OpenVPN Performance

bluestreek

I am running OpenVPN on Centos 6.5 and connecting windows clients. If I do a speedtest on a connected client and it uses about 50mbps the cpu usage is almost 50% of one core. Its a dedicated server with an i7 2600k. I have read that OpenVPN can be put in multi-daemon mode and use more cores but I cannot find a guide on how to set this up.

CLIENT

remote x.x.x.x 1194 udp
dev tun
tls-client
ca ca.crt
persist-tun
persist-key
comp-lzo adaptive
nobind
pull
tls-auth ta.key 1
redirect-gateway def1
tun-mtu 1500
mssfix 1450
reneg-sec 0
route-delay 5 30
auth-user-pass
remote-cert-tls server
auth RSA-SHA256
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256

SERVER

port 1194
proto udp
dev tun
tun-mtu 1500
reneg-sec 0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/ta.key 0
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
management localhost 7505
keepalive 5 30
comp-lzo adaptive
persist-key
persist-tun
auth RSA-SHA256
cipher AES-256-CBC
script-security 1
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
log-append /var/log/openvpn.log
verb 3
client-config-dir /etc/openvpn/ccd

Thanks

Traffic

bluestreek wroteI have read that OpenVPN can be put in multi-daemon mode and use more cores but I cannot find a guide on how to set this up.

As you say .. "multi-daemon" mode.

This means you run a separate daemon for each of your clients but that means using another --dev tun, --port and vpn subnet per daemon.

IE (example):

daemon #1 (server1.conf)
- dev tun11
  port 11001
  server 10.11.0.0 255.255.255.0
daemon #2 (server2.conf)
- dev tun12
  port 12001
  server 10.12.0.0 255.255.255.0

As I understand it (at this time), openvpn running a single server uses a single thread.

bluestreek

So I figured out that you can just create new config files and it just creates new vpn instances automatically. I think it creates new tun devices automatically? I didn't realize you had iterated that also until just now. I managed to bind each instance to a single core with with taskset but I am unsure how to start or stop each instance individually. I tried doing it by config file but it doesn't seem to work that way. I am also curious why it creates either 3 or 4 processes but only one is listed until /var/run/openvpn?

I also just listed the server configs all together in radiusplugin.cnf but I have been getting some error message

RADIUS-PLUGIN: BACKGROUND-ACCT: Statusfile  could not opened.

I assume I did it incorrectly.

Thanks

Traffic

bluestreek wrotehow to start or stop each instance individually

for restart and stop, See --management in The Manual v23x

Use command line to start:

openvpn --config your-config-file.conf

Add --daemon to command line OR config file .. not both !

FWIW: arch-linux does this all very nicely using units.

bluestreek

I managed to get all that working thanks!

I am having another problem.

I have someone connecting who has about a 120ms ping and a 60/5 connection. There are many replay errors and sometimes the Frag TTL Expired error. I have these same problems and a similar ping. I have tried setting mssfix and fragment to 1300 but I am not sure its helping much.

I also followed the instructions in the thread https://forums.openvpn.net/topic7756.html to set the MTU to 1300 and it seems to be changed. I assume this takes effect instantly? Unfortunately even doing this does not seem to help although both connections seem to be more reliable than previously. For the second connection if we do a speedtest it seems pretty fast but youtube/reddit etc all are extremely slow. Also just loading a website seems to almost stall the entire connection most of the time.

Is changing the tun-mtu helpful? I left it at 1500 still.

Not sure how to fix it.

Note: Not sure if lowering the mtu was helpful as its UDP based from what I read in the last thread? I also did not touch the link-mtu on the server side.

Thanks for your help so far!

Traffic

bluestreek wroteset the MTU to 1300 and it seems to be changed. I assume this takes effect instantly?

No .. you mush issue SIGHUP to the process (Restart).

There is no easy fix for MTU problems .. try using --mtu-disc yes and --mtu-test

According to the Manual:

The Manual wroteIt's best to use the --fragment and/or --mssfix options to deal with MTU sizing issues

If --fragment and --mssfix are used together, --mssfix will take its default max parameter from the --fragment max option.

Therefore, one could lower the maximum UDP packet size to 1300 (a good first try for solving MTU-related connection problems) with the following options:

--tun-mtu 1500 --fragment 1300 --mssfix

bluestreek

This is a little off topic in regard to the other questions but I cant figure out how to push 100+ routes over OpenVPN. I read that they added a route-continuation that allows you to push a larger number but it seems to get stuck after the 2nd one then start try to push the first set again.

Thanks!

Traffic

bluestreek wrotebut I cant figure out how to push 100+ routes

See --max-routes in The Manual v23x

bluestreek

Much appreciated!

I was in the wrong manual as I did look through for something like that.