My Vpn connection works, I can connect, I have access to remote network computers and shared drives. I need to see if there's any way to speed up my connection. I just transferred a 10MB folder of files, and it took 37 minutes. This was from my server's samba share to my clients local disk. It seems so slow compared to everything else I'm thinking I have a configuration issue. Server Config: [code] ca /usr/local/etc/openvpn/2.0/keys/ca.crt cert /usr/local/etc/openvpn/2.0/keys/nas2.crt key /usr/local/etc/openvpn/2.0/keys/nas2.key # This file should be kept secret dh /usr/local/etc/openvpn/2.0/keys/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.2.0 255.255.255.0" push "dhcp-option DNS 192.168.2.1" push "dhcp-option WINS 192.168.2.1" push "dhcp-option DOMAIN " client-to-client keepalive 10 120 comp-lzo max-clients 100 persist-key persist-tun status openvpn-status.log log openvpn.log log-append openvpn.log verb 3 [/code] Client Config: [code] client dev tap ;dev-node MyTap proto udp remote float comp-lzo adaptive keepalive 15 60 ns-cert-type server -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- resolv-retry infinite nobind [/code] Client Advertised Connection: 18Mbps Down, 3Mbps Up (AT&T) Speedtest on client: 6.46Mbps Down, 1.93Mbps Up, 22mS Ping Server Advertised Bandwidth: 15Mbps Down, 3Mbps (Comcast) Speedtest on server: 19.21Mbps Down, 1.47Mbps Up, 33mS Ping i tried changing [code] comp-lzo adaptive [/code] to [code] comp-lzo off push "comp-lzo off" [/code] but that didn't help, and may have made things worse, but I didn't modify the server at all. I'd like to try any suggestions for modifying the configs prior to paying for faster internet connections. I checked cpu usage and disk IO on the server, cpu doesn't even drop when transferring and disk read / write is much faster than the transfer rate.

[quote="jnnewton"] I just transferred a 10MB folder of files, and it took 37 minutes. This was from my server's samba share to my clients local disk[/quote]That would be about 4.6 kilobytes/sec .. sounds quite slow .. Perhaps one of your hosts [i]floated[/i]. Please set --[b]verb 4[/b] in your configs .. try again and post the log files.

First: Your posted server config is incomplete. Second:[quote="jnnewton"]Thu Jan 14 16:11:57 2016 us=33172 ROUTE: route addition failed using CreateIpForwardEntry: [u]Access is denied[/u]. [status=5 if_index=4][/quote]You must run your openvpn client as administrator. In fact, I don't know how you have connected at all .. Third: TUN is generally faster than TAP. Last: Perhaps your NAS uplink is slower than you expect.

Hmm .. well spotted .. maybe some MITM ? Now I have to setup a TAP server and add --[b]persist tun[/b] for testing :roll:

For security, you should consider these: [list][*]1024 bit Diffie Hellman is [i]generally[/i] considered to be too weak, 2048 bit is highly recommended. This means creating a completely new [url=http://openvpn.net/index.php/open-source/documentation/howto.html#pki]PKI[/url]. [*]OpenVPN also offers --[b]tls-auth[/b], which I strongly recommend, it mitigates most [i]known[/i] attacks. See [b]--tls-auth[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url][/list]

Slow Connection Over VPN

jnnewton

My Vpn connection works, I can connect, I have access to remote network computers and shared drives. I need to see if there's any way to speed up my connection. I just transferred a 10MB folder of files, and it took 37 minutes. This was from my server's samba share to my clients local disk. It seems so slow compared to everything else I'm thinking I have a configuration issue.

