Too many concurrent connections make the openvpn suspended

[deleted]

Hi , I have a openvpn server hosting one thousand clients , but when the connections rush in , the openvpn instance seemed suspended , when telnet the tcp port 1194 (telnet 127.0.0.1 1194 ) , there is no response immediately

and the server instance is not down ,when try telneting at another time ,it will response.

the server box seems ok , but there are some logs below:

write TCPv4_SERVER: Broken pipe (code=32)

do you have any idea about the issues? thanks!

JoshC

cosmo wroteHi , I have a openvpn server hosting one thousand clients , but when the connections rush in , the openvpn instance seemed suspended

A TLS handshake is very CPU-taxing on the server, so when connections "rush in" as you describe, it's basically a temporary dDoS on your server, even if you intended for the connections to be made.

I'd suggest using your firewall to rate-limit the number of new connections you allow per second to a low enough value that it doesn't cripple your server; just be sure to properly configure it so already-established sessions continue to pass through. Some connections will be dropped briefly when this flood-protection kicks in, but it's clearly better than the alternative.

Also note that if that many clients connect at once, a time-based session re-key (see --reneg-sec, set to 3600 by default) will cause that load of clients to re-key at the same time again next renegotiation. Rate-limiting spreads this load out. Optionally you can explicitly set --reneg-sec to 0 and enable the use of --reneg-bytes, or include a random-offset to reduce the --reneg-sec value that you push to clients (such as in a --client-connect script) to avoid this.

[deleted]

JoshC wrote
cosmo wroteHi , I have a openvpn server hosting one thousand clients , but when the connections rush in , the openvpn instance seemed suspended
A TLS handshake is very CPU-taxing on the server, so when connections "rush in" as you describe, it's basically a temporary dDoS on your server, even if you intended for the connections to be made.

I'd suggest using your firewall to rate-limit the number of new connections you allow per second to a low enough value that it doesn't cripple your server; just be sure to properly configure it so already-established sessions continue to pass through. Some connections will be dropped briefly when this flood-protection kicks in, but it's clearly better than the alternative.

Also note that if that many clients connect at once, a time-based session re-key (see --reneg-sec, set to 3600 by default) will cause that load of clients to re-key at the same time again next renegotiation. Rate-limiting spreads this load out. Optionally you can explicitly set --reneg-sec to 0 and enable the use of --reneg-bytes, or include a random-offset to reduce the --reneg-sec value that you push to clients (such as in a --client-connect script) to avoid this.

Thank you very much for your advices ! but my server is capable of handling too many connections at the same time. I have make some tunings in my OpenBSD box,but when I test about 500 concurrent connecttion , it also prompted the error . any tunings for OpenVPN Server can make the concurrent connections work? Thanks!

Thanks!