So i've had an openvpn server running on up-to-date Archlinux. It is my main local LAN server, primarily loaded up with hard drives (4TB total) as a fileserver but I was running openvpn on it as well so I could remote into my LAN & access files. It's fairly hefty of a machine, considering I built it as a gaming rig circa 2005. AMD Athlon 64x2 2.8GHz CPU, 6GB DDR2 RAM. To access files over the VPN I told samba to listen on the local VPN address of the server, in my case 10.11.12.1. I figured it would be probably better for security purposes to separate out the VPN server onto its own isolated machine, and was recently given a hand-me-down PC from a relative.
This new machine is a tiny slim form-factor relic from the early Vista days, and was one of those PCs that were supposedly "vista capable" lol. It's pretty weak; a dual core Intel T2060 processor at 1.6GHz. I looked it up and it appears that it's actually a mobile processor, which I can believe because the 1GB of RAM in it is actually SO-DIMM laptop-style RAM! Even with these specs though, I would figure it should run openvpn fine, particularly as this is ALL it is configured to do.
The setup's fairly simple; im using the TUN adapter and doling out addresses to clients in the 10.11.12.x range. I'm also pushing routes for the internal LAN subnet (172.16.16.x) out to clients and have added a static route on the LAN gateway sending 10.11.12.x packets to 172.16.16.4, which is the LAN IP of the new openvpn server. The setup seems to be technically working fine; I can access all machines/devices of the local LAN from any VPN client, and access to the main fileserver works OK. I've kept as much about the config the same from the old server to the new, including using AES encryption and a 2048-bit key length.
However, clients have seen speeds drop rather dramatically with this new machine. I currently have a Comcast residnetial connection with 50 megabits/sec down and 10 megabits/sec up. The old server would duly allow users to download/stream files at around that max upload (it was roughly 10 megabits, but sometimes would drop down to 8). With this new machine, the absolute max upload from the VPN to clients is around 1.5-2mbps. This has been tested at a friends house 3 blocks away on ethernet and a comcast connection. Ping latencies through the regular internet are 10ms due to the closeness, but even here speeds only topped out at 3mbps.
What gives? Why are things so slow with this new machine? Surely it's fast enough, or so I would assume especially since it openvpn is literally the only extra software installed on it. I have altered the port number and protocol (TCP vs UDP) as well as fiddled around with the fragment, mssfix and tun-mtu settings on the server and clients, all with zero improvement noticed. Below are the server config and a sample config from a client.
/etc/openvpn/server.conf
local 172.16.16.4
port 1194
proto udp
dev tun
tun-mtu 1428
fragment 1415
mssfix 1410
ca /etc/openvpn/ca.crt
cert /etc/openvpn/KS.crt
key /etc/openvpn/KS.key
dh /etc/openvpn/dh2048.pem
server 10.11.12.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.11.12.0 255.255.255.0
push "route 172.16.0.0 255.255.0.0"
push "route 192.168.68.0 255.255.255.0"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0
cipher AES-128-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 5
mute-replay-warnings
reneg-sec 10800
Client config (this one for my Win7 x64 laptop)
client
dev tun
tun-mtu 1428
fragment 1415
mssfix 1410
dev-node OPENVPN
remote 76.22.129.200
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "Z:\\keys\\pLAN9\\ca.crt"
cert "Z:\\keys\\pLAN9\\pLAN9-Mobile.crt"
key "Z:\\keys\\pLAN9\\pLAN9-Mobile.key"
ns-cert-type server
tls-auth "Z:\\keys\\pLAN9\\ta.key" 1
cipher AES-128-CBC
verb 4
