I've got an OpenVPN server on a Digital Ocean VPS, and I've got OpenVPN installed on my macbook air (via Tunnelblick). I'm getting very weird speed drops across the tunnel. For example, when I ping directly across the VPN tunnel from my macbook to the VPS:
MBA:~ andrewbyrley$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1): 56 data bytes
64 bytes from 10.8.0.1: icmp_seq=0 ttl=63 time=448.963 ms
64 bytes from 10.8.0.1: icmp_seq=1 ttl=63 time=334.389 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=63 time=370.196 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=63 time=287.481 ms
64 bytes from 10.8.0.1: icmp_seq=4 ttl=63 time=79.094 ms
64 bytes from 10.8.0.1: icmp_seq=5 ttl=63 time=91.108 ms
64 bytes from 10.8.0.1: icmp_seq=6 ttl=63 time=78.502 ms
Request timeout for icmp_seq 7
64 bytes from 10.8.0.1: icmp_seq=7 ttl=63 time=1769.758 ms
64 bytes from 10.8.0.1: icmp_seq=8 ttl=63 time=772.507 ms
64 bytes from 10.8.0.1: icmp_seq=9 ttl=63 time=78.422 ms
64 bytes from 10.8.0.1: icmp_seq=10 ttl=63 time=79.125 ms
64 bytes from 10.8.0.1: icmp_seq=11 ttl=63 time=77.984 ms
64 bytes from 10.8.0.1: icmp_seq=12 ttl=63 time=78.972 ms
64 bytes from 10.8.0.1: icmp_seq=13 ttl=63 time=355.447 ms
64 bytes from 10.8.0.1: icmp_seq=14 ttl=63 time=637.224 ms
64 bytes from 10.8.0.1: icmp_seq=15 ttl=63 time=83.165 ms
64 bytes from 10.8.0.1: icmp_seq=16 ttl=63 time=78.931 ms
64 bytes from 10.8.0.1: icmp_seq=17 ttl=63 time=78.239 ms
64 bytes from 10.8.0.1: icmp_seq=18 ttl=63 time=329.765 ms
64 bytes from 10.8.0.1: icmp_seq=19 ttl=63 time=219.429 ms
^C
--- 10.8.0.1 ping statistics ---
20 packets transmitted, 20 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 77.984/316.435/1769.758/388.154 ms
See the response times? The logs (as far as I can tell) aren't even registering these drops, so the connection isn't totally dropping. Here is my server config:
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/vpnserver.crt
key keys/vpnserver.key
dh keys/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist vpsserver-ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/vpsserver-status.log
log /var/log/openvpn/vpsserver.log
verb 4
mute 20
and the client config:
client
dev tun
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mba.crt
key mba.key
cipher BF-CBC
comp-lzo
verb 3
mute 20
Any ideas what could be causing this? It's been awhile since I've had to do a clean install of OpenVPN, and I wasn't familiar with easyrsa3. It's possible I screwed up signing the certificates. I followed this guide
https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto, but I didn't understand "signing as a client" vs "signing as a server." I just created and signed all of the certificates on the VPS and scp'd the keys to the clients. I realize that's not the most secure way to do things, but I don't really need that level of security. Here's the server log from an initial connection:
Mon Jul 28 21:29:25 2014 us=299853 MULTI: multi_create_instance called
Mon Jul 28 21:29:25 2014 us=300314 179.42.245.9:65433 Re-using SSL/TLS context
Mon Jul 28 21:29:25 2014 us=300373 179.42.245.9:65433 LZO compression initialized
Mon Jul 28 21:29:25 2014 us=300642 179.42.245.9:65433 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jul 28 21:29:25 2014 us=300662 179.42.245.9:65433 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Jul 28 21:29:25 2014 us=300753 179.42.245.9:65433 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 28 21:29:25 2014 us=300765 179.42.245.9:65433 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 28 21:29:25 2014 us=300800 179.42.245.9:65433 Local Options hash (VER=V4): '530fdded'
Mon Jul 28 21:29:25 2014 us=300817 179.42.245.9:65433 Expected Remote Options hash (VER=V4): '41690919'
Mon Jul 28 21:29:25 2014 us=300888 179.42.245.9:65433 TLS: Initial packet from [AF_INET]179.42.245.9:65433, sid=4be66768 b5600d19
Mon Jul 28 21:29:32 2014 us=184986 179.42.245.9:65433 VERIFY OK: depth=1, CN=Easy-RSA CA
Mon Jul 28 21:29:32 2014 us=185518 179.42.245.9:65433 VERIFY OK: depth=0, CN=mba
Mon Jul 28 21:29:33 2014 us=468554 179.42.245.9:65433 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 28 21:29:33 2014 us=468657 179.42.245.9:65433 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 28 21:29:33 2014 us=468733 179.42.245.9:65433 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 28 21:29:33 2014 us=468759 179.42.245.9:65433 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 28 21:29:33 2014 us=530980 179.42.245.9:65433 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jul 28 21:29:33 2014 us=531119 179.42.245.9:65433 [mba] Peer Connection Initiated with [AF_INET]179.42.245.9:65433
Mon Jul 28 21:29:33 2014 us=531178 mba/179.42.245.9:65433 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Jul 28 21:29:33 2014 us=531227 mba/179.42.245.9:65433 MULTI: Learn: 10.8.0.6 -> mba/179.42.245.9:65433
Mon Jul 28 21:29:33 2014 us=531243 mba/179.42.245.9:65433 MULTI: primary virtual IP for mba/179.42.245.9:65433: 10.8.0.6
Mon Jul 28 21:29:35 2014 us=553739 mba/179.42.245.9:65433 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jul 28 21:29:35 2014 us=553858 mba/179.42.245.9:65433 send_push_reply(): safe_cap=940
Mon Jul 28 21:29:35 2014 us=553905 mba/179.42.245.9:65433 SENT CONTROL [mba]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Anyways, anyone have any ideas about the speed issues? Thanks!
