Hello.
I'm trying to deploy an openvpn server on windows 2012 standard system. The problem I am facing is that the packet latency gets very high and uneven when I enable packet forwarding to be able to reach the server on it's LAN IP. So the scenario is :
-install server, generate all certs and keys (dh, ca, srv, client)
-client on my laptop I'm using for a long time with dozens of other openvpn servers - no problem with other connections. updated to latest version just to be sure
-client connects and all is ok. I can ping VPN subnet through the tunnel with no problem and no delay. Reply time roughly the same through VPN and directly pinging WAN.
-I enable forwarding on the VPN interface and reply time gets weird:
Reply from 10.0.24.1: bytes=32 time=82ms TTL=128
Reply from 10.0.24.1: bytes=32 time=79ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Reply from 10.0.24.1: bytes=32 time=77ms TTL=128
Reply from 10.0.24.1: bytes=32 time=101ms TTL=128
Request timed out.
Reply from 10.0.24.1: bytes=32 time=3666ms TTL=128
Reply from 10.0.24.1: bytes=32 time=80ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Request timed out.
Reply from 10.0.24.1: bytes=32 time=3158ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Reply from 10.0.24.1: bytes=32 time=94ms TTL=128
Reply from 10.0.24.1: bytes=32 time=85ms TTL=128
Request timed out.
Reply from 10.0.24.1: bytes=32 time=3158ms TTL=128
Reply from 10.0.24.1: bytes=32 time=80ms TTL=128
Reply from 10.0.24.1: bytes=32 time=75ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Request timed out.
Reply from 10.0.24.1: bytes=32 time=3160ms TTL=128
Reply from 10.0.24.1: bytes=32 time=80ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Request timed out.
Reply from 10.0.24.1: bytes=32 time=3153ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Reply from 10.0.24.1: bytes=32 time=83ms TTL=128
Reply from 10.0.24.1: bytes=32 time=74ms TTL=128
If I set ping timeout very high supprisingly all packets return:
Reply from 192.168.1.10: bytes=100 time=8434ms TTL=127
Reply from 192.168.1.10: bytes=100 time=88ms TTL=127
Reply from 192.168.1.10: bytes=100 time=79ms TTL=127
Reply from 192.168.1.10: bytes=100 time=8487ms TTL=127
the connection is unusable
I tried:
-fixmss
-tun-mtu
-sndbuf 0
-rcvbuf 0
-netsh mtu
-reverting Openvpn to 2.3.9, tried x86 and x64
I did investigated the delayed packets:
-packet leaves the client
-packet gets to the router without delay
-cannot pinpoint yet when it arrives, wireshark does not show incoming packets on VPN interface, maybe I need to restart the server. Can't do it right now.
-reply packet is registered with wireskark leaving VPN interface with delay
-packet arrives on client with no delay from the previous sighting
The moment I do
netsh interface ipv4>set interface VPN forwarding=disabled
situation reverts to normal:
Reply from 10.0.24.1: bytes=32 time=3153ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Reply from 10.0.24.1: bytes=32 time=83ms TTL=128
Reply from 10.0.24.1: bytes=32 time=74ms TTL=128
Request timed out. <CHANGE HERE>
Reply from 10.0.24.1: bytes=32 time=158ms TTL=128
Reply from 10.0.24.1: bytes=32 time=76ms TTL=128
Reply from 10.0.24.1: bytes=32 time=77ms TTL=128
Reply from 10.0.24.1: bytes=32 time=75ms TTL=128
Reply from 10.0.24.1: bytes=32 time=81ms TTL=128
Reply from 10.0.24.1: bytes=32 time=77ms TTL=128
Reply from 10.0.24.1: bytes=32 time=77ms TTL=128
Reply from 10.0.24.1: bytes=32 time=80ms TTL=128
So, to me, this looks like some buffering issue, but is it within OpenVPN, TAP driver, or Windows ?
What Do You think ?
configs are super-simple, templates from other working instances:
port 1194
proto udp
dev tun
ca "ca.crt" #ca
cert "optasrv.crt" #srvcrt
key "optasrv.key" #srvkey
dh "dh1024.pem" #dh
server 10.0.24.0 255.255.255.0
push route 192.168.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status "openvpn-status.log"
log-append "openvpn.log"
crl-verify "crl.pem"
verb 3 # verbose mode
client
proto udp
dev tun
remote IP PORT
dhcp-option DOMAIN domain.local
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert .crt
key .key
comp-lzo
verb 3