Server Config:

ca /usr/local/etc/openvpn/2.0/keys/ca.crt
cert /usr/local/etc/openvpn/2.0/keys/nas2.crt
key /usr/local/etc/openvpn/2.0/keys/nas2.key  # This file should be kept secret
dh /usr/local/etc/openvpn/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.1"
push "dhcp-option WINS 192.168.2.1"
push "dhcp-option DOMAIN <DOMAIN>"
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3

Client Config:

client
dev tap
;dev-node MyTap
proto udp
remote <SERVER> <PORT>
float
comp-lzo adaptive
keepalive 15 60
ns-cert-type server
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>
resolv-retry infinite
nobind

Client Advertised Connection: 18Mbps Down, 3Mbps Up (AT&T)
Speedtest on client: 6.46Mbps Down, 1.93Mbps Up, 22mS Ping

Server Advertised Bandwidth: 15Mbps Down, 3Mbps (Comcast)
Speedtest on server: 19.21Mbps Down, 1.47Mbps Up, 33mS Ping

i tried changing

comp-lzo adaptive

comp-lzo off
push "comp-lzo off"

but that didn't help, and may have made things worse, but I didn't modify the server at all.

I'd like to try any suggestions for modifying the configs prior to paying for faster internet connections.

I checked cpu usage and disk IO on the server, cpu doesn't even drop when transferring and disk read / write is much faster than the transfer rate.

Traffic

jnnewton wrote I just transferred a 10MB folder of files, and it took 37 minutes. This was from my server's samba share to my clients local disk

That would be about 4.6 kilobytes/sec .. sounds quite slow .. Perhaps one of your hosts floated.

Please set --verb 4 in your configs .. try again and post the log files.

jnnewton

server log when i started the sever:

$ tail -F /zfile/dump/NAS2/logs/openvpn.log
Thu Jan 14 15:48:47 2016 us=858988 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Jan 14 15:48:47 2016 us=859150 UDPv4 link local (bound): [undef]
Thu Jan 14 15:48:47 2016 us=859258 UDPv4 link remote: [undef]
Thu Jan 14 15:48:47 2016 us=859345 MULTI: multi_init called, r=256 v=256
Thu Jan 14 15:48:47 2016 us=859480 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Jan 14 15:48:47 2016 us=859568 ifconfig_pool_read(), in='jnewt-d630,10.8.0.4', TODO: IPv6
Thu Jan 14 15:48:47 2016 us=859630 succeeded -> ifconfig_pool_set()
Thu Jan 14 15:48:47 2016 us=859687 IFCONFIG POOL LIST
Thu Jan 14 15:48:47 2016 us=859741 jnewt-d630,10.8.0.4
Thu Jan 14 15:48:47 2016 us=859849 Initialization Sequence Completed

later, when i got home, here's the client log:

