Outside traffic not working / extremely slow

msilvs

At one point this was working for outside traffic, although extremely slow. There must have been a configuration change between that point and now (I have ben trying to fix this and don't know what the working state was). However shown below is the configuration now that is not working for any outside traffic.

I have one client, a laptop, that is connected to a server on another network. I want all traffic on the laptop to go through the server. That is the goal.

Are there any obvious issues or other ways to determine what is happening?

CONFIG:

Server:

local 192.168.1.72
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "explicit-exit-notify 3"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
persist-tun
status openvpn-status.log

Client:

client
dev tun
proto udp
remote SERVER_EXT_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mike-laptop.crt
key mike-laptop.key
ns-cert-type server
comp-lzo
verb 3
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

IFCONFIG:
Server:

# ifconfig
          eth0      Link encap:Ethernet  HWaddr 00:25:31:05:7d:10  
          inet addr:192.168.1.72  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::225:31ff:fe05:7d10/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:27400 errors:0 dropped:1 overruns:0 frame:0
          TX packets:14354 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4822376 (4.5 MiB)  TX bytes:1977397 (1.8 MiB)
          Interrupt:11 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:158 (158.0 B)  TX bytes:158 (158.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:25536 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13576 errors:0 dropped:16 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:35414075 (33.7 MiB)  TX bytes:732424 (715.2 KiB)

Client:
using wlan0

# ifconfig
eth0      Link encap:Ethernet  HWaddr 10:bf:48:24:0f:87  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4231 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4231 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:447246 (447.2 KB)  TX bytes:447246 (447.2 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:148 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:9450 (9.4 KB)

wlan0     Link encap:Ethernet  HWaddr 68:5d:43:46:1f:8b  
          inet addr:10.0.0.8  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::6a5d:43ff:fe46:1f8b/64 Scope:Link
          inet6 addr: 2601:6:8280:2c5:cdae:f841:18fe:9f1f/64 Scope:Global
          inet6 addr: 2601:6:8280:2c5:6a5d:43ff:fe46:1f8b/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:68380 errors:0 dropped:0 overruns:0 frame:0
          TX packets:73748 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:45194356 (45.1 MB)  TX bytes:13335958 (13.3 MB)

PING:
Client:

$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=52.9 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=51.1 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=62.7 ms

ROUTE:

Client:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         10.0.0.1        0.0.0.0         UG    0      0        0 wlan0
10.0.0.0        0.0.0.0         255.255.255.0   U     9      0        0 wlan0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
SERVER_EXT_IP   10.0.0.1        255.255.255.255 UGH   0      0        0 wlan0

Server:

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

IPERF:
This speed seems fast. I am assuming that means there is no issue with server side performance such as encryption/cpu usage.

Server:

# iperf -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
[  4] local 10.8.0.1 port 5001 connected with 10.8.0.6 port 60850
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-10.3 sec  25.2 MBytes  20.6 Mbits/sec

Client:

$ iperf -c 10.8.0.1
------------------------------------------------------------
Client connecting to 10.8.0.1, TCP port 5001
TCP window size: 45.0 KByte (default)
------------------------------------------------------------
[  3] local 10.8.0.6 port 60850 connected with 10.8.0.1 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-10.1 sec  25.2 MBytes  21.0 Mbits/sec

IPTABLES:

Server:

# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 7069 packets, 1053K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 5642 packets, 957K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 12 packets, 2283 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 12 packets, 2283 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere

OS INFO:
Server:

Linux mike-vpn 3.14.0-kirkwood-tld-1 #1 PREEMPT Tue Apr 1 22:54:58 PDT 2014 armv5tel GNU/Linu

Client:

Linux mike 3.13.0-24-generic #46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

Traffic

Did you enable IP_Forwarding on your server ?

msilvs

Yes, thank you. After posting above I realized that was not enabled. I am now back to the extremely slow state where I get less than 1KB/sec (then gets slower as the transfer continues) using wget via terminal on the server. All traffic works but is extremely slow. A long to outside traffic works as I would expect... I tried disabling compression and changing cipher type, that did not seem to change anything.

msilvs

Unable to edit posts... Am I missing something..?

In my last post I meant to say...

wget -O /dev/null http://speedtest.wdc01.softlayer.com/downloads/test10.zip

This gives me ~250K/s on the server through SSH.

Over the VPN on the client, I receive ~3-5K/s (last night I was receiving ~500B/s).

Traffic

msilvs wroteUnable to edit posts... Am I missing something

You cannot edit your posts.

As for your issues with speed .. it is almost impossible to say where the bottle necks occur.

This is what I get on an average connection:

iperf Client:

[root@arch-live ~]# iperf -p 32145 -c 10.101.103.199 -t 60
------------------------------------------------------------
Client connecting to 10.101.103.199, TCP port 32145
TCP window size: 43.8 KByte (default)
------------------------------------------------------------
[  3] local 10.101.103.9 port 49215 connected with 10.101.103.199 port 32145
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-60.1 sec  25.0 MBytes  3.49 Mbits/sec
[root@arch-live ~]#

iperf Server:

[root@arch-test ~]# iperf -s -p 32145
------------------------------------------------------------
Server listening on TCP port 32145
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
[  4] local 10.101.103.199 port 32145 connected with 10.101.103.9 port 49215
[ ID] Interval       Transfer     Bandwidth
[  4]  0.0-61.1 sec  25.0 MBytes  3.43 Mbits/sec
^C[root@arch-test ~]#

And all of those hosts are VMs running on old Pentium 4's

Be aware, if your VPN client is trying to use your VPN server's internet connection then your server's connection to the internet must be shared by the server and the client and the server must upload your data to the client. That means your server's upload bandwidth is a serious bandwidth issue .. dependent on your ISP.

msilvs

With regards to this being an ISP bottleneck, I connected to the server while on the same LAN as the server. This, I assume, would rule out that the issue is with the connection speed. The results were no different. Maybe there other linux (server) configuration options that I am unaware of that is slowing everything down?