I setup Openvpn for five different locations about three months ago. At the moment, I am the only one using the VPN at three of the locations. At the other two locations, only one person at each location is using the VPN on the odd occasion. So effectively speaking, only one person is using the VPN.
At four of the clients connecting to the network and then using remote desktop to logon to the servers, I have no issues with speed. At the fifth location there is slight refresh delay when viewing larger files. I put this down to the fact that the Internet upload speed at that location is only 1Mb. We are getting the broadband speed at that location addressed.
Because I have been mainly connecting to the servers over VPN using remote desktop, I haven't really had any issues with speed. I also use Putty quite a lot to change settings on the Linux box which handles OpenVpn, Internet filtering etc! Again no issues with Putty, but then its all text based, there should be no issues with putty.
However I have recently been copying files across from my computer to the servers and I have noticed that I was errrors saying that the location xyz could no longer be found. Doing research indicated that SMB is very sensitive to latency which is a problem with WANS
It was recommended to disabled network autotuning
"netsh interface tcp set global autotuning=disabled"
which I have done and this seems to have fixed the problem.
So Question one: Does disabling the autotuning cause any problems such as the remote laptop connecting to their Internet provider in terms of losing speed etc. Disabling autotuning as I understands it limits the MTU to a lower speed which means that if you have fast broadband, you are effectively hurting your online speed. At least that was the explanation for why its not a good idea to disable the autotuning.
Question two: I just came across another setting called "--tun-mtu" does this not serve the same purpose as autotuning in that it disables autotuning (but only for the VPN) and limits the MTU to whatever speed that you specify in the config files?
Question three. This setting "mssfix 1400" - if I have understood what I have been reading correctly - this only applies if you are using TCP, not UDP as the protocol - Is this correct?
To continue my real life scenario, I continued to test out connecting to windows shares at the different locations and opening small and large files at each location. I noticed the following. When uploading a 90Mb file to one server, it was doing about 600kb/sec and took about two and a half minutes. When downloading the same file from the server onto my computer, it was 1Mb/sec speed and took 1 minute 30 seconds. I believe that this is based on my broadband upload speed being 5Mb and the remote server's broadband upload speed being closer to 20Mb.
I then used pscp to copy the same file to the linux server and down again and the speeds were 230Kb speed and over 7 minutes for uploading and bizarrely enough an identical speed for download from server to my computer. Which surprised me as I expected the PSCP to be quicker than the windows SMB transfer. why is PSCP so much slower on the upload and identical on the download?
Which raised question four? How do I determine what is limiting the speed, my broadband or my VPN. And it raised the question what speeds I should be seeing for my broadband if my upload speed is 5Mb and my download is supposedly 30Mb and the remote server has a broadband upload speed of 20Mb and download of 65Mb?
Question five. I came across this website
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
and it looks very interesting, but I am not sure that raising the MTU so high is correct on a WAN, especially as the article states that this would work best on a LAN environment. But what their article did highlight is that by changing the MTU they seem to be able to change the speed of the bandwidth tremendously. I don't have this Iperf that the article keeps referring to and I am not sure if that is what I need to test out my speeds. What I did do was run this command that the article suggested
" openssl speed -evp aes-256-cbc" as I am using cipher AES-256-CBC encryption and I was quite pleased to see that I was getting circa 430Mb or 430Kb (not sure if thats Mb or Kb) for each reply that came back. which was similar to what they got after their tweaks. But I don't know what the openssl speed is all about - so I don't know if its good or bad!
Moving on with my scenario, I noticed that the last location with the 1Mb upload and 14Mb download broadband speed , the speeds were very different. Uploading for the windows share is about the same time and speed but the pscp was even slower as it took over 9 minutes 30 seconds and the speed dropped to 160kb in the end and time so this is obviously my broadband upload and the remote server download speeds which is the limiting factor I presume. Downloading the test file took well over 10 minutes and the speed was 132Kb. I didn't even bother with testing the pscp download.
Lastly I took a 5mb PDF file and attempted to open the file through the windows share on the first server with fast broadband and the last server with the slow broadband. With the first server, the file opened up almost instantaneous, but the slow broadband server (with 1Mb upload speed), it took about 50 seconds to open the file which is approxiamately the same time to actually download the file. If I connected to the server via RDP, opening the file is practically instantaneous. Therefore it is clear that I need to find a way to open the files more quickly as remote desktop is not an option for the end users as we don't want them logging onto the server!
Therefore its obvious that the broadband upload and download speeds on both ends have a definite effect. The question is what could be changed in Openvpn to reduce the impact of low bandwidth? Hence question five above and moving onto question six
Question six: Some people have recommend adding this setting: "net.inet.ip.fastforwarding = 1" but if I have understood this correctly, this will not fix my issue with smb requiring that network tuning be disabled, nor will it have any effect on file transfers as I am not forwarding packets on outside the network as in the case mentioned in this article
https://forums.openvpn.net/topic9934.html#p21446 as their issue was to do with getting the Internet to work properly through the Openvpn. Also this seems to be a pfsense fix only. I am using a basic slackware build that has openvpn, dansguardian and squid installed.
Question seven: Will installing Wins really have much of an effect on file transfer and opening 5mb files bearing in mind what broadband speeds I am talking about here.
At this precise point, my main questions really are:
What can I do to improve file transfer and opening files at the location where the broadband is slow
Secondly, what speeds should I be getting based on the broadband speeds I have given
I am not really looking for answers like - do this, do that as I want to understand how to investigate these sort of things. I am not the kind of person that justs wants the answer. I want to learn how to optimise the VPN by understanding how all the above works.
If you have any questions about the setup, please let me know and I will try and answer the questions.
Thank you for any advice
Robert