Thu Jan 14 16:11:48 2016 us=748760 Current Parameter Settings:
Thu Jan 14 16:11:48 2016 us=748760   config = 'client.ovpn'
Thu Jan 14 16:11:48 2016 us=748760   mode = 0
Thu Jan 14 16:11:48 2016 us=748760   show_ciphers = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   show_digests = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   show_engines = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   genkey = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   key_pass_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   show_tls_ciphers = DISABLED
Thu Jan 14 16:11:48 2016 us=748760 Connection profiles [default]:
Thu Jan 14 16:11:48 2016 us=748760   proto = udp
Thu Jan 14 16:11:48 2016 us=748760   local = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   local_port = 0
Thu Jan 14 16:11:48 2016 us=748760   remote = '<WORKDOMAIN>'
Thu Jan 14 16:11:48 2016 us=748760   remote_port = <PORT>
Thu Jan 14 16:11:48 2016 us=748760   remote_float = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   bind_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   bind_local = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   connect_retry_seconds = 5
Thu Jan 14 16:11:48 2016 us=748760   connect_timeout = 10
Thu Jan 14 16:11:48 2016 us=748760   connect_retry_max = 0
Thu Jan 14 16:11:48 2016 us=748760   socks_proxy_server = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   socks_proxy_port = 0
Thu Jan 14 16:11:48 2016 us=748760   socks_proxy_retry = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tun_mtu = 1500
Thu Jan 14 16:11:48 2016 us=748760   tun_mtu_defined = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   link_mtu = 1500
Thu Jan 14 16:11:48 2016 us=748760   link_mtu_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tun_mtu_extra = 32
Thu Jan 14 16:11:48 2016 us=748760   tun_mtu_extra_defined = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   mtu_discover_type = -1
Thu Jan 14 16:11:48 2016 us=748760   fragment = 0
Thu Jan 14 16:11:48 2016 us=748760   mssfix = 1450
Thu Jan 14 16:11:48 2016 us=748760   explicit_exit_notification = 0
Thu Jan 14 16:11:48 2016 us=748760 Connection profiles END
Thu Jan 14 16:11:48 2016 us=748760   remote_random = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ipchange = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   dev = 'tap'
Thu Jan 14 16:11:48 2016 us=748760   dev_type = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   dev_node = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   lladdr = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   topology = 1
Thu Jan 14 16:11:48 2016 us=748760   tun_ipv6 = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_local = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_remote_netmask = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_noexec = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_nowarn = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_ipv6_local = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_ipv6_netbits = 0
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_ipv6_remote = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   shaper = 0
Thu Jan 14 16:11:48 2016 us=748760   mtu_test = 0
Thu Jan 14 16:11:48 2016 us=748760   mlock = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   keepalive_ping = 15
Thu Jan 14 16:11:48 2016 us=748760   keepalive_timeout = 60
Thu Jan 14 16:11:48 2016 us=748760   inactivity_timeout = 0
Thu Jan 14 16:11:48 2016 us=748760   ping_send_timeout = 15
Thu Jan 14 16:11:48 2016 us=748760   ping_rec_timeout = 60
Thu Jan 14 16:11:48 2016 us=748760   ping_rec_timeout_action = 2
Thu Jan 14 16:11:48 2016 us=748760   ping_timer_remote = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   remap_sigusr1 = 0
Thu Jan 14 16:11:48 2016 us=748760   persist_tun = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   persist_local_ip = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   persist_remote_ip = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   persist_key = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   passtos = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   resolve_retry_seconds = 1000000000
Thu Jan 14 16:11:48 2016 us=748760   username = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   groupname = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   chroot_dir = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   cd_dir = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   writepid = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   up_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   down_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   down_pre = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   up_restart = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   up_delay = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   daemon = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   inetd = 0
Thu Jan 14 16:11:48 2016 us=748760   log = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   suppress_timestamps = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   nice = 0
Thu Jan 14 16:11:48 2016 us=748760   verbosity = 4
