OpenVPN Raspberry Pi Config Issues

rohtua

Hi,
I've been running an OpenVPN server on a Pi0 now for a few months, this week I decided to move the server from the Pi0 to a Pi3, the idea being the faster processor plus ethernet connection would improve the connection speeds I get with the VPN. I tranferred it across and there was some slight improvement using the ethernet connection. I got a whole 5mb/s in upload and download!!!! So I looked on the forums for tips on how to improve the speed of the server. I found suggestions such as mssfix, tun-mtu, sndbuf, rcvbuf and disable comp-lzo. All of which I did, I ran speed test after adding each new setting to the config, there where some slight increases at first after adding the snd/rcvbuf options up to about 6/7mb/s. The big difference came when I added the tun-mtu and mssfix options, I got a 24mb/s download speed and 6mb/s upload. I was happy with this, but to see if I could get any more speed out of it I experimented with changing the figures in for mssfix and tun-mtu. I originally tried tun-mtu 1400 and mssfix 1360, then looking around I found a forum post on which someone had posted their server config with the value of 64800 for tun-mtu and mssfix set to 1440.

I thought it can't hurt to try them, if it doesn't work just change the settings back, right? This is where the problems started I changed the values and the speed of the server dropped to around 1mb/s or less for upload and download speeds. I changed the values back only to find the speed only increased to around 3mb/s either way. I've spent the past day and half changing these settings, I've rewritten the server.conf file in case there was some corruption in the original, I reset all the settings back to the original setup I had on the Pi0 but every time I now change the settings the speed either gets worse or hovers between 0.1mb/s and 5mb/s. Has anyone experienced this or have any idea why its happening and how I might fix it. Ideally I want to get back to the point where I had 24mb/s download and 6mb/s upload.

Sorry for the really long post, just thought it best if I explained as clearly as possible.

Here's my current server config: local 192.168.1.240

dev tun

proto udp

port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt

cert /etc/openvpn/easy-rsa/keys/TMVPN_S.crt

key /etc/openvpn/easy-rsa/keys/TMVPN_S.key

dh /etc/openvpn/easy-rsa/keys/dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig 10.8.0.1 10.8.0.2

push "route 10.8.0.1 255.255.255.255"

push "route 10.8.0.0 255.255.255.0"

push "route 192.168.1.240 255.255.255.0"

push "dhcp-option DNS 192.168.1.93"

push "redirect-gateway def1"

client-to-client

duplicate-cn

keepalive 10 120

cipher AES-128-CBC

user nobody

group nogroup

persist-key

sndbuf 393216

rcvbuf 393216

push "sndbuf 393216"

push "rcvbuf 393216"

tun-mtu 1460

mssfix 1420

status openvpn-status.log

#comp-lzo

verb 11

TinCanTech

What speed do you pay for from your ISP ?

rohtua

I'm supposed to get 50mb/s according to the router I'm currently getting 40mb/s down and 6mb/s up, which is matched when I run speed tests without connecting to the VPN as soon as I connect to the VPN speed drops to around 1-2mb/s either way. Like I said it was working giving me 5mb/s down and 6mb/s up and on a handful of occasions 20-24mb/s down and 6mb/s up until the point I started changing the mtu etc. settings from the values originally assigned when I first put them into the conf file. I've even tried setting up the vpn from scratch this using raspian lite instead of the full raspian I used originally but the speeds haven't changed much. I've seen a few speed tests where the download has been around 1.4mb/s and upload has gone up to 2.7mb/s but that's the best I've been able to get out of it!!!

rohtua

Hi,
I've just tried setting up the VPN again from scratch this time using an install method from PiVPN (http://www.pivpn.io/) which automates the install and setup process. Now it works the same way it did when I first added the tun-mtu etc. to my original sever config. Here's the config generated by the scripts:
dev tun
proto udp
port 700
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 0.0.0.0 "
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
#crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
log /var/log/openvpn.log
verb 1
# Generated for use by PiVPN.io The only differences I can see here compared to my config is that TLS auth is on (and working, something that I could never get to work on my original setup) and the encryption is AES-256 instead of AES-128. Given that that's a higher encryption method I'd like to know why I'm getting the same speeds with this config as I was with my edited config originally???? Plus comp-lzo is also on which I had turned off as it was the first suggestion I came across when trying to increase the speed of OpenVPN. Any help in understanding why my config didn't work and how I could fix the issues there would be greatly appreciated.

TinCanTech

Probably the only changes you can make are :

--cipher AES-128-CBC
--auth SHA1 (the default)

These must be set on both server and client.

If you are using OpenVPN 2.4.x then you can use --ncp-disable otherwise Openvpn will
negotiate the best security cipher not the fastest.

Do not mess with MTU unless you know what you are doing and it is unlikely to help any way.
https://en.wikipedia.org/wiki/Maximum_transmission_unit

If you think you have an MTU issue try --mtu-test on your client.