tomco
Hi!
I have two Debian Linux hosts running OpenVPN. Both are virtual machines hosted in ESXi 5.0 hypervisors. One is the OpenVPN server, the other one is the client. Each host has two network interfaces and acts as a router. One interface of each host is connected to the Internet, the other one is connected to a local network. The net 10.1.1.0/24 is behind the OpenVPN server, 10.1.2.0/24 is behind the client. Both nets are routed through the VPN. The server is hosted in a datacenter with 100MBit/s bandwidth, the OpenVPN client is connected via DSL with 3Mbit/s upstream.
The net behind the OpenVPN server contains some Linux and Windows Servers. They are accessed by RDP and SSH clients on the workstations, which are sitting behind the OpenVPN client in the 10.1.2.0/24 net.
So far everything is working fine. But as soon as somebody starts a large FTP transfer from a client in 10.1.2.0/24 through the tunnel to an FTP server in 10.1.1.0/24, the latency goes way up and it is impossible to work in the remote desktop and SSH sessions. While the transfer is running and the upstream of the DSL is more or less saturated, it is still possible to surf the web at normal speeds and the ping to hosts in the Internet is in the 20ms range. The ping through the tunnel is about 200ms at this time. Normal ping times through the tunnel, when no heavy traffic is flowing, is in the 20ms range, too.
So it seems that the DSL is very well capable of handling the outgoing traffic and there is a bottleneck in the tunnel. Hours of googling turned up nothing. Does anybody have any ideas which parameters to tweak to improve the latency in the tunnel under high traffic load?
best regards,
Tom
Here are the configs of the OpenVPN server and client:
# server config:
local x.x.x.x
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server 10.10.0.0 255.255.255.0
push "route 10.1.1.0 255.255.255.0"
route 10.1.2.0 255.255.255.0
keepalive 60 300
max-clients 25
user nobody
group nogroup
persist-key
persist-tun
# client config:
client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
ns-cert-type server
