Very high latency when using VPN

GSnake

Hello everyone!

When I ping my server (and the VPN subnet) I get a very high latency

PING 10.2.1.1 (10.2.1.1) 56(84) bytes of data.
64 bytes from 10.2.1.1: icmp_seq=1 ttl=64 time=672 ms
64 bytes from 10.2.1.1: icmp_seq=2 ttl=64 time=670 ms
64 bytes from 10.2.1.1: icmp_seq=3 ttl=64 time=633 ms
64 bytes from 10.2.1.1: icmp_seq=4 ttl=64 time=605 ms
64 bytes from 10.2.1.1: icmp_seq=5 ttl=64 time=652 ms
64 bytes from 10.2.1.1: icmp_seq=6 ttl=64 time=646 ms

and the same happens when pinging any other host. (Yes I do redirect my traffic through the VPN)

64 bytes from 8.8.8.8: icmp_seq=1 ttl=44 time=69.8 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=44 time=70.8 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=44 time=69.4 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=44 time=70.0 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=44 time=83.0 ms
64 bytes from 8.8.8.8: icmp_seq=6 ttl=44 time=355 ms
64 bytes from 8.8.8.8: icmp_seq=7 ttl=44 time=346 ms
64 bytes from 8.8.8.8: icmp_seq=8 ttl=44 time=342 ms
64 bytes from 8.8.8.8: icmp_seq=9 ttl=44 time=360 ms
64 bytes from 8.8.8.8: icmp_seq=10 ttl=44 time=354 ms
64 bytes from 8.8.8.8: icmp_seq=11 ttl=44 time=378 ms
64 bytes from 8.8.8.8: icmp_seq=12 ttl=44 time=375 ms
64 bytes from 8.8.8.8: icmp_seq=13 ttl=44 time=375 ms
64 bytes from 8.8.8.8: icmp_seq=14 ttl=44 time=364 ms
64 bytes from 8.8.8.8: icmp_seq=15 ttl=44 time=348 ms
64 bytes from 8.8.8.8: icmp_seq=16 ttl=44 time=378 ms
64 bytes from 8.8.8.8: icmp_seq=17 ttl=44 time=368 ms
64 bytes from 8.8.8.8: icmp_seq=18 ttl=44 time=359 ms
64 bytes from 8.8.8.8: icmp_seq=19 ttl=44 time=376 ms
64 bytes from 8.8.8.8: icmp_seq=20 ttl=44 time=363 ms
64 bytes from 8.8.8.8: icmp_seq=21 ttl=44 time=380 ms
64 bytes from 8.8.8.8: icmp_seq=22 ttl=44 time=367 ms
64 bytes from 8.8.8.8: icmp_seq=23 ttl=44 time=362 ms
64 bytes from 8.8.8.8: icmp_seq=24 ttl=44 time=363 ms
64 bytes from 8.8.8.8: icmp_seq=25 ttl=44 time=415 ms
64 bytes from 8.8.8.8: icmp_seq=26 ttl=44 time=637 ms
64 bytes from 8.8.8.8: icmp_seq=27 ttl=44 time=655 ms
64 bytes from 8.8.8.8: icmp_seq=28 ttl=44 time=676 ms
64 bytes from 8.8.8.8: icmp_seq=29 ttl=44 time=640 ms
64 bytes from 8.8.8.8: icmp_seq=30 ttl=44 time=229 ms
64 bytes from 8.8.8.8: icmp_seq=31 ttl=44 time=631 ms
64 bytes from 8.8.8.8: icmp_seq=32 ttl=44 time=686 ms
64 bytes from 8.8.8.8: icmp_seq=33 ttl=44 time=668 ms
64 bytes from 8.8.8.8: icmp_seq=34 ttl=44 time=414 ms
64 bytes from 8.8.8.8: icmp_seq=35 ttl=44 time=586 ms
64 bytes from 8.8.8.8: icmp_seq=36 ttl=44 time=643 ms
64 bytes from 8.8.8.8: icmp_seq=37 ttl=44 time=654 ms

These are my configs:

server.conf
# Port listening on:
port 1194

# TCP or UDP server?
proto udp

dev tun

# Cipher
cipher AES-256-CBC
# Certs:

ca /etc/openvpn/ca.crt
cert /etc/openvpn/cert.crt
key /etc/openvpn/key.key
tls-auth /etc/openvpn/ta.key 0
# Diffie hellman parameters.

dh /etc/openvpn/dh2048.pem

# VPN Subnet (manually configured):
mode server
tls-server
topology subnet
push "topology subnet"
ifconfig 10.2.1.1 255.255.255.0
ifconfig-pool 10.2.1.20 10.2.1.254 255.255.255.0
push "route-gateway 10.2.1.1"

# Static IPs:
ifconfig-pool-persist ipp.txt

# Routes
push "route 10.2.1.0 255.255.255.0"
# Client Custom Config Dir:
client-config-dir /etc/openvpn/ccd

# Tunneling traffic through VPN:
push "redirect-gateway"

# Push DNS:
push "dhcp-option DNS 10.2.1.1"

# Pings every 10 seconds and wait 300 seconds for a response (to keep alive the connection):
keepalive 10 300

# Compression:
comp-lzo

# Privilege downgrade: (Linux Specific)
user vpn
group vpn

persist-key
persist-tun

# Quick Log:
status openvpn-status.log

# Logs:
log openvpn.log
log-append openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4

sndbuf 0
rcvbuf 0
push "sndbuf 393216"
push "rcvbuf 393216"
learn-address /etc/openvpn/learn-address.sh client.conf client
dev tun
remote example.com
resolv-retry infinite
nobind
persist-key
persist-tun
ca [inline]
cert [inline]
key [inline]
tls-auth [inline] 1
verb 1
keepalive 10 120
port 1194
proto udp
cipher AES-256-CBC
comp-lzo
remote-cert-tls server Could AES256 be the problem? I checked the server CPU and everything seems normal. (<1% CPU usage)
I've also tried to edit the MTU / MSS values with no result sadly.

Jlennemann

Try reducing the cipher from cipher AES-256-CBC to cipher AES-128-CBC and then post the output of your pings. Also, what is the download/upload speed of your test location and the location where your server is hosted?