Hi,
I'm trying to get a TCP based OpenVPN up and running (I'm restricted to TCP because my ISP severely shapes small UDP packets.)
It all comes up and works fine, but the performance is really poor. I'm using scp of a fixed size file as a rough benchmark, and I get the following:
1. No VPN ... ~2.1MB/s
2. tinc (tcp) ... ~ 1.6MB/s
3. vtun (tcp) ... ~ 1.6MB/s
4. OpenVPN (tcp) ... ~ 400kB/s
The link has a latency of about 125ms, and it's PPPoE to the ISP, so there's an outgoing interface MTU of 1492. I've been pulling my hair out messing with mtu's, mss's and everything else trying to get this to work.
I did suspect my ISP of specifically targeting OpenVPN traffic, but I've tried on different ports, and also even ran it over the top of tinc to test this theory and still saw poor performance. I'm convinced it's some kind of TCP window/ack issue, but I've really hit a brick wall in terms of options, and I'm confused as to why all the other vpn's I tried have so much better performance.
I've run this from an OpenWRT router, a MikroTik device and now I've just tested on a separate fresh linux install with exactly the same behaviour.
I don't believe that there's a problem with OpenVPN that would cause such a major difference in performance, so it must be something I am doing (or not doing.)
Any help or ideas would be greatly appreciated. My configs are below.
Server Config:
proto tcp-server
port 1194
dev ad_secure
dev-type tun
comp-lzo no
ca ca.crt
cert AAAA.crt
key AAAA.key
dh dh1024.pem
mode server
tls-server
ifconfig 192.168.21.1 192.168.21.2
route 192.168.21.0 255.255.255.0
keepalive 10 120
persist-key
persist-tun
tls-remote ad
verb 3
client-config-dir clients
The Stuff from the 'ad' client file:
ifconfig-push 192.168.21.10 255.255.255.0
push "route 192.168.21.0 255.255.255.0"
The Client config:
proto tcp-client
tls-client
comp-lzo no
port 1194
dev-type tun
dev lee1
ca ca.crt
cert ad.crt
key ad.key
remote A.B.C.D
Thanks,
Lee.
