[Resolved] Entire Network Slows when transferring over VPN

whynotkeithberg

Hello everyone,

I am new to OpenVPN Access server. We have a 10 user license. The VPN was already setup when I joined the company. However, before me they had no IT support so everything was setup by a developer. He actually did a pretty good job but there have been little issues I've had to fix. This one however, is really weird to me.

We all use the VPN every day because all of our servers are in a datacenter. I however, am the heaviest user as the sysadmin & I transfer large files across it often.

Since we've moved everything to the datacenter whenever I'm connected to the VPN & transferring large files across it the internet slows to a crawl for other users. I'm really confused as to why this is. I can't find any setting such as "use remote default gateway" or whatever the exact parameter is.

Any tips you can give or areas I should look would be really appreciated.

What settings should I post? Below is my as.conf. I've removed all certs/keys.

# OpenVPN AS 1.1 configuration file
#
# NOTE:  The ~ symbol used below expands to the directory that
# the configuration file is saved in

# remove for production
# DEBUG=false

# enable AS Connect functionality
AS_CONNECT=true

# temporary directory
tmp_dir=~/tmp

lic.dir=~/licenses

# run_start retries
run_start_retry.give_up=60
run_start_retry.resample=10

# enable client gateway
sa.show_c2s_routes=true

# certificates database
certs_db=sqlite:///~/db/certs.db

# user properties DB
user_prop_db=sqlite:///~/db/userprop.db

# configuration DB
config_db=sqlite:///~/db/config.db

# log DB
log_db=sqlite:///~/db/log.db

# wait this many seconds between failed retries
db_retry.interval=1

# how many retries to attempt before failing
db_retry.n_attempts=6

# On startup, wait up to n seconds for DB files to become
# available if they do not yet exist.  This is generally
# only useful on secondary nodes used for standby purposes.
# db_startup_wait=

# Node type: PRIMARY|SECONDARY.  Defaults to PRIMARY.
# node_type=

# bootstrap authentication via PAM -- allows
# admin to log into web UI before authentication
# system has been configured.  Configure PAM users
# allowed to access via the bootstrap auth mechanism.
boot_pam_service=openvpnas
boot_pam_users.0=openvpn


# System users that are allowed to access the server agent XML API.
# The user that the web server will run as should be in this list.
system_users_local.0=root
system_users_local.1=openvpn_as

# The user/group that the web server will run as
cs.user=openvpn_as
cs.group=openvpn_as

# socket directory
general.sock_dir=~/sock

# path to linux openvpn executable
# if undefined, find openvpn on the PATH
#general.openvpn_exe_path=

# source directory for OpenVPN Windows executable
# (Must have been built with MultiFileExtract)
sa.win_exe_dir=~/exe

# The company name will be shown in the UI
sa.company_name=OpenVPN Technologies, Inc.

# server agent socket
sa.sock=~/sock/sagent

# If enabled, automatically generate a client configuration
# when a client logs into the site and successfully authenticates
cs.auto_generate=true

# files for web server (PEM format)
cs.ca_bundle=~/web-ssl/ca.crt
cs.priv_key=~/web-ssl/server.key
cs.cert=~/web-ssl/server.crt

# web server will use three consecutive ports starting at this
# address, for use with the OpenVPN port share feature
cs.dynamic_port_base=870

# which service groups should be started during
# server agent initialization
sa.initial_run_groups.0=web_group
#sa.initial_run_groups.1=openvpn_group

# use this twisted reactor
sa.reactor=epoll

# The unit number of this particular AS configuration.
# Normally set to 0.  If you have multiple, independent AS instances
# running on the same machine, each should have a unique unit number.
sa.unit=0

# If true, open up web ports on the firewall using iptables
iptables.web=true

vpn.server.user=openvpn_as
vpn.server.group=openvpn_as

Here is my personal client.ovpn

# Automatically generated OpenVPN client config file
# Generated on Tue Jun 18 15:05:07 2013 by sr17-openvpn01
# Note: this config file contains inline private keys
#       and therefore should be kept confidential!
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=keith
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=keith@address
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=address:1194
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
# -----END CERTIFICATE-----
# -----BEGIN CERTIFICATE-----
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=0
# OVPN_ACCESS_SERVER_ORGANIZATION=OpenVPN Technologies, Inc.
setenv FORWARD_COMPATIBLE 1
client
server-poll-timeout 4
nobind
remote address 1194 udp
remote address 1194 udp
remote address 1194 tcp
remote address 1194 udp
remote address 1194 udp
remote address 1194 udp
remote address 1194 udp
remote address 1194 udp
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
auth-user-pass
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

<ca>
Removed
</ca>

<cert>
Removed
</cert>

<key>
Removed
</key>

key-direction 1
<tls-auth>
removed
-----END OpenVPN Static key V1-----
</tls-auth>

whynotkeithberg

Thank you. That should give me a bit to go over... Having trouble with DNS over VPN as well. But I am going to browse through everything you sent before bugging you all anymore.

I just found it really weird that our office internet would slow down for users when we have 1GB fiber & I'm transferring it externally to a datacenter at only 1MB/s. Our users DNS wasn't coming over the VPN & they aren't set to use remote gateway. Yet the second I cancel the transfer, the office internet speeds up again.

Thanks again & I will get back to this post if I can't figure something out.

whynotkeithberg

No, the VPN runs separately from our Firewall. The firewall just handles the routing to & from the VPN subnet.

I've been using SCP for transfers... Which I know wraps in a layer of encryption on top of the encryption from the VPN. However, what would this have to do with a user who is on the VPN, but accessing public sites such as yahoo. Once I cancel my transfer his internet speeds up.

I've already checked & no one has it set to use the remote default gateway. I even did traces & IP address checks. I did some checks over certain ports & it went via VPN, but the web traffic still showed the IP of our office. Not the IP of the datacenter which is where he would have been exiting from if exiting VPN.

I actually just built a new CentOS VM on which I"m going to do a brand new install of OpenVPN AS. I have almost zero experience with AS. From what I've seen it's great, but I prefer doing stuff through command line & text files. So, taking me a bit to figure everything out. The way the config files are for our current VPN server (which was setup by a developer before they hired me as their IT lead) are insanely confusing. Multiple files with very similar names & similar contents etc... Hard to figure out what i was doing. So I assumed maybe completely rebuilding would be better. Especially since I just added 3 more LAN's and will be adding a new DMZ as well.

THanks again! If you think of anything else I may find useful please let me know.

whynotkeithberg

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.