Thu Jan 14 16:11:48 2016 us=748760   mute = 0
Thu Jan 14 16:11:48 2016 us=748760   status_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   status_file_version = 1
Thu Jan 14 16:11:48 2016 us=748760   status_file_update_freq = 60
Thu Jan 14 16:11:48 2016 us=748760   occ = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   rcvbuf = 0
Thu Jan 14 16:11:48 2016 us=748760   sndbuf = 0
Thu Jan 14 16:11:48 2016 us=748760   sockflags = 0
Thu Jan 14 16:11:48 2016 us=748760   fast_io = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   lzo = 7
Thu Jan 14 16:11:48 2016 us=748760   route_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   route_default_gateway = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   route_default_metric = 0
Thu Jan 14 16:11:48 2016 us=748760   route_noexec = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   route_delay = 5
Thu Jan 14 16:11:48 2016 us=748760   route_delay_window = 30
Thu Jan 14 16:11:48 2016 us=748760   route_delay_defined = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   route_nopull = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   route_gateway_via_dhcp = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   max_routes = 100
Thu Jan 14 16:11:48 2016 us=748760   allow_pull_fqdn = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   management_addr = '127.0.0.1'
Thu Jan 14 16:11:48 2016 us=748760   management_port = 25340
Thu Jan 14 16:11:48 2016 us=748760   management_user_pass = 'stdin'
Thu Jan 14 16:11:48 2016 us=748760   management_log_history_cache = 250
Thu Jan 14 16:11:48 2016 us=748760   management_echo_buffer_size = 100
Thu Jan 14 16:11:48 2016 us=748760   management_write_peer_info_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   management_client_user = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   management_client_group = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   management_flags = 6
Thu Jan 14 16:11:48 2016 us=748760   shared_secret_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   key_direction = 0
Thu Jan 14 16:11:48 2016 us=748760   ciphername_defined = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   ciphername = 'BF-CBC'
Thu Jan 14 16:11:48 2016 us=748760   authname_defined = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   authname = 'SHA1'
Thu Jan 14 16:11:48 2016 us=748760   prng_hash = 'SHA1'
Thu Jan 14 16:11:48 2016 us=748760   prng_nonce_secret_len = 16
Thu Jan 14 16:11:48 2016 us=748760   keysize = 0
Thu Jan 14 16:11:48 2016 us=748760   engine = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   replay = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   mute_replay_warnings = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   replay_window = 64
Thu Jan 14 16:11:48 2016 us=748760   replay_time = 15
Thu Jan 14 16:11:48 2016 us=748760   packet_id_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   use_iv = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   test_crypto = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tls_server = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tls_client = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   key_method = 2
Thu Jan 14 16:11:48 2016 us=748760   ca_file = '[[INLINE]]'
Thu Jan 14 16:11:48 2016 us=748760   ca_path = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   dh_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   cert_file = '[[INLINE]]'
Thu Jan 14 16:11:48 2016 us=748760   priv_key_file = '[[INLINE]]'
Thu Jan 14 16:11:48 2016 us=748760   pkcs12_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   cryptoapi_cert = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   cipher_list = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   tls_verify = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   tls_export_cert = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   verify_x509_type = 0
Thu Jan 14 16:11:48 2016 us=748760   verify_x509_name = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   crl_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ns_cert_type = 1
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_ku[i] = 0
Thu Jan 14 16:11:48 2016 us=748760   remote_cert_eku = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ssl_flags = 0
Thu Jan 14 16:11:48 2016 us=748760   tls_timeout = 2
Thu Jan 14 16:11:48 2016 us=748760   renegotiate_bytes = 0
Thu Jan 14 16:11:48 2016 us=748760   renegotiate_packets = 0
Thu Jan 14 16:11:48 2016 us=748760   renegotiate_seconds = 3600
Thu Jan 14 16:11:48 2016 us=748760   handshake_window = 60
Thu Jan 14 16:11:48 2016 us=748760   transition_window = 3600
Thu Jan 14 16:11:48 2016 us=748760   single_session = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   push_peer_info = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tls_exit = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tls_auth_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_protected_authentication = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_private_mode = 00000000
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_cert_private = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_pin_cache_period = -1
