OpenVPN terrifically slow; < 1 Mbps

cookiecaper

Hello. I have an OpenVPN server on a 100Mb/s uplink. I have an OpenVPN client on 100Mb/s uplink. I am using Linux on both machines (server Ubuntu 11.10; client ArchLinux). When I connect through the VPN, I get very bad throughput, usually well under 1 Mbps. Latencies are very high; pings will take 500-2500ms to come through. SSH connections can usually function without much disruption but web browsing is basically impossible.

Here are some things I have tried:
* switch from udp to tcp
* fragment option (identical settings in both client and server configs)
* mssfix option
* tun-mtu option
* disable ciphers
* disable compression

None of these had an appreciable effect on the connection speed.

Here is the openvpn server log after I connect:

on May  7 18:27:17 2012 us=175843 Initialization Sequence Completed
Mon May  7 18:27:46 2012 us=88947 MULTI: multi_create_instance called
Mon May  7 18:27:46 2012 us=89207 xxx.xx.xxx.xxx:37746 Re-using SSL/TLS context
Mon May  7 18:27:46 2012 us=89380 xxx.xx.xxx.xxx:37746 LZO compression initialized
Mon May  7 18:27:46 2012 us=89926 xxx.xx.xxx.xxx:37746 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon May  7 18:27:46 2012 us=89965 xxx.xx.xxx.xxx:37746 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon May  7 18:27:46 2012 us=90092 xxx.xx.xxx.xxx:37746 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon May  7 18:27:46 2012 us=90122 xxx.xx.xxx.xxx:37746 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon May  7 18:27:46 2012 us=90179 xxx.xx.xxx.xxx:37746 Local Options hash (VER=V4): '530fdded'
Mon May  7 18:27:46 2012 us=90214 xxx.xx.xxx.xxx:37746 Expected Remote Options hash (VER=V4): '41690919'
Mon May  7 18:27:46 2012 us=90318 xxx.xx.xxx.xxx:37746 TLS: Initial packet from [AF_INET]xxx.xx.xxx.xxx:37746, sid=83625445 a266e351
Mon May  7 18:27:46 2012 us=766192 xxx.xx.xxx.xxx:37746 VERIFY OK: depth=1, /C=US/ST=UT/L=SaltLakeCity/O=Jeff-ZL/CN=Jeff-ZL_CA/emailAddress=me@mydomain.com
Mon May  7 18:27:46 2012 us=766788 xxx.xx.xxx.xxx:37746 VERIFY OK: depth=0, /C=US/ST=UT/L=SaltLakeCity/O=Jeff-ZL/CN=jeff-comp/emailAddress=me@mydomain.com
Mon May  7 18:27:46 2012 us=974178 xxx.xx.xxx.xxx:37746 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon May  7 18:27:46 2012 us=974261 xxx.xx.xxx.xxx:37746 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May  7 18:27:46 2012 us=974349 xxx.xx.xxx.xxx:37746 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon May  7 18:27:46 2012 us=974381 xxx.xx.xxx.xxx:37746 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May  7 18:27:47 2012 us=25191 xxx.xx.xxx.xxx:37746 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon May  7 18:27:47 2012 us=25261 xxx.xx.xxx.xxx:37746 [jeff-comp] Peer Connection Initiated with [AF_INET]xxx.xx.xxx.xxx:37746
Mon May  7 18:27:47 2012 us=25357 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: Learn: 172.17.17.10 -> jeff-comp/xxx.xx.xxx.xxx:37746
Mon May  7 18:27:47 2012 us=25392 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: primary virtual IP for jeff-comp/xxx.xx.xxx.xxx:37746: 172.17.17.10
Mon May  7 18:27:49 2012 us=49626 jeff-comp/xxx.xx.xxx.xxx:37746 PUSH: Received control message: 'PUSH_REQUEST'
Mon May  7 18:27:49 2012 us=49845 jeff-comp/xxx.xx.xxx.xxx:37746 SENT CONTROL [jeff-comp]: 'PUSH_REPLY,route 172.17.17.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 172.17.17.1,topology net30,ping 10,ping-restart 120,ifconfig 172.17.17.10 172.17.17.9' (status=1)
Mon May  7 18:27:49 2012 us=191681 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:27:50 2012 us=106540 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:27:55 2012 us=906742 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:28:12 2012 us=648428 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:28:12 2012 us=890207 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:28:13 2012 us=376643 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:28:14 2012 us=353030 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:28:16 2012 us=303208 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped
Mon May  7 18:28:18 2012 us=649093 jeff-comp/xxx.xx.xxx.xxx:37746 MULTI: bad source address from client [xxx.xx.xxx.xxx], packet dropped

As you can see I have the somewhat common problem of flooded "bad source address" lines. This is the only thing I have not yet tried to address thus far. I haven't sought to fix this because creating a ccd file for each client sounds like a lot of work and most people say that you can ignore these messages and that they don't cause a speed hit. If you say I have to, I will address this, but according to my reading I don't really have a use case that necessitates it (no private subnet needing access behind these clients, they aren't routers, just laptops...).

Here is my server config:

port 16345
proto udp
dev tun
ca ca.crt
cert zl-ovpn.crt
key zl-ovpn.key  # This file should be kept secret
dh dh1024.pem
server 172.17.17.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.17.17.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo yes
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 4 
mute 20

Here is my local config:

client
remote endpoint.example 16345
ca /home/jeff/vpn-keys/ca.crt
cert /home/jeff/vpn-keys/jeff-comp.crt
key /home/jeff/vpn-keys/jeff-comp.key
dev tun
comp-lzo yes
proto udp
nobind
auth-nocache
script-security 2
persist-key
persist-tun

Please help. I've looked through many threads on this forum and haven't found a good answer yet. :\

cookiecaper

I decided to try again and am now getting OK speeds with fragment, tun-mtu, and mssfix options.

Here's what I have at the end of my server.conf:

tun-mtu  1500
fragment 1415
mssfix 1410

With these settings I get about 35Mb down and 10Mb up.

However, I am on a 100Mb symmetrical line at the office. Does anyone have example OpenVPN configs that will let me push that whole line? I've disabled compression and I actually get crappier speeds with it off (maybe a fluke, didn't test a lot, but it does not appear that compression is slowing the connection down).

Any suggestions are welcome. Please help. 🙂

Thanks.

Mimiko

How fast are the processor? What is amount of RAM you have? What is the buffer lenght? What software are installed on computers which may use connection?