I am not sure this is the correct section please advise if this should be re-posted elsewhere I have been running OpenVPN 2.3.4 client for a few months. Today I decided to upgrade to 2.3.6 to see if I could improve my internet speed from 5-7Mb/s to a number closer to my LAN performance. The opposite occurred. I am not able to exceed .5 Mb/s when the test even finishes (http://www.speedtest.net). I did nothing but upgrade the software on the client, testing directly before and after. I have now downgraded back to 2.3.4 but still have the same issue. I have built a test setup on a PC Engines ALIX box with OpenWRT running OpenVPN. It sits behind my firewall with a client behind the OpenVPN box (making it it's own internal test LAN with my production clients the OpenVPN clients). When I run Totusoft Lan Speed Test (http://www.totusoft.com/lanspeed1.html) I can get 15 Mb/s with either of the above OpenVPN versions. I am struggling with iPerf strings, but seem to get slightly higher results. I am trying to: 1 - Restore the original performance of 2.3.4 2 - Understand the performance differential between my LAN and Internet speed (15 Mb/s LAN, 5-7 Mb/s Internet) and if it can be improved 3 - suggest an iPerf string for testing I expect that there would be some loss going out to the internet over local file transfers. I also expect that the data being used for test is not random data and probably overstates real performance, however I assume this is true across all 3 tools. Other info [list]IBM T-43 Laptop running Windows XP-SP3, 1.7mhz processor with 2GB ram. Both Google and IE browsers. I have set up a second PC (I7-920mhz, 6GB, Vista) and can get 10 Mb/s 9 Mb/s over the internet and interestingly slower LAN performance (When it actually routes traffic over the tunnel - another problem) I have tried playing with tun-mtu, fragment and mssfix parameters with no impact. Without OpenVPN http://www.speedtest.net will offer my full bandwidth of 50Mb/s 10/Mb/s on both machines over the wired LAN [/list] [code]Router Config ------------- config openvpn 'TAP' option _role 'server' option enable '1' option port '1190' option proto 'udp' option dev 'tap0' option ca '/etc/openvpn/ca.crt' option cert '/etc/openvpn/server.crt' option key '/etc/openvpn/server.key' option dh '/etc/openvpn/dh1024.pem' option ifconfig_pool_persist '/tmp/ipp.txt' option keepalive '10 120' option persist_key '1' option persist_tun '1' option status '/tmp/openvpn-status.log' option verb '3' option server_bridge '192.168.111.1 255.255.255.0 192.168.111.200 192.168.111.205' list push 'redirect-gateway def1' list push 'dhcp-option DNS 192.168.111.1' list push 'dhcp-option DNS 8.8.8.8' option cipher 'aes-128-cbc' option enabled '1' option comp_lzo 'yes' Client Config ------------- remote 192.168.1.19 1190 client tls-client dev tap0 proto udp remote-cert-tls server resolv-retry infinite nobind persist-tun persist-key ca ca.crt cert client1.crt key client1.key ns-cert-type server comp-lzo yes cipher aes-128-cbc verb 3[/code] Thanks for your help.... RangerZ

[quote="RangerZ"]Understand the performance differential between my LAN and Internet speed (15 Mb/s LAN, 5-7 Mb/s Internet)[/quote]10/100/1000/10G base T .. 15 Mb/s LAN :?: [url]https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux[/url] [quote="RangerZ"]suggest an iPerf string for testing[/quote]man iperf ..

Performace issues after upgrading to v2.3.6 from 2.3.4

RangerZ

I am not sure this is the correct section please advise if this should be re-posted elsewhere

I have been running OpenVPN 2.3.4 client for a few months. Today I decided to upgrade to 2.3.6 to see if I could improve my internet speed from 5-7Mb/s to a number closer to my LAN performance. The opposite occurred. I am not able to exceed .5 Mb/s when the test even finishes (http://www.speedtest.net). I did nothing but upgrade the software on the client, testing directly before and after. I have now downgraded back to 2.3.4 but still have the same issue.

I have built a test setup on a PC Engines ALIX box with OpenWRT running OpenVPN. It sits behind my firewall with a client behind the OpenVPN box (making it it's own internal test LAN with my production clients the OpenVPN clients). When I run Totusoft Lan Speed Test (http://www.totusoft.com/lanspeed1.html) I can get 15 Mb/s with either of the above OpenVPN versions. I am struggling with iPerf strings, but seem to get slightly higher results.

I am trying to:
1 - Restore the original performance of 2.3.4
2 - Understand the performance differential between my LAN and Internet speed (15 Mb/s LAN, 5-7 Mb/s Internet) and if it can be improved
3 - suggest an iPerf string for testing

I expect that there would be some loss going out to the internet over local file transfers. I also expect that the data being used for test is not random data and probably overstates real performance, however I assume this is true across all 3 tools.

Other info

IBM T-43 Laptop running Windows XP-SP3, 1.7mhz processor with 2GB ram. Both Google and IE browsers.