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_id = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   pkcs11_id_management = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   server_network = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   server_netmask = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   server_network_ipv6 = ::
Thu Jan 14 16:11:48 2016 us=748760   server_netbits_ipv6 = 0
Thu Jan 14 16:11:48 2016 us=748760   server_bridge_ip = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   server_bridge_netmask = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   server_bridge_pool_start = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   server_bridge_pool_end = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_pool_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_pool_start = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_pool_end = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_pool_netmask = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_pool_persist_filename = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_pool_persist_refresh_freq = 600
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_ipv6_pool_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_ipv6_pool_base = ::
Thu Jan 14 16:11:48 2016 us=748760   ifconfig_ipv6_pool_netbits = 0
Thu Jan 14 16:11:48 2016 us=748760   n_bcast_buf = 256
Thu Jan 14 16:11:48 2016 us=748760   tcp_queue_limit = 64
Thu Jan 14 16:11:48 2016 us=748760   real_hash_size = 256
Thu Jan 14 16:11:48 2016 us=748760   virtual_hash_size = 256
Thu Jan 14 16:11:48 2016 us=748760   client_connect_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   learn_address_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   client_disconnect_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   client_config_dir = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   ccd_exclusive = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   tmp_dir = 'C:\Users\jnewt\AppData\Local\Temp\'
Thu Jan 14 16:11:48 2016 us=748760   push_ifconfig_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   push_ifconfig_local = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   push_ifconfig_remote_netmask = 0.0.0.0
Thu Jan 14 16:11:48 2016 us=748760   push_ifconfig_ipv6_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   push_ifconfig_ipv6_local = ::/0
Thu Jan 14 16:11:48 2016 us=748760   push_ifconfig_ipv6_remote = ::
Thu Jan 14 16:11:48 2016 us=748760   enable_c2c = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   duplicate_cn = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   cf_max = 0
Thu Jan 14 16:11:48 2016 us=748760   cf_per = 0
Thu Jan 14 16:11:48 2016 us=748760   max_clients = 1024
Thu Jan 14 16:11:48 2016 us=748760   max_routes_per_client = 256
Thu Jan 14 16:11:48 2016 us=748760   auth_user_pass_verify_script = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   auth_user_pass_verify_script_via_file = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   client = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   pull = ENABLED
Thu Jan 14 16:11:48 2016 us=748760   auth_user_pass_file = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   show_net_up = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   route_method = 0
Thu Jan 14 16:11:48 2016 us=748760   ip_win32_defined = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   ip_win32_type = 3
Thu Jan 14 16:11:48 2016 us=748760   dhcp_masq_offset = 0
Thu Jan 14 16:11:48 2016 us=748760   dhcp_lease_time = 31536000
Thu Jan 14 16:11:48 2016 us=748760   tap_sleep = 0
Thu Jan 14 16:11:48 2016 us=748760   dhcp_options = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   dhcp_renew = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   dhcp_pre_release = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   dhcp_release = DISABLED
Thu Jan 14 16:11:48 2016 us=748760   domain = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   netbios_scope = '[UNDEF]'
Thu Jan 14 16:11:48 2016 us=748760   netbios_node_type = 0
Thu Jan 14 16:11:48 2016 us=748760   disable_nbt = DISABLED
Thu Jan 14 16:11:48 2016 us=748760 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
Thu Jan 14 16:11:48 2016 us=748760 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Thu Jan 14 16:11:48 2016 us=748760 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Jan 14 16:11:48 2016 us=748760 Need hold release from management interface, waiting...
Thu Jan 14 16:11:49 2016 us=264440 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Jan 14 16:11:49 2016 us=373805 MANAGEMENT: CMD 'state on'
Thu Jan 14 16:11:49 2016 us=373805 MANAGEMENT: CMD 'log all on'
Thu Jan 14 16:11:49 2016 us=514394 MANAGEMENT: CMD 'hold off'
Thu Jan 14 16:11:49 2016 us=514394 MANAGEMENT: CMD 'hold release'
Thu Jan 14 16:11:49 2016 us=592532 LZO compression initialized
Thu Jan 14 16:11:49 2016 us=592532 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Jan 14 16:11:49 2016 us=608158 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Jan 14 16:11:49 2016 us=608158 MANAGEMENT: >STATE:1452809509,RESOLVE,,,
