Reducing Overhead? Tricks?

derdigge

Dear Forum!

I have openvpn link running which i am routing port into the tunnel to oner machine on the other end.
Both end of the tunnel is a Debian machine, handling the traffic. The data passing through is mixed up.
So some small one will be inbetween also. Yes i know about the payload and overhead storry.
Are there tricks / methods to improve the issue. I have about douple lineload vs tun load, see screenshot.
For testing i blocked all traffic on eth0 which is not on port 31000 which is my openvpn connection port.

This way i am sure "no other" traffic are misleading in my data. I enabled comp-lzo because machines are powerfull enough on both ends.
Without Tunnel it is about 1300kb/s in an out total.

As You can see my openvpn "douples" the traffic. I routet all the traffic outside the tunnel an came to the same result.

ServerConfig:

port 31000
proto udp
dev tun4
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/Server.crt
key /etc/openvpn/keys/Server.key
dh /etc/openvpn/keys/dh2048.pem
server 10.8.5.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/log/tun4_34791_udp_gateway_ipp.txt
status /etc/openvpn/log/tun4_34791_udp_gateway_status.log
keepalive 5 30
cipher AES-256-CBC
auth SHA512
verb 3
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
comp-lzo

ClientConfig:

client
tls-client
dev tun10
proto udp
remote TheTarget.ip 31000
resolv-retry infinite
nobind
pkcs12 /etc/openvpn/thekeyfile.p12
verb 3
cipher AES-256-CBC
auth SHA512
remote-cert-tls server
script-security 2
up /etc/openvpn/scripts/ausgang.sh
comp-lzo

Version:

openvpn --version
OpenVPN 2.3.4 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Oct 26 2014
library versions: OpenSSL 1.0.1e 11 Feb 2013, LZO 2.06
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=no enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no

Thanks for reading until that point!
derdigge

maikcat

please describe exactly what and how you testing/measuring.

Michael.

derdigge

Thanks for Your reply!

The screenshot is only vpn traffic, nothing else.
INPUT/OUTPUT/FORWARD is REJECT on eth0 (instead Port80) on both sides.

This the Tunnel is rx 643KB/s
But eth0 is charged with rx 1140KB/s

TX numbers are nearly the same.

In fact openvpn nearly doubles the traffic costs, when using the tunnel.
Hope this explains my problem better,

innogen

To: derdigge

If you wish to have second, third opinions, you may like to surf to https://lists.sourceforge.net/lists/listinfo/openvpn-users, subscribe to the mailing list and re-post your question(s) in plaintext there. You will have to re-present that graphic of yours in PNG format into plaintext.

Best of luck.

maikcat

ok,

you mean when you copy a file from server to your client over vpn tunnel (via ssh for example)
you notice the same behavior?

Michael.

derdigge

No sorry.

I use the openvpn tunnel with the configuration from post1.
I route all traffic through that tunnel. It results in the kbyte/s numbers you see in that screenshot.

Because of openvpn the traffic is nearly doubled. Caused by overhead?
I want to know tricks how to reduce that. By googling openvpn overhead you can easily find out
that openvpn adds about 20% to the traffic when tunneled. (depending on data)

In my Case its adding 100% to the traffic.

tun = traffic inside the tunnel
eth = overall traffic

There is no other traffic on that system. just openvpn.

derdigge

maikcat

think about the following...

your client asks for a web page,
server downloads it from the web (download traffic from server to internet)
at the same time your server sends the traffic TO your client (uploads traffic to your client)
all of the above passes from eth0....

still seems wierd the ammount of traffic?

Michael.

derdigge

At first, i thought ecxatly that. I am not totaly stupid my friend 😉

Then i tried the following:

A program which receives data from the tunnel and send it right back through the same tunnel. (same data no processing)
Thats what happening on that screenshot. So there is no "data needs to come from eth0".
The box from that screenshot just "reflects" the data to make the behavior i am speaking of visible.

You now understand what i am talking about ?

maikcat

can you please describe how you testing?

which tool are you using?

you send data where?to server itself?

again,if you f.e copy a file from server do you notice the same overhead?

Michael.

derdigge

I use netcat and dd..

dd at the tunnel entry an iso through ncat. (tcp)
on the other side two netcats one into file one out of same file and back into tunnel. (back to sender)
At the other side(back at the statr) then at last > /dev/null

When i do this without the tunnel ther is about ~2-3% Overhead.

maikcat

copying a file via ssh from server to client shows the same problem?

if you use wireshark,does it shows anything strange?

Michael.

derdigge

i tested it and do not see this behavios scping a file directly.
But with further testings i was able to reduce the overhead. Now i use same cipher but packet auth ist now sha1.
Now i am facing 37% overhead in the last 12Hours. Which is normal value i think for mixed traffic?