Dear Community!
I am facing a strange situation. Currently i use an OpenvzVPS as an openvpn gateway.
When i use rinetd to forward an Conection from Tunnel to an Server on the internet and push/pull data to it,
no matter if i use ftp/http/cifs, i easyly reach throughput 200Mbits - 250Mbits.
Iperf performs about 300Mbits easyly.
I also tried to connect the machines using ipv6, cause its aviable on both peers.
Also i tried a S5 and http proxy sitting on that vps an it performs about 250Mbits throughput.
For my config i used conclusions from this article: (which is a very great article btw)
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
When i use "redirect gateway", without rinetd the throughput drops to 30Mbits - 50Mbits no matter what i do.
At a normal pc i would use maquarading but as i read here in several posts this isnt possible on openvz?
The problem seems to be somewere between the iptables lines.
So has anyone an idea/hint on that?
Regards!
derdigge
Here is my config:
Server:
vpn_server.conf
port 28000
proto udp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
server 10.8.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 5 30
tun-mtu 17500
mssfix 0
fragment 0
cipher AES-256-CBC
auth SHA256
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
iptables-save:
# Generated by iptables-save v1.4.14 on Fri Dec 13 22:12:21 2013
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.2.0/24 -j SNAT --to-source $VPS_IP
COMMIT
# Completed on Fri Dec 13 22:12:21 2013
# Generated by iptables-save v1.4.14 on Fri Dec 13 22:12:21 2013
*mangle
:PREROUTING ACCEPT [1156:120189]
:INPUT ACCEPT [1144:119469]
:FORWARD ACCEPT [12:720]
:OUTPUT ACCEPT [1058:132466]
:POSTROUTING ACCEPT [1070:133186]
COMMIT
# Completed on Fri Dec 13 22:12:21 2013
# Generated by iptables-save v1.4.14 on Fri Dec 13 22:12:21 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3:376]
-A INPUT -p udp -m udp --dport 28000 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.2.0/24 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Fri Dec 13 22:12:21 2013
-------------------------------------------------------------------
client:
client
tls-client
dev tun10
proto udp
remote $VPS_IP 28000
resolv-retry infinite
nobind
pkcs12 /etc/openvpn/gk_e1.p12
verb 3
tun-mtu 17500
mssfix 0
fragment 0
cipher AES-256-CBC
auth SHA256
route -n
Kernel-IP-Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.2.5 128.0.0.0 UG 0 0 0 tun10
0.0.0.0 192.168.88.100 0.0.0.0 UG 0 0 0 eth0
10.8.2.1 10.8.2.5 255.255.255.255 UGH 0 0 0 tun10
10.8.2.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun10
$VPS_IP 192.168.88.100 255.255.255.255 UGH 0 0 0 eth0
128.0.0.0 10.8.2.5 128.0.0.0 UG 0 0 0 tun10
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
192.168.88.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
Thanks for reading till the end 🙂