I have set up a second PC (I7-920mhz, 6GB, Vista) and can get 10 Mb/s 9 Mb/s over the internet and interestingly slower LAN performance (When it actually routes traffic over the tunnel - another problem)

I have tried playing with tun-mtu, fragment and mssfix parameters with no impact.

Without OpenVPN http://www.speedtest.net will offer my full bandwidth of 50Mb/s 10/Mb/s on both machines over the wired LAN

Router Config
-------------
config openvpn 'TAP'
	option _role 'server'
	option enable '1'
	option port '1190'
	option proto 'udp'
	option dev 'tap0'
	option ca '/etc/openvpn/ca.crt'
	option cert '/etc/openvpn/server.crt'
	option key '/etc/openvpn/server.key'
	option dh '/etc/openvpn/dh1024.pem'
	option ifconfig_pool_persist '/tmp/ipp.txt'
	option keepalive '10 120'
	option persist_key '1'
	option persist_tun '1'
	option status '/tmp/openvpn-status.log'
	option verb '3'
	option server_bridge '192.168.111.1 255.255.255.0 192.168.111.200 192.168.111.205'
	list push 'redirect-gateway def1'
	list push 'dhcp-option DNS 192.168.111.1'
	list push 'dhcp-option DNS 8.8.8.8'
	option cipher 'aes-128-cbc'
	option enabled '1'
	option comp_lzo 'yes'



Client Config
-------------
remote 192.168.1.19 1190
client
tls-client
dev tap0
proto udp
remote-cert-tls server
resolv-retry infinite
nobind
persist-tun
persist-key
ca ca.crt 
cert client1.crt 
key client1.key 
ns-cert-type server
comp-lzo yes
cipher aes-128-cbc
verb 3

Thanks for your help.... RangerZ

Traffic

RangerZ wroteUnderstand the performance differential between my LAN and Internet speed (15 Mb/s LAN, 5-7 Mb/s Internet)

10/100/1000/10G base T .. 15 Mb/s LAN :?:

https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux

RangerZ wrotesuggest an iPerf string for testing

man iperf ..

RangerZ

Thanks for the reply

My test LAN is limited by the PC-engines ALIX which has 10/100 ports. The primary house LAN, which this sits behind is GB lan and GB Buffalo Router. The internet connection is 50Mb/s dn, 10 Mb/s up.

To be clear, when connected to my test setup the OpenVPN client sends to the OpenWRT Router\OpenVPN server and then back out through my primary house LAN to the internet.

I am satisfied with the 15Mb/s when transferring between my house LAN OpenVPN clients and the OpenWRT Router\OpenVPN server (who would not want more). I am baffled by why I did not get closer to 13/9 Mb/s when going to the internet, and more why this has crashed. I base the 13 and 9 at a 10-20% discount for Internet overhead on the 15Mb/s down that I get for LAN traffic and the 9 Mb/s I get as the gating factor as upload speed from my ISP (the 10 Mb/s).

If I am (still) getting 15Mb/s 15 Mb/s with a LAN transfer this indicates that the client can manage encryption (AES-128-CBC/sha1) to support this speed between the OpenVPN Client and server. The decrypted call is then made to the internet, and the response then encrypted and returned from the server to the client. I get the same http://www.speedtest.net results from the client behind the OpenWRT Router\OpenVPN server as the ones in front of it (50+/10+), though the display acts more choppy. Is my assumption fair or faulty?

I am becoming of the opinion that it is browser related. IE and chrome are .5/.5, but I just installed Mozilla and it gets about 2/2. All now with the latest flash and java (7.75 for xp). Still a big drop from what I was getting before upgrading to 2.3.6.

I have previously read your link and have tried different MTUs as suggest (Before the issue at hand) and did not see and difference between omitting the statement and MTU values up to 36000. I also have tried to use MTU discovery in the OpenVPN config, but it appeared not to work.

Regarding your iperf comment, I do not understand it. Here is a recent iperf test

C:\iperf>iperf.exe -c 192.168.111.74 -u -P 1 -i 1 -p 5001 -f m -b 500M -t 10 -T
1
------------------------------------------------------------
Client connecting to 192.168.111.74, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 0.06 MByte (default)
------------------------------------------------------------
[  3] local 192.168.111.200 port 8257 connected with 192.168.111.74 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  1.0- 2.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  2.0- 3.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  3.0- 4.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  4.0- 5.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  5.0- 6.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  6.0- 7.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  7.0- 8.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  8.0- 9.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  9.0-10.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  0.0-10.0 sec   305 MBytes   256 Mbits/sec
[  3] Sent 217685 datagrams
[  3] Server Report:
[  3]  0.0-15.7 sec  30.8 MBytes  16.5 Mbits/sec  351.963 ms 195727/217684 (90%

[  3]  0.0-15.7 sec  1 datagrams received out-of-order

C:\iperf>iperf.exe -c 192.168.111.74 -u -P 1 -i 1 -p 5001 -f m -b 500M -t 10 -T
1
------------------------------------------------------------
Client connecting to 192.168.111.74, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 0.06 MByte (default)
------------------------------------------------------------
[  3] local 192.168.111.200 port 8258 connected with 192.168.111.74 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec  0.98 MBytes  8.22 Mbits/sec
[  3]  1.0- 2.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  2.0- 3.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  3.0- 4.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  4.0- 5.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  5.0- 6.0 sec  20.0 MBytes   168 Mbits/sec
[  3]  6.0- 7.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  7.0- 8.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  8.0- 9.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  9.0-10.0 sec  29.6 MBytes   248 Mbits/sec
[  3]  0.0-10.0 sec   142 MBytes   119 Mbits/sec
[  3] Sent 101388 datagrams
[  3] WARNING: did not receive ack of last datagram after 10 tries.

