Transatlantic Bandwidth

Davey

Hi,

I'm running a couple of OpenVPN gateways in different countries. When people connect to one of them from a nearby location, download bandwidth is high. However, when connecting from further away, the performance drops dramatically. While browsing for solutions, quite a number of people seem to agree that this is normal but I've seen a number of commercial OpenVPN connections that were considerably faster...

This is my test setup:
- OpenVPN 2.3.10 udp server running on a dedicated server on the US east coast. The server is running debian wheezy, it is connected with a 1 Gbps uplink, the CPU is a Xeon E3-1240. When wgetting files I can achieve download speeds of several 100 Mbps so everything seems fine with the connection itself. OpenVPN was installed from the official ppa.
- Several OpenVPN 2.3.10 clients in the US and Europe using Linux and Windows connected via home connections from 50 to 300 Mbps download speed. Latency from the EU clients to the server is around 100 ms.

This is what I see:
US clients:
- OpenVPN clients connecting to the server from the US get download speeds of over 100 Mbps measured using speedtest.net - Great!
EU clients
- Tests using speedtest.net indicate that we can reach around 80-90% of the maximum download speed without a vpn measuring on US servers.
- After establishing the connection, download speeds drop to ~5 Mbps for these clients when measuring with the same speedtest servers.

The total bandwidth produced by all clients on the server during that test was around 10 Mbps up and 10 Mbps down, so it can't really be a congestion problem, although there were around 20 clients connected at that time. CPU usage on the clients and server was very low.

I've tried setting the sndbuf and rcvbuf settings to 0 and then increasing them as explained in http://www.lowendtalk.com/discussion/40099/why-openvpn-is-so-slow-cool-story . I also tried doubling the net.core.rmem_default and net.core.wmem_default values. This seems to have helped a little, I'm now getting 7-8 Mbps instead of 5 but still, I think I should be able to get a lot more.

I have also tried switching to a different udp port to rule out the ISPs throttling port 53 but that had no effect. Changing the mtu or disabling lzo compression doesn't seem to do much either. Any suggestions how I might be able to improve bandwidth? Is this simply a normal thing with increasing latency?

My setup is pretty much default:

Net core values on server and client:

net.core.rmem_default = 458752
net.core.wmem_default = 458752

Server config:

user    nobody
group   nogroup

dev     tun

local   <IP address>
port    53
proto   udp

#tun-mtu 1500
#fragment 1300
#mssfix

ca      <ca>
cert    <cert>
key     <key>
dh      <pem>

server  10.66.66.0 255.255.255.0
ifconfig-pool-persist ipp.udp

push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

sndbuf 0
rcvbuf 0

#client-to-client
keepalive 10 120

cipher AES-256-CBC
comp-lzo

persist-tun
persist-key

client-config-dir ccd.udp
ccd-exclusive

verb 0

management <IP address> <Port>

Client config:

client
dev     tun
proto   udp
remote  <Server IP> 53
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
route-method exe
route-delay 2
cipher AES-256-CBC
remote-cert-tls server
redirect-gateway def1
sndbuf 0
rcvbuf 0
			
<ca>
<CA cert>
-----END CERTIFICATE-----
</ca>

<cert>
<User cert>
-----END CERTIFICATE-----
</cert>

<key>
<User key>
-----END RSA PRIVATE KEY-----
</key>

Traffic

Perhaps your EU clients are throttled by EU providers ...

Davey

Traffic wrotePerhaps your EU clients are throttled by EU providers ...

That's what I was thinking as well... I'm pretty sure it used to be faster, is there a way to find out?

Davey

I was able to test with 2 more EU lines today, 50 and 60 Mbps from T-Online in Germany. The 60 Mbps line reached 20+ Mbps download speeds using Windows, the 50 Mbps line only 4-5 Mbps using a Mac. This is really weird.

Traffic

Are you really expecting to get full performance from all those International Communications Companies, who are too busy making money, while they are also serving up Facefork and Youbube and Netdlix and XPox and Jamazon and The list goes on and on and on etc ... And on a weekend .. when all the kids are at home on their toys ?

And what exactly do you think OpenVPN can do about it .. ?

Try running a simple LAN P2P VPN and stress test OpenVPN to the Max:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux

but don't expect the same performance outside of your domain.

Davey

Traffic wroteAre you really expecting to get full performance from all those International Communications Companies, who are too busy making money, while they are also serving up Facefork and Youbube and Netdlix and XPox and Jamazon and The list goes on and on and on etc ... And on a weekend .. when all the kids are at home on their toys ?

Well, I'd probably consider it a normal thing if I wouldn't be able to score 90% of the max bandwidth on a US speedtest server without the vpn... Are the isps just assigning a higher priority to my speedtest traffic than to my vpn traffic?

Traffic

Davey wroteAre the isps just assigning a higher priority to my speedtest traffic than to my vpn traffic?

When you use speedtest.net you are testing your broadband connection to see that you are getting what you pay for .. This may sound controversial but I would bet my Grandmother's ashes that ALL ISPs make sure speedtest.net traffic is given priority over other traffic so that you have no reason to complain about their service .. It stands to reason and who is going to stop them ?

It follows then, if a consumer us going to pay extra to watch something like Netflix via their internet connection then Netflix are going to be doing something to ensure their service is also suitably prioritized .. Some people think this is an unfair practice: http://www.savetheinternet.com/sti-home .. But from my personal point of view, I do not believe there is anything us mere mortals can do to stop these International Corporations doing what ever they like with their networks. If there are court cases to try to control them, they will fight them to and beyond the absolute Bitter End and will cheat and connive and even break the law, if necessary, to get their own way.

UNITED STATES OF AMERICA, Plaintiff, vs. MICROSOFT CORPORATION, Defendant:
http://www.justice.gov/atr/us-v-microsoft-courts-findings-fact

To be honest, the title says enough , that it should come to USA vs MSC :!:

Even if you don't read it all, read the last couple of paragraphs.

Also, bear in mind that your EU clients are governed by EU law .. to put that another way "EU clients are screwed"

Have a nice day :twisted: