Overhead mysteries

nog

Hello.

I've been trying to solve/understand this problem with my openvpn connection for a while now. The provider is a well respected vpn service with a few thousand users.

The problem is that overhead on the uplink is always ~100%. For example 30kByte/s upload through the tunnel will always load the DSL link with ~60kByte/s. The downstream on the other hand has a normal overhead of ~1-10%.

Some background:
I'm on a 16/1Mbps ADSL2+ connection, using PPPoE, so mtu is 1492 bytes.
My router is running openwrt and allows icmp "fragmentation needed" in forwarding.
The VPN connection is created by my computer behind the router (NAT).
The computer runs linux with latest stable openvpn.

Sample traffic from iptraf-ng displaying both the computers interface (br0), aswell as the tunnel (tun0):
http://imgbox.com/OblzFEQ0

I feel I've really tried everything at this point. Allowing ICMP errors (fragmentation, packet-too-big), unrestricted firewall configuration on both router and the computer, different type of packet payloads, configuring openvpn with different tun-mtu, link-mtu, mssfix, etc. Still the overhead on the uplink always remains at 90-110%.

Anyone else seeing this same issue? Perhaps it's normal?

Traffic

nog wroteI'm on a 16/1Mbps ADSL2+ connection

16mb down 1mb up .. ok

nog wroteFor example 30kByte/s upload through the tunnel will always load the DSL link with ~60kByte/s

Describe the source and destination in detail.

nog wrotePerhaps it's normal?

sounds normal.

You do understand how a VPN works right ?

nog

Traffic wroteYou do understand how a VPN works right ?

Im sorry the post gave you the impression that I'm an idiot. I do apologize.

I might not be a professional but I've worked with VPNs for years now, and I'm used to seeing overhead of 1-20%, never before have I encountered 100% overhead. Which is why I made the post.

The traffic shown in the previous post is with one open youtube stream plus a torrent client seeding with a bandwidth cap of 5kByte/s. The torrent client is not downloading anything.

Traffic

nog wroteTraffic wrote:
You do understand how a VPN works right ?

Im sorry the post gave you the impression that I'm an idiot. I do apologize.

I might not be a professional but I've worked with VPNs for years now, and I'm used to seeing overhead of 1-20%, never before have I encountered 100% overhead. Which is why I made the post.

Sorry, I just asked to ascertain your level of understanding. Which is still unclear .. see below

nog wroteMy router is running openwrt and allows icmp "fragmentation needed" in forwarding.
The VPN connection is created by my computer behind the router (NAT).

Perhaps a diagram will help:

VPN over Local LAN Only
=======================

...... YourLAN ............ | 
                            |
VPN   : ===== :VPN    NAT   | --- Internet --- :youtube
Client:       :Server Router|
                            |
        ^^^^^               | ^^^^^^^^^^^^^^^^^^^^^^^^^^
         VPN                |  No VPN Encryption !
      Encrypted             |  Possible HTTPS encryption

In this scenario VPN encryption only takes place between your PC and your router over your LAN and no where else ..

If the client is offsite to the server:

VPN over internet
==================

...... YourLAN ............ | 
                            |
              :VPN    NAT   | --- Internet --- :youtube
              :Server Router|
                  :         |
                   ~~~~~~<> | ---
                  }         |
                  {         | ^^^^^^^^^^^^^^^^^^^^^^^^^^
                  }         | *No VPN Encryption !
                  {         | *Possible HTTPS encryption
                  {         |
                  }         |
                  {         |
                   ~~~~~~<> | === Internet === :(eg.CoffeeShopRouter): === :VPN Client
                            |
                            | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                            | *VPN Encrypted

VPN encryption takes place between the VPN client and the VPN server all the way across the internet, securing your data. That is, however, until it is received by the server and forwarded onto the internet .. eg:to youtube.

In this scenario, when the client downloads a stream from youtube it goes:

From youtube to your VPN server at your server upload speed 1mb/s
*with No VPN encryption*
If you limit this to 30KB/s then the download is at 30KB/s
From your VPN server to your VPN client at your VPN server upload speed 1mb/s
*with VPN encryption*
This then doubles your 30KB/s download .. because upload to the client is also 30KB/s = 60KB/s total

Does that explain this for you:

Traffic wrotenog wrote:
For example 30kByte/s upload through the tunnel will always load the DSL link with ~60kByte/s

Which is why I asked this:

Traffic wroteDescribe the source and destination in detail.