth network operator also starting LTE operations and allowing their prepaid customers access from day one. These days their LTE network is also available in Cologne so I had to take a closer look, of course with a prepaid SIM and a €2 per 24 hours data option that gave me up to 1 GB of unthrottled data.

Data rates I could achieve were not stellar but not really bad either. Under very good signal conditions I got close to 30 Mbit/s in the downlink direction and about 10 Mbit/s in the uplink direction. Closer examination revealed that they are using a 10 MHz carrier in the 1800 MHz band which should allow, under very ideal conditions up to 75 Mibt/s in the downlink direction (have a look here if you'd like to know how you can find out which band and bandwidth your LTE network operators is using). But no matter what I did and where I went in the city, the 30 Mbit/s was the magical limit. I don't think the air interface is the limit, the bottleneck must be somewhere else. Under other circumstances I would probably be ecstatic about such speeds but with data rates of 100 Mbit/s+ other operators achieve easily, the 30 Mbit/s pale in comparison.

In a recent network test I reported on, CS-Fallback Voice Call establishment times of that network operator were reported to be pretty bad. I can't confirm this, however, so perhaps they have changed something in their network in the meantime. What's a bit unfortunate, however, is that after a voice call the mobile stays in 2G or 3G a long time before returning to LTE. Other network operators are more advanced and redirect their mobiles back to LTE after the call. That makes for a much better experience. Also, I noticed that there's a 2-3 seconds interruption in the data traffic while switching from UMTS and LTE. That means that they must still be using a rather crude LTE Release with Redirect to UMTS procedure rather than a much smoother PS handover.

While the above is perhaps still excusable, there's one thing they should have a look at quickly: Whenever the mobile switches from 2G or 3G back to LTE the PDP context is lost. In other words, I always get a new IP address when that happens which kills, for example, my VPN tunnel every time it happens. Quite nasty and that's definitely a network bug. Please fix!

In summary the network speed is not stellar compared to what others offer today and some quirks in the network still have to be fixed. On the other hand, however, you can pick up a prepaid SIM in a supermarket and get LTE connectivity without a contract.

Affordable Global Internet Access Roaming Becoming A Reality

Accessing the Internet from a mobile phone or tethering a PC over it while traveling all over the world has been possible for many years. Unfortunately, it was also prohibitively expensive. A solution to the problem was to use local SIM cards but getting them has and still often is a hassle. 2014, however, will have been the year when all that has changed, at least for some of us, fortunately including me. And here's why:

New in 2014: EU Data Roaming For A Few Euros A Month

Earlier this year I reported about the new Euro-Roaming offer of my network operator that lets me use my data bucket that is included in my monthly subscription in all EU countries without any extra charges for 5 Euros extra per month. One price for all countries. Perfect, my Internet access problem is solved, and I no longer need local SIM cards except in really exceptional circumstances.

New in 2014: Global Roaming Prices Reach Affordable Levels

But the EU isn't the world and I also travel a lot to Asia and the US. Again, new roaming prices of my home network operator for global destinations completely changes the game. Instead of 20 euros a day for only a few megabytes, the latest offer for any destination is around 12 Euros per week for a 150 MB bucket. If the data is used up sooner, another bucket can be bought instantly via a landing page. 150 MB is not much by today's standards and I had to buy several packages during a recent trip to China to keep me connected, but compared to previous prices this is heaven and totally usable.

New in 2014: Fast Networks And LTE Roaming

When I visited countries such as China in previous years I always noticed how slow even 3G connectivity was. While it could have been the local network I suspect that connectivity between the visited network and my home network was rather underdesigned. Again, when I was recently in China, 3G connectivity was fast and totally usable. I'm delighted! Also, 2014 is the year when LTE roaming agreements finally started to fall in place. Over the past months I've roamed on foreign LTE networks in quite a number of countries and I've achieved data rates of well of 20 Mbit/s. Not that 3G networks are slow but seeing that LTE indicator in the status bar is still something special and promises fast data rates.

