essele
Hi,
I have an OpenVPN setup running and am seeing some strange behaviour with a UDP based config. A TCP based config works perfectly, but performance is relatively poor compared with UDP.
If I switch to UDP everything is great to start with, performance is brilliant.
Then after a period of time, usually somewhere around 10 minutes or so ... it could be traffic related, but I don't think so ... things start to fall apart ... it looks like lots of packets dropping ... pings drop to about 50% success and it's virtually impossible to get a TCP connection to run (I'm using scp as a test, and it just stalls.)
There are no clues in the logs, even if I go up to "verb 6" ... as far as it's concerned everything seems ok, and the occasional ping will go through, so the link is still functioning in a way.
My guess is that my ISP (well known for censorship) is doing some kind of bandwidth shaping on the connection and causing lots of UDP drops, but the strange thing is that if I stop and restart the connection everything is fine again (for a while.)
I've also opened the firewall incoming for the VPN to eliminate issues there, although I do have the keepalive running.
I'm using OpenVPN 2.2.2 on OpenWRT on one end, and 2.2.1 on Fedora on the other end.
Does anyone have any ideas where I could look to diagnose this? The only idea I have now is to write a UDP client/server app to simulate a link and monitor drops ... but that's a bit painful.
Any help appreciated,
Lee.
essele
OK ... some more information.
I put together a script that sends UDP packets at given time intervals, for the moment using 10ms, and 1000 byte packets.
If I send this over the ISP normal link, I only get about 1% of them through ... as I reduce the speed or the size then more of them make it.
If I send them over an established TCP based OpenVPN (over the same ISP link) then I don't get any drops at all.
In the dropping case, if I tcpdump the ppp link I can see all of the packets going out but not getting to the end point, which adds weight to the theory that the ISP is traffic shaping. I've tried a range of ports and they all behave the same way.
Now all of that would be fine, however each time I establish a UDP based OpenVPN link it's fine for a while, even doing large transfers ... but this doesn't fit the situation above ... I get drops pretty much right from the start, yet I can get at least 5 minutes of great performance over the VPN before it starts to fail.
Any ideas?
Thanks,
Lee.