Thu Jan 14 16:11:49 2016 us=670685 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Thu Jan 14 16:11:49 2016 us=670685 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Jan 14 16:11:49 2016 us=670685 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Jan 14 16:11:49 2016 us=670685 Local Options hash (VER=V4): 'd79ca330'
Thu Jan 14 16:11:49 2016 us=670685 Expected Remote Options hash (VER=V4): 'f7df56b8'
Thu Jan 14 16:11:49 2016 us=670685 UDPv4 link local: [undef]
Thu Jan 14 16:11:49 2016 us=670685 UDPv4 link remote: [AF_INET]73.3.60.37:1194
Thu Jan 14 16:11:49 2016 us=670685 MANAGEMENT: >STATE:1452809509,WAIT,,,
Thu Jan 14 16:11:49 2016 us=733197 MANAGEMENT: >STATE:1452809509,AUTH,,,
Thu Jan 14 16:11:49 2016 us=733197 TLS: Initial packet from [AF_INET]73.3.60.37:1194, sid=7b81da79 a9ecbc4b
Thu Jan 14 16:11:50 2016 us=76917 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC68U, emailAddress=me@myhost.mydomain
Thu Jan 14 16:11:50 2016 us=76917 VERIFY OK: nsCertType=SERVER
Thu Jan 14 16:11:50 2016 us=76917 VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC68U, emailAddress=me@myhost.mydomain
Thu Jan 14 16:11:50 2016 us=608206 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jan 14 16:11:50 2016 us=608206 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 14 16:11:50 2016 us=608206 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jan 14 16:11:50 2016 us=608206 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 14 16:11:50 2016 us=608206 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Jan 14 16:11:50 2016 us=608206 [RT-AC68U] Peer Connection Initiated with [AF_INET]73.3.60.37:1194
Thu Jan 14 16:11:51 2016 us=376585 MANAGEMENT: >STATE:1452809511,GET_CONFIG,,,
Thu Jan 14 16:11:52 2016 us=423478 SENT CONTROL [RT-AC68U]: 'PUSH_REQUEST' (status=1)
Thu Jan 14 16:11:52 2016 us=485920 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,dhcp-option DNS 192.168.2.1,route-gateway 192.168.2.1,redirect-gateway def1,route-gateway dhcp,ping 15,ping-restart 60'
Thu Jan 14 16:11:52 2016 us=485920 OPTIONS IMPORT: timers and/or timeouts modified
Thu Jan 14 16:11:52 2016 us=485920 OPTIONS IMPORT: route options modified
Thu Jan 14 16:11:52 2016 us=485920 OPTIONS IMPORT: route-related options modified
Thu Jan 14 16:11:52 2016 us=485920 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Jan 14 16:11:52 2016 us=485920 open_tun, tt->ipv6=0
Thu Jan 14 16:11:52 2016 us=485920 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{5693E78B-63D2-42BC-B8E1-3D56AF0E987B}.tap
Thu Jan 14 16:11:52 2016 us=485920 TAP-Windows Driver Version 9.21 
Thu Jan 14 16:11:52 2016 us=485920 TAP-Windows MTU=1500
Thu Jan 14 16:11:52 2016 us=485920 NOTE: FlushIpNetTable failed on interface [13] {5693E78B-63D2-42BC-B8E1-3D56AF0E987B} (status=5) : Access is denied.  
Thu Jan 14 16:11:52 2016 us=564046 Extracted DHCP router address: 192.168.2.1
Thu Jan 14 16:11:57 2016 us=33172 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Jan 14 16:11:57 2016 us=33172 C:\windows\system32\route.exe ADD 73.3.60.37 MASK 255.255.255.255 192.168.1.254
Thu Jan 14 16:11:57 2016 us=33172 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=4]
Thu Jan 14 16:11:57 2016 us=33172 Route addition via IPAPI failed [adaptive]
Thu Jan 14 16:11:57 2016 us=33172 Route addition fallback to route.exe
Thu Jan 14 16:11:57 2016 us=33172 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Thu Jan 14 16:11:57 2016 us=33172 ERROR: Windows route add command failed [adaptive]: returned error code 1
Thu Jan 14 16:11:57 2016 us=33172 C:\windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.2.1
Thu Jan 14 16:11:57 2016 us=33172 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=13]
Thu Jan 14 16:11:57 2016 us=33172 Route addition via IPAPI failed [adaptive]
Thu Jan 14 16:11:57 2016 us=33172 Route addition fallback to route.exe
Thu Jan 14 16:11:57 2016 us=33172 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Thu Jan 14 16:11:57 2016 us=48748 ERROR: Windows route add command failed [adaptive]: returned error code 1
Thu Jan 14 16:11:57 2016 us=48748 C:\windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.2.1
Thu Jan 14 16:11:57 2016 us=48748 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=13]
Thu Jan 14 16:11:57 2016 us=48748 Route addition via IPAPI failed [adaptive]
Thu Jan 14 16:11:57 2016 us=48748 Route addition fallback to route.exe
Thu Jan 14 16:11:57 2016 us=48748 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Thu Jan 14 16:11:57 2016 us=64386 ERROR: Windows route add command failed [adaptive]: returned error code 1
Thu Jan 14 16:11:57 2016 us=64386 MANAGEMENT: >STATE:1452809517,ADD_ROUTES,,,
Thu Jan 14 16:11:57 2016 us=64386 C:\windows\system32\route.exe ADD 0.0.0.0 MASK 255.255.255.255 192.168.1.254
Thu Jan 14 16:11:57 2016 us=64386 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=4]
Thu Jan 14 16:11:57 2016 us=64386 Route addition via IPAPI failed [adaptive]
Thu Jan 14 16:11:57 2016 us=64386 Route addition fallback to route.exe
Thu Jan 14 16:11:57 2016 us=64386 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Thu Jan 14 16:11:57 2016 us=64386 ERROR: Windows route add command failed [adaptive]: returned error code 1
Thu Jan 14 16:11:57 2016 us=64386 Initialization Sequence Completed
Thu Jan 14 16:11:57 2016 us=64386 MANAGEMENT: >STATE:1452809517,CONNECTED,SUCCESS,,73.3.60.37

