If installing Wireguard as your VPN is a possibility, Install Opnsense + Wireguard on old hardware and forget about AES.