C:\iperf>iperf.exe -c 192.168.111.74 -u -P 1 -i 1 -p 5001 -f m -b 500M -t 10 -T
1
------------------------------------------------------------
Client connecting to 192.168.111.74, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 0.06 MByte (default)
------------------------------------------------------------
[  3] local 192.168.111.200 port 8259 connected with 192.168.111.74 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec  0.98 MBytes  8.22 Mbits/sec
[  3]  1.0- 2.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  2.0- 3.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  3.0- 4.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  4.0- 5.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  5.0- 6.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  6.0- 7.0 sec  0.00 MBytes  0.00 Mbits/sec
[  3]  7.0- 8.0 sec  21.0 MBytes   176 Mbits/sec
[  3]  8.0- 9.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  9.0-10.0 sec  30.5 MBytes   256 Mbits/sec
[  3]  0.0-10.0 sec  83.0 MBytes  69.5 Mbits/sec
[  3] Sent 59180 datagrams
[  3] Server Report:
[  3]  0.0-54.4 sec  7.51 MBytes  1.16 Mbits/sec  640.141 ms 53820/59178 (91%)
[  3]  0.0-54.4 sec  1 datagrams received out-of-order

Of the 3 tests the first gives a result in line with Totusofts lanspeed test. I do not know how to explain the other 2, but most of the time get a

WARNING: did not receive ack of last datagram after 10 tries.

The value of M does not appear linear or at least up and to the right. If I test the values 400 and 800 they are the peaks with values in between returning lower speed results. I also do not know why I get only half of my expected bandwidth @ 800. The lack of a server report means I do not get calculated results.

C:\iperf>iperf.exe -c 192.168.111.74 -u -P 1 -i 1 -p 5001 -f m -b 800M -t 10
------------------------------------------------------------
Client connecting to 192.168.111.74, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 0.06 MByte (default)
------------------------------------------------------------
[  3] local 192.168.111.200 port 8345 connected with 192.168.111.74 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec  50.1 MBytes   420 Mbits/sec
[  3]  1.0- 2.0 sec  50.1 MBytes   420 Mbits/sec
[  3]  2.0- 3.0 sec  49.5 MBytes   415 Mbits/sec
[  3]  3.0- 4.0 sec  50.1 MBytes   420 Mbits/sec
[  3]  4.0- 5.0 sec  49.2 MBytes   413 Mbits/sec
[  3]  5.0- 6.0 sec  47.9 MBytes   402 Mbits/sec
[  3]  6.0- 7.0 sec  50.1 MBytes   421 Mbits/sec
[  3]  7.0- 8.0 sec  50.1 MBytes   420 Mbits/sec
[  3]  8.0- 9.0 sec  49.2 MBytes   413 Mbits/sec
[  3]  9.0-10.0 sec  49.5 MBytes   415 Mbits/sec
[  3]  0.0-10.0 sec   496 MBytes   415 Mbits/sec
[  3] Sent 353672 datagrams
[  3] WARNING: did not receive ack of last datagram after 10 tries.

C:\iperf>iperf.exe -c 192.168.111.74 -u -P 1 -i 1 -p 5001 -f m -b 400M -t 10
------------------------------------------------------------
Client connecting to 192.168.111.74, UDP port 5001
Sending 1470 byte datagrams
UDP buffer size: 0.06 MByte (default)
------------------------------------------------------------
[  3] local 192.168.111.200 port 8346 connected with 192.168.111.74 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0- 1.0 sec  48.3 MBytes   406 Mbits/sec
[  3]  1.0- 2.0 sec  43.1 MBytes   361 Mbits/sec
[  3]  2.0- 3.0 sec  48.3 MBytes   406 Mbits/sec
[  3]  3.0- 4.0 sec  48.3 MBytes   406 Mbits/sec
[  3]  4.0- 5.0 sec  47.6 MBytes   399 Mbits/sec
[  3]  5.0- 6.0 sec  48.3 MBytes   406 Mbits/sec
[  3]  6.0- 7.0 sec  48.3 MBytes   405 Mbits/sec
[  3]  7.0- 8.0 sec  47.6 MBytes   399 Mbits/sec
[  3]  8.0- 9.0 sec  47.6 MBytes   399 Mbits/sec
[  3]  9.0-10.0 sec  48.3 MBytes   406 Mbits/sec
[  3]  0.0-10.0 sec   476 MBytes   399 Mbits/sec
[  3] Sent 339453 datagrams
[  3] WARNING: did not receive ack of last datagram after 10 tries.

Best Regards... RangerZ