New in 2014: Viginti Band LTE Phones That Also Include 5-6 UMTS Bands

While LTE roaming in Europe for European customers is not a problem from a mobile device point of view, getting LTE connectivity in other parts of the world has been another matter altogether so far as North America and China use different UMTS and LTE bands. 5-6 band UMTS and LTE devices have been available for a while in Europe but these unfortunately did not include bands for other regions. But again, things have changed dramatically for the better. One popular smartphone now boasts support of 20 (!) LTE bands and 6 UMTS bands. This includes all major LTE and UMTS bands used in Europe, North America and even the TD-LTE bands used in China. That's especially good news for global travelers no matter where they come from because true Global UMTS and LTE roaming has now become a reality. I'm more than delighted!

I've been using mobile Internet access while traveling for pretty much a decade now. 2014, however, has brought about an as dramatic a change of my usage behavior as the introduction of local prepaid SIM cards for mobile Internet access had many years ago.

Will Fiber To The Home Become The New Monopoly?

Those who have gigabit Internet speeds at home thanks to a 'fiber to the home' (FTTH) connection are probably more than happy with their Internet access. I benchmarked such a connection recently and I guess I'd be more than happy as well to have such a line at my home in Cologne. Given some time, perhaps…But I can't help thinking that once a fiber cable is laid into the streets and houses by a network operator, it effectively creates a (next generation) monopoly, as no other network operator will have an incentive to put a fiber into the same ground as well. So the monopoly moves from copper to fiber as once users have become accustomed to fiber access they are unlikely to go back to something that is significantly slower. Again, the only competition could come from cable operators who also have fiber cables close to buildings today and can thus extend fiber connectivity from there to individual buildings. Hm, sounds like operator monopoly 2.0!?

Android’s Password For Encryption Can Be Different From The Screen Unlock PIN

I can't remember when I first read about Android's ability to encrypt the user data partition. What I did remember however was, that the article said that the PIN used for unlocking the screen is also used during system startup to unlock the encrypted partition. I was pretty disappointed at the time because a four or five digit screen unlock PIN can easily be cracked in an offline attack so I never really bothered to give encryption a try. But is this really the case?

A Long Password For Encryption And A Short PIN for Unlocking The Screen

As I couldn't find the definite answer on the web I tried out myself with a device running CyanogenMod 11 (Android 4.4.4). And indeed, to start the encryption process a screen unlock PIN has to be set which is then also used to unlock the encrypted drive during system startup. But, and this is the good part now, the password to unlock the encryption key during system startup can be changed afterward to a password of a much longer length independent of the screen unlock PIN. In other words, it's possible to use use a long and strong password during system startup and a reasonably short and different screen unlock PIN. Perfect!

CyanogenMod Update Trouble

As far as CyanogenMod is concerned, however, there's a little catch: The automatic updater doesn't work anymore as the downloaded image is put into the user's encrypted data directory. Unfortunately, the CWM (ClockWorkMod) recovery manager used by CyanogenMod for many devices doesn't support encrypted user data partitions. The only way to update the system image on such devices if they are encrypted is to push the image from a PC via ADB to a temporary partition after the device has been booted to recovery mode. Here's a description of how that works. It's not difficult to do but not very convenient either.

More Details on Encryption

And for some more background information on how Android encryption works, have a look here.

Chip 2014 Cellular Network Test Germany: 126 Mbit/s Peak!

Every year there are two very interesting network tests published in German IT magazines. Chip has just published its result a couple of days ago and you can read the very detailed report in German here or in English, with the help of Google translate here. Again, the results are amazing and here are a couple of key numbers:

  • Fastest average speed measured over 30 seconds in one of the LTE networks: 126 Mbit/s
  • Average UMTS and LTE speed nationwide over the whole test period: between 37 Mbit/s (cities) to 25 Mbit/s (rural areas).
  • Upload speeds > 2 Mbit/s on average of the best network: 84.5%
  • LTE network coverage along the nation wide test route: 75%
  • Success rate of watching Youtube videos without interruption: 94%
  • Voice call drop rate of the best network in sparsely populated areas: 1.84%

The "Connect" test is up next and will also be interesting, especially because the magazine compares the networks in Germany, Austria and Switzerland with each other.

If you know of similar tests for other countries that were published recently I'd be great if you could leave a comment.

October 3rd – GSM In The Commotion of German Unity in 1990

On this day back in 1990 the two Germanys became one country again and thanks to this we have a public holiday in Germany today. While this happened a long time ago I still remember it well and it's a good opportunity to tell a story of how the telecommunication world looked like back then.

