OpenVpn Peformance

dniasoff

Hi,

I have a few users using OpenVPN on a Broadcom MIPS router connecting to our head office.

They are on a fiber connection and their max speed when not using OpenVPN is around 30MB.

When OpenVPN is enabled this drops to around 15MB.

Here are some key lines from my config file

proto udp
key-direction 1
cipher none
auth none
no-iv
client
dev tun

When they were doing their speed test I was running "top" to see CPU usage and I noticed the following 2 processes hammering the CPU

PIDUSER STATUS RSS PPID %CPU %MEM COMMAND
6 admin SW 0 2 43.6 0.0 sirq-net-rx/0
2250 admin R 1900 1 37.9 3.1 openvpn

I cross compiled OpenVPN myself so can change compile time options.

Are their any config options/compile time options that can reduce CPU usage and improve throughput.

Thanks

Daniel

janjust

a perf hit of a factor of 2 on a Broadcom MIPS router does not surprise me - remember that this router runs @ ~ 250 MHz so it will not be able to handle openvpn traffic at more than roughly CLOCKSPEED / 2 Mbps.

The Johan

You may find this information useful:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux

Although of course if you start tampering with the encryption keys, the security may be lower.

Oh, and 250MHz is not a very 'hot' system for encryption/decryption of a stream of data. Consider replacing it with a simple dual-atom machine. (2x1.8GHz or so)

dniasoff

Thanks for 2 very useful responses

I am looking for a cheap device with an ADSL modem built in.

I can use a more powerful router like http://www.buffalo-technology.com/en/airstation-trade-nfiniti-trade-dual-band-wireless-n-gigabit-router-access-point.html
which has an Atheros AR7161@680MHz processor and I guess this should triple the throughput?

I am getting 28MB on a http://wiki.openwrt.org/toh/tp-link/tl-mr3420 which has an Atheros AR7241@400MHz CPU with a similar config and I can see CPU maxing out at this speed.

I shouldn't be doing encryption (i have configured -- cipher none) so all OpenVpn is doing is encapsulation.

I am going to try --fragment 0 --mssfix 0 --cipher none --auth none and report back.

Thanks

Daniel