transfer rate (2.34 KB/s):

Traffic

First: Your posted server config is incomplete.

Second:

jnnewton wroteThu Jan 14 16:11:57 2016 us=33172 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=4]

You must run your openvpn client as administrator. In fact, I don't know how you have connected at all ..

Third: TUN is generally faster than TAP.

Last: Perhaps your NAS uplink is slower than you expect.

Pippin

persist-tun

Server running tun ?

dev tap

and client running tap ?

And yes, start client as administrator.

In fact, I don't know how you have connected at all ..

Yeah, me too :-)

Traffic

Hmm .. well spotted .. maybe some MITM ?

Now I have to setup a TAP server and add --persist tun for testing :roll:

Pippin

I`m not sure `server is running tap.
It`s not specified in server config.
This means it will default to tun i think?

jnnewton

Looks like i had cut off the top of my server config as traffic pointed out.
I did remove the persist-tun. here's the complete server config

port 1194
proto udp
dev tap
ca /usr/local/etc/openvpn/2.0/keys/ca.crt
cert /usr/local/etc/openvpn/2.0/keys/nas2.crt
key /usr/local/etc/openvpn/2.0/keys/nas2.key  # This file should be kept secret
dh /usr/local/etc/openvpn/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.1"
push "dhcp-option WINS 192.168.2.1"
push "dhcp-option DOMAIN <DOMAIN>"
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
persist-key
status /zfile/dump/NAS2/logs/openvpn-status.log
log-append  /zfile/dump/NAS2/logs/openvpn-log.log
verb 4

Also, running as Administrator did fix the access is denied thing that Traffic also mentioned.

So what else can I do? I am still getting about the same rate of transfer.

Traffic

Traffic wroteTUN is generally faster than TAP

It would be interesting to see how much faster, if you would care to reconfigure your VPN.

If you do, take note:
You will probably have to change the way you connect to your NAS share. The command to use on your client would be:

C:\>net use x: \\ip.address\sharename

ip.address would be the VPN IP of the NAS.

Also, depending on the type of data you are copying, --comp-lzo may actually slow it down a tiny fraction, so you could set --comp-lzo no (server & client).

Also, you do not need --log-append as this will grow your log until it reaches disc capacity, change to --log, which will reset each time the VPN is restarted. And, now that you have diagnosed the usual problems, setting a lower --verb is reasonable.

Traffic

For security, you should consider these:

1024 bit Diffie Hellman is generally considered to be too weak, 2048 bit is highly recommended.
This means creating a completely new PKI.
OpenVPN also offers --tls-auth, which I strongly recommend, it mitigates most known attacks.
See --tls-auth in The Manual v23x

jnnewton

Ok, so I've switched over to TUN, and while I'm having some routing issues (can't ping windows machines on LAN from VPN clients but can ping linux server). I will say that I'm now getting about 100MB/s file transfer rate. However, it is strange that my ping has almost tripled on speedtest.net (high 40mS to 120mS), and maybe that's why TUN actually "feels" slower. speedtest shows the connection at 1.5/1.2Mbps. Is there a way to further speed up the connection? I should be getting up to 3Mbps / 375KB/s so I'm at about 25-30% of my advertised connection rate (limited by upload speeds).

I'm going to stick with TUN for now, but if anyone can think of a reason why i can't ping windows computers (they resolve) but my nix server is fine, I'd like to try to get that cleaned up. LAN all on same subnet, IPs 192.168.2.xxx (yeah, i should change that), and my VPN client IPs are 10.8.0.xxx.

EDIT: disabling of comp-lzo changed ping to 93mS, and lowered speedtest to around 1.2/1.2 Mbps.