It must have been an interesting time back then if you already worked in this business, as the licenses for the two GSM networks to open a couple of years later (in 1992) were awarded on the 8th December 1989. That is, they were awarded in the Federal Republic of Germany, i.e. in the West, but not in East Germany and that date is only a few weeks after the wall between East and West fell. So what happend between East and West in terms of mobile networks up to re-unification just a few months later? I remember that I read something about this a couple of years ago in the "Die D2 Story", a great book  by Susanne Päch. The story, which only fills a couple of pages in the book goes like this in my own words:

Back then the telecommunication landscape was quite different to what we all take for granted today. Only few people had a wireless phone (I'm trying to avoid the word 'mobile') and GSM was still being developed. In fact there was only one analog network at the time, the C-Netz, operated by the state owned incumbent telephone network operator, the German Postal Service ("Deutsche Bundespost"). After the wall fell, so the story in the book goes, the network was especially challenged in Berlin as the fixed line network in East Berlin was little developed compared to the western counterpart and there were only few interconnect links between the two parts of the city. So lots of businesses and the press began using C-Netz wireless phones in the East and thus quickly filled up the available channels. Things got so bad, the story continues, that many companies feared not getting a line when they needed one so they left the connection open all day long, which obviously only increased the issue. According to the book, the network operator got concerned and started interrupting connections after 10 minutes to free up air interface capacity.

During the course of 1990 the C-Net started to expand into East Germany as a postal union between East and West was set up pretty quickly after the wall fell and thus allowed the West German postal service to expand it's network into the East as there was no way to increase capacity in the East German fixed line network to cope with the demand of making phone calls to the West. You can safely assume, though, that at the prices for devices at the time well above and beyond 1.000 Euros, the network was not used by ordinary people but mostly for business people and politicians shuttling back and forth between East and West.

And then there was the big question of who is going to build out the GSM networks in the East. As said above, West Germany awarded one license to its incumbent network operator and another one was awarded in a contest to Mannesmann D2 (taken over by Vodafone a couple of years later). But that was only for West Germany. Due to the postal union, the incumbent was all set for expanding the scope of the network build out to the East. But what about Mannesmann? After all, before October 3rd, East and West were still two independent states and just extending a license that was awarded in one country to another was hardly possible just like that. Also, the 900 MHz frequency block assigned to GSM was used by the Warshaw pact military in East Germany. A tricky situation and for a while, the East German postal ministry played with the thought of starting a bidding process for a GSM license on its territory before unification was achieved. And there were lots of companies interested as it was seen as a money printing license. But Mannesmann cleverly argued, according to the book, that since the postal service as the incumbent could build a single network in the East and the West, the same must also be applied to the private competition to avoid being disadvantaged. So in the end, the West Germans seem to have put a lot of pressure on their East German counterparts and Mannesmann also got to build out the Eastern part of the re-united German with GSM. And to fix things with the military, some money seems to have changed hands.

And that's the story of GSM and German reunification! For the details I can only recommend reading Susanne Päch's book. It's long out of print as it was published in 1994 but can still be found at used book dealers. One final thought: All the German companies mentioned in the book that were so important then no longer exist or have exited the business. The incumbent, Deutsche Bundespost, has become Deutsche Telekom today, Mannesmann D2 has become Vodafone, Siemens exited the mobile business many years ago, Bosch did so even sooner and I'm sure only few Germans can still remember a company called PKI. Today, the dominant players in the business have quite different names. Well, at least Nokia and Ericsson still exist.

Oktoberfest Network Number Crunching

TheresienwieseIt's October again and Munich's Oktoberfest is in full swing. In the tents, 100.000 seats are available to celebrate and mobile networks are challenged by the number of devices per square meter. They seem to hold out quite well though according to these interesting reports (in German, sorry) by Teltarif. But how much of a challenge is the Oktoberfest really to the networks? Let's play a bit with the numbers!

If there are 100.000 seats available in the tents then let's say that at any point in time there are around 150.000 people present, inside and outside of the tents. According to Wikipedia, the Theresienwiese on which the Oktoberfest is celebrated has 31 ha, which is roughly 500 x 500 m. I've put a map on the left to give you an idea of the location's size. 150.000 people packs a place this size quite tightly. If you have a look at the pictures from people taken at the Oktoberfest or on Wikipedia it's obvious the number is not overstated.

