Performance issues

alexs_yb

Hi

I was doing some testing last night. Using the latest community openvpn client openvpn-install-2.3.6-I003-x86_64.exe, this is the XP variant i believe, i use it on W8.1, I have tried the other Vista+ variant but it doesn't work on my laptop - the networking setup has issue

Any way I have openvpn to route every thing back to the server. I was at home with my vpn up, and I tried to do a scp, rsync (over ssh), SMB xfer from a machine on the same lan as my laptop, so it shouldn't have gone over the vpn services.

What I noticed was my transfer rate was limited to 6M/s approx. Minute I shut down the openvpn server (I run it as an always on service), the xfer speed sky rocketed up to 111M/s (Im on a 1G network).

Why is the openvpn interface coming into play if I am using the local lan

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.198 10
0.0.0.0 128.0.0.0 10.32.23.1 10.32.23.35 30
10.32.23.0 255.255.255.128 On-link 10.32.23.35 286
10.32.23.35 255.255.255.255 On-link 10.32.23.35 286
10.32.23.127 255.255.255.255 On-link 10.32.23.35 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.32.23.1 10.32.23.35 30
192.168.11.0 255.255.255.0 On-link 192.168.11.198 266
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10
192.168.11.198 255.255.255.255 On-link 192.168.11.198 266
192.168.11.255 255.255.255.255 On-link 192.168.11.198 266
192.168.56.0 255.255.255.0 On-link 192.168.56.1 276
192.168.56.1 255.255.255.255 On-link 192.168.56.1 276
192.168.56.255 255.255.255.255 On-link 192.168.56.1 276
202.74.32.200 255.255.255.255 192.168.11.1 192.168.11.198 11
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.56.1 276
224.0.0.0 240.0.0.0 On-link 10.32.23.35 286
224.0.0.0 240.0.0.0 On-link 192.168.11.198 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.56.1 276
255.255.255.255 255.255.255.255 On-link 10.32.23.35 286
255.255.255.255 255.255.255.255 On-link 192.168.11.198 266

192.168.11.0/24 is the local and I was talking to 192.168.11.5
it also happens to be my local DHCP server as well

Traffic

Please see the Forum rules (top of page)

alexs_yb

apologies

client config I have done a little redacting.

client
dev tun
resolv-retry infinite
nobind
remote-cert-tls server
tls-client
ca client-ca.crt
tls-auth ta.key 1
cryptoapicert "SUBJ: vpn"

comp-lzo
verb 3

keepalive 10 25
auth-retry nointeract

sndbuf 65536
rcvbuf 65536
socket-flags TCP_NODELAY

<connection>
remote vpn.abc.com 2443 udp
</connection>

# Back to UDP
<connection>
remote 2.4.3.2 2443 udp
remote 2.4.3.2 2443 udp
remote 1.1.2.2 2443 udp
connect-retry-max infinite
</connection>

Traffic

and your server config ?

alexs_yb

Oh interesting you think this might be a server issue ?

local 2.4.3.2
server 10.32.23.128 255.255.255.128
server-ipv6 2002:ca4a:2000:2017:C000::/66
port 2443
proto udp
dev tun
topology subnet
ifconfig-pool-persist /etc/openvpn/ip-pool.txt
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"
txqueuelen 500
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
crl-verify /etc/openvpn/client-crl.pem
tls-verify /etc/openvpn/verifyCert.sh
tls-auth /etc/openvpn/ta.key 0 # This file is secret
client-config-dir ccd
push "route-ipv6 2001::/16"
push "route-ipv6 2002::/16"
push "route-ipv6 0::/1"
push "route-ipv6 8000::/1"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.3.2.100"
push "dhcp-option DNS 10.3.2.102"
push "dhcp-option DNS 10.3.6.11"
push "comp-lzo yes"
keepalive 5 15
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/status-udp.log
verb 3
mute 10
management localhost 2443
script-security 2
client-connect /etc/openvpn/ConnectClientFW.sh
client-disconnect /etc/openvpn/DisConnectClientFW.sh
learn-address /etc/openvpn/set-route.sh

alexs_yb

I installed the vista + driver I believe the I6 variant.

Still no change.

checked netsh routing noticed this
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10

in here

192.168.11.0 255.255.255.0 On-link 192.168.11.198 266
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10
192.168.11.198 255.255.255.255 On-link 192.168.11.198 266
192.168.11.255 255.255.255.255 On-link 192.168.11.198 266

so that extra line, i believe added because its the dns and dhcp server. was causing all the traffic to go via the openvpn interface, once i deleted
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10

I got transfer speed back up to 100MB/s+ better than the 6MB/s

Any ideas why going via the openvpn driver it slows down to 6MB/s ????

Traffic

alexs_yb wrotewhy going via the openvpn driver it slows down to 6MB/s

encryption over head probably ..

alexs_yb wrotechecked netsh routing noticed this
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10

alexs_yb wrote192.168.11.0/24 is the local and I was talking to 192.168.11.5 it also happens to be my local DHCP server as well

From the manual wrote--redirect-gateway flags

flag = bypass-dhcp -- Add a direct route to the DHCP server (if it is non-local) which bypasses the tunnel

this may be effecting your routing .. try removing the "bypass-dhcp" flag from your server config.

alexs_yb

Encryption overheard, its not getting encrypted , its to the local lan ! It does look like its hitting the openvpnn nic which is causing some slowness.

But i do need the dchp-gateway bypass, especiallly when the dhcp server isn't on the local lan.

Traffic

alexs_yb wroteBut i do need the dchp-gateway bypass, especiallly when the dhcp server isn't on the local lan

alexs_yb wrote192.168.11.0/24 is the local and I was talking to 192.168.11.5
it also happens to be my local DHCP server as well

alexs_yb wrotechecked netsh routing noticed this
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10

looks local to me .. perhaps you can explain ?

alexs_yb

Sorry your going off on the wrong tangent.

This is a shared config, one my example the dhcp server is local lan, but for other its not.

Thats why the command is there.,

What I am saying is why when I have the /32 route in place do my traffic get slowed to 6MB/s when i can get 110MB/s with out the router.

The only thing I can think of is the packet is some how getting routed via the openvpn nic and for some reason its being slowed down even though it doesn't have to do anything with it.

Traffic

alexs_yb wroteSorry your going off on the wrong tangent

really ...

We provide support for OpenVPN not your network routing:

alexs_yb wroteThis is a shared config, one my example the dhcp server is local lan, but for other its not

your networking is clearly different in the different locations ..

alexs_yb wrotechecked netsh routing noticed this
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10

in here

192.168.11.0 255.255.255.0 On-link 192.168.11.198 266
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10
192.168.11.198 255.255.255.255 On-link 192.168.11.198 266
192.168.11.255 255.255.255.255 On-link 192.168.11.198 266

so that extra line, i believe added because its the dns and dhcp server. was causing all the traffic to go via the openvpn interface, once i deleted
192.168.11.5 255.255.255.255 192.168.11.1 192.168.11.198 10

I got transfer speed back up to 100MB/s+ better than the 6MB/s

The route is likely added by using "bypass-dhcp".

Once you remove the route things work as expected .: remove "bypass-dhcp" in the network where your DHCP is local.