Hi,
I've been going through forums, mailing lists and tried many options to try and hunt this issue down. What I'm getting is a very widely fluctuating latency. I'm using a satellite connection with a 600ms ping time. For the test I disconnected everything else from the connection. The ping time pinging the VPN server on it's public IP does not fluctuate as such - always between 580ms and 680ms. I don't recall seeing the same issue on a lower latency connection. It's almost like OpenVPN is waiting for something, and then getting back to normal:
Where 10.8.0.1 is the VPN Server:
64 bytes from 10.8.0.1: icmp_req=245 ttl=64 time=608 ms
64 bytes from 10.8.0.1: icmp_req=246 ttl=64 time=658 ms
64 bytes from 10.8.0.1: icmp_req=247 ttl=64 time=1098 ms
64 bytes from 10.8.0.1: icmp_req=248 ttl=64 time=1491 ms
64 bytes from 10.8.0.1: icmp_req=249 ttl=64 time=2301 ms
64 bytes from 10.8.0.1: icmp_req=250 ttl=64 time=2869 ms
64 bytes from 10.8.0.1: icmp_req=251 ttl=64 time=3293 ms
64 bytes from 10.8.0.1: icmp_req=252 ttl=64 time=3663 ms
64 bytes from 10.8.0.1: icmp_req=253 ttl=64 time=3603 ms
64 bytes from 10.8.0.1: icmp_req=254 ttl=64 time=2915 ms
64 bytes from 10.8.0.1: icmp_req=255 ttl=64 time=2174 ms
64 bytes from 10.8.0.1: icmp_req=256 ttl=64 time=1914 ms
64 bytes from 10.8.0.1: icmp_req=257 ttl=64 time=1374 ms
64 bytes from 10.8.0.1: icmp_req=258 ttl=64 time=1434 ms
64 bytes from 10.8.0.1: icmp_req=259 ttl=64 time=1773 ms
64 bytes from 10.8.0.1: icmp_req=260 ttl=64 time=1745 ms
64 bytes from 10.8.0.1: icmp_req=261 ttl=64 time=2263 ms
64 bytes from 10.8.0.1: icmp_req=262 ttl=64 time=2924 ms
64 bytes from 10.8.0.1: icmp_req=263 ttl=64 time=3257 ms
64 bytes from 10.8.0.1: icmp_req=264 ttl=64 time=3376 ms
64 bytes from 10.8.0.1: icmp_req=265 ttl=64 time=2605 ms
64 bytes from 10.8.0.1: icmp_req=266 ttl=64 time=1638 ms
64 bytes from 10.8.0.1: icmp_req=267 ttl=64 time=1058 ms
64 bytes from 10.8.0.1: icmp_req=268 ttl=64 time=628 ms
64 bytes from 10.8.0.1: icmp_req=269 ttl=64 time=618 ms
This is running on a satellite connection with a minimum 650kbps up/down stream monitoring bandwidth with bmon and having no other applications using bandwidth. Sometimes the times above even hit 20000ms (20 full seconds).
What I tried doing:
1. Changing the port to something non-standard - in case the ISP deprioritizes it on that basis - no change
2. Put the no-replay option on both the client and server config.
3. Set auth none and cipher none
4. Did an MTU test with ping. The connection's MTU is 1470 bytes. Don't think this would apply - as the ping packets are far less than this. Put the MTU to 1400.
5. Enabled and disabled lzo compression
6. Tried setting the TOS packet to Minimize delay by using:
iptables -A OUTPUT -t mangle -p udp --dport 1181 -j TOS --set-tos Minimize-Delay
iptables -A INPUT -t mangle -p udp --sport 1181 -j TOS --set-tos Minimize-Delay
And running the inverse on the server to make sure that the packet goes out with the TOS set.
Where port 1181 was the port being used for the openvpn server. I've been running VOIP over OpenVPN - so as one can imagine this is causing complete chaos.
Server config right now:
port 34249
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
tun-mtu 1400
no-replay
passtos
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.72.0.1 255.255.255.252"
keepalive 2 120
cipher none
auth none
persist-key
persist-tun
persist-local-ip
persist-remote-ip
push "persist-key"
push "persist-tun"
status openvpn-status.log
verb 3
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf
client-cert-not-required
username-as-common-name
management localhost 7505
script-security 2
client-connect /etc/openvpn/client-connect.sh
client-disconnect /etc/openvpn/client-disconnect.sh
Client daemon:
/usr/sbin/openvpn.real --passtos --no-replay --cipher none --auth none --remote REMOTEIPOFSERVER --nobind --dev tun --proto udp --port 34249 --auth-nocache --syslog nm-openvpn --tun-mtu 1400 --script-security 2 --up /usr/lib/NetworkManager/nm-openvpn-service-openvpn-helper --up-restart --persist-key --persist-tun --management 127.0.0.1 1194 --management-query-passwords --route-noexec --ifconfig-noexec --client --auth-user-pass --ca /usr/share/paiwastoonstaffpack/vpnca.crt
Note: Using OpenVPN in Ubuntu I've replaced /usr/sbin/openvpn with a wrapper script to additional parameters.
Right now I am out of ideas on this. Help on where to go to nail the issue down would be much appreciated.
Thanks,
-Mike