The next number that's available from this report is that one of the four network operators has put up 8 additional cell sites for the event and I assume the other network operators have put up similar numbers and the same or different sites. Let's say there are two sectors on each site as some of them must be at the border of the event area and hence the third sector pointing outwards doesn't carry as much traffic. GSM, UMTS and LTE are up and running but GSM doesn't carry a lot of data so I'll leave it out of the game.

Let's say out of those 150.000 people, 100.000 use a smartphone and do so heavily. Tweeting, texting, sending WhatsApp messages, pictures, Facebook, etc. etc. should drive uplink traffic well beyond the normal uplink/downlink ratio. After all, you need to show your friends where you are by sending pictures and they probably interact with you heavily so phones are unlikely to stay in pockets for long. So let's say the mobiles of those 100.000 people are connected to the network once every 3 minutes and stay connected for around 20 seconds. That means that each mobile device is online 60 times per hour for a total of 7 minutes every hour. 60 times an hour is perhaps a bit on the high side for an average, but let's be pessimistic.

Now, let's divide the 100.000 users by 4 network operators so each serves around 25.000 customers. There are 8 cell sites with two sectors each so 25.000 / 16 means each sector of each network operator serves 1562 devices. Each device is on air for 7 minutes per hour which means 208 mobile devices are on the air in each sector of each operator simultaneously. Sounds like quite a lot and if there was only UMTS, it would probably have a hard time, even if each network operator had deployed two carriers. But LTE cells can quite cope with such a number of simultaneous devices. And if the maximum capacity is reached it's possible to deploy extra LTE carriers, e.g. a 2600 MHz low power signal to catch the devices close to the cell and a somewhat higher power 1800 MHz signal to serve devices further away. Add UMTS to the overall mix and I would say there's still a healthy margin to work with.

Obviously the numbers I've used above are only assumptions and could be off by quite a bit. If you have more precise numbers please let me know, I'm happy to adapt my calculations.

Benchmarking That 1 Gbit/s FTTH Connection

When I moved to Cologne 5 years ago I upgraded from a 6 Mbit/s down – 384 kbit/s up ADSL line to a 25 Mbit/s down – 5 Mbit/s VDSL line and it felt really fast. It still does, well, sort of. That's because I could recently benchmark a 1 Gbit/s Fiber to the Home (FTTH) line in France and the results are nothing short of breathtaking.

When benchmarking such a connection it's necessary to have a server on the other end that can actually deliver such high speeds, a transit/peering connection of the fiber operator that is broad enough and a device at home that can handle data at such a high speed as well. As I couldn't go and benchmark that fiber link in person, I prepared a Banana Pi to be my remote test laboratory. A Raspberry Pi would not have done as it 'only' has a 100 Mbit/s Ethernet port and the processor can handle data transfer speeds of about 30 Mbit/s. The Banana Pi on the other hand has a Gbit Ethernet port and when I tested data transfers to and from a local server before shipping it to France I could reach speeds of 80 MB/s, i.e. 640 Mbit/s. That's not the full gigabit/s the Ethernet port is capable of but to get a feeling for the fiber line it's a good start.

Downlink-benchmarkTo access the Banana Pi remotely I prepared it to automatically establish an SSH TCP port forwarding connection to my virtual server on th net with a public IP address. Via this little detour I could connect back to the Banana Pi despite it being behind a NAT. To test up- and download speeds I used CURL and http up- and downloads. The results are breathtaking. In the downlink direction I could reach speeds average speeds of 33 MByte/s, that's around 264 Mbit/s. A "small" 160 MB Linux distribution downloads in 6 seconds and is more than 10 times the speed of my VDSL line at home… In the uplink direction I could reach speeds of around 6 MByte/s, i.e. 48 Mbit/s which is also 10 times more than what my VDSL line can do. I ran the tests at 10 in the morning, in the evening during the busiest hours and also at 4 o'clock in the morning and always got the same results.

So which part is the bottleneck, the fiber line, the peering/transit link or the server on the other end? To find that out I ran two downloads simultaneously from two different servers, one connected to the French network via Level 3 and another one that was connected via the German Internet Exchange (DECIX). With this setup I got an aggregated 33 MByte/s. This means that the fiber link into the home was the limiting factor as otherwise I would have seen a higher aggregated speed.

It's pretty amazing what a fiber line directly to the home can do today and it also shows quite clearly that the copper cable to homes won't be able to compete for much longer in areas where fiber gets deployed.