Idle chatter 1GB per day?

apeg

Hey guys,

I'm running an openVPN server with 5 or so clients and im noticing a large difference in idle bandwidth usage from my software client vs. my Tomato router client?

My plan is to adjust the keepalive in hopes of reducing it but variation are so large im wondering if im missing something elsewhere?

- Ubuntu system running openVPN client on boot (Internet traffic not redirected)
- 24h (Received | Sent) = 40MB | 900MB <- as reported from the Server

but if i remove OpenVPN from the computer and apply it to the router level i get a drastic drop
- 24h (Received | Sent) = 150KB | 150KB

Any pointers what i can look into? here is my client side configuration:

client
dev tun12
proto udp
remote *****
resolv-retry infinite
nobind
persist-key
persist-tun
ca *****
cert *****
key *****
tls-client
remote-cert-tls server
auth-user-pass *****
cipher AES-128-CBC
reneg-sec 0
verb 4

Server config:

server 10.9.0.0 255.255.255.0
proto udp
port *****
dev tun22
cipher AES-128-CBC
keepalive 15 60
verb 4
push "route 172.168.1.0 255.255.255.0"
client-config-dir ccd
client-to-client
plugin /lib/openvpn_plugin_auth_nvram.so vpn_*****
script-security 2
username-as-common-name
ca *****
dh *****
cert *****
key *****
status-version 2
status status

Traffic

apeg wroteAny pointers what i can look into?

This is probably a service on your server that your router does not support .. perhaps ftp.

apeg

Hey Traffic, in both cases the server is mine, its a DD-wrt router hosting an openVPN server

The difference is when connecting to that router via another dd-wrt router (client) OR connecting via software client running directly on a computer behind the router. (in both cases the client machine is on and sitting idle)

I get what your saying that the router (client) may preventing a given protocol from communicating because its not as full featured as the software client. but the server router is running the same version of dd-wrt, so its unlikely the router server supports protocols that the routers client does not? no?

I wonder if im not "Redirect Internet traffic" correctly on my software client which is causing things like OS update/checks to tunnel through to the server?

Logging into the Router (client) i can pull the config file from dd-wrt:

daemon
client
dev tun11
proto udp
remote ****
resolv-retry 30
nobind
persist-key
persist-tun
cipher none
verb 3
ca *****
cert *****
key *****
status-version 2
status status

I don't know if DD-wrt adds something after? when i use this exact configuration on my software client the idle data usage is still 1GB+

Traffic

For a 24h period, I get about 1.5mb data over a truly idle VPN with --keepalive 15 60 .. so either:

something is wrong with your VPN causing hundreds of reconnects
check your logs
your client is pulling data over your vpn
check your firewall

apeg wroteServer config:
Code:
push "route 172.168.1.0 255.255.255.0"

You realise this is not an RFC1918 compliant subnet .. ?

apeg

Traffic wroteFor a 24h period, I get about 1.5mb data over a truly idle VPN with --keepalive 15 60 .. so either:

something is wrong with your VPN causing hundreds of reconnects
check your logs

your client is pulling data over your vpn
check your firewall

apeg wroteServer config:
Code:
push "route 172.168.1.0 255.255.255.0"
You realise this is not an RFC1918 compliant subnet .. ?

Good stuff, thanks again Traffic.

Ill run a network logger of some kind on the software install and see if i can catch anything there. And thanks for the 172.168... catch, ill strip the 8.

Cheers,