OpenSSL / Aes-Ni

walibix

Hi,

sorry for my pretty bad english :mrgreen:

i just install a new server, ubuntu 14.04LTS , and move my previous openvpn server

local x.x.x.x
proto udp
port 443
dev tun
ca /etc/openvpn/Wali443/keys/ca.crt
cert /etc/openvpn/Wali443/keys/WALI-SERVER.crt
key /etc/openvpn/Wali443/keys/WALI-SERVER.key
dh /etc/openvpn/Wali443/keys/dh2048.pem
tls-auth /etc/openvpn/Wali443/keys/ta.key 0

cipher AES-256-CBC
server 10.8.200.0 255.255.255.0
push "dhcp-option DNS 8.8.8.8"
# push "route 192.168.200.0 255.255.255.0"
# push "route 192.168.201.0 255.255.255.0"
# push "route 192.168.3.0 255.255.255.0"
route 192.168.200.0 255.255.255.0
route 192.168.201.0 255.255.255.0
route 192.168.3.0 255.255.255.0

client-config-dir /etc/openvpn/Wali443/ccd
keepalive 5 30

persist-key
persist-tun

ifconfig-pool-persist /etc/openvpn/ipp-Wali433.txt

verb 4
status /etc/openvpn/openvpn-status-Wali443.log
log-append /etc/openvpn/openvpn-Wali443.log

all is fine, working , but , as i heavy load the tun (60Mb/s) my CPU reach 30% only for openvpn (Xeon 1225v3) as my workstation is only @ 3% cpu

i try to add --engine AESNI view from https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
but openvpn failed to start : engine not supported

so i go to openssl engine :
(rsax) RSAX engine support
(rdrand) Intel RDRAND engine
(dynamic) Dynamic engine loading support

and i check cat /proc/cpuinfo i saw aes entry

i check speed of openssl

openssl speed -elapsed -evp aes-128-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-cbc 650041.65k 694197.67k 705379.75k 708163.93k 709006.68k

OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-cbc 314807.58k 352870.51k 359219.46k 364332.71k 365196.63k

which show that aes-ni is working fine with openssl but apparently not with openpvn

so please, can anyone help me ? :?:

Traffic

walibix wrotei try to add --engine AESNI

Try:

engine aesni

lower case ..

mikedpitt

I was also trying to follow this how to referenced above as I also run OpenVPN from a Xeon server, although I'd simply want to leverage the power of the Xeon in the server by adding:

engine aesni

line to server.conf correct? No client side config changes for that to take affect?
Should I also add:

engine aesni --remote server

To the client *.ovpn file also?

also, how are these other options added to the server.conf file? I've tried adding:

tun-mtu 9000
fragment 0
mssfix 0

to my server.conf and the OpenVPN service will not start. Thanks very much in advance. I also would like to only use AES256CBC on my server, and if that means this will speed it up dramatically, I'd of course love to get it working. 😃

Traffic

Some further help:
https://forums.openvpn.net/topic21376.html