Hello guys, I setup a new OpenVPN server and like to increase the speed and/or do a little bit of tuning on my setup with your help. First of all some details about my enviroment: - ISP: Vodafone Kabel Deutschland (cable connection): 200 Down / 50 Up - Modem: Compal CH7466CE in Bridge Mode - Router: ASUS RT-AC87U - Server: Debian 9 VM on a ESXi host (4 GB RAM and Xeon E3-1271, 4 cores for the VM) - OpenVPN: 2.4.6 (Server & Client) - Client: Windows 10 and Android Server Config: [code] #Main Configuration# port 1194 proto udp4 dev tun0 server 10.5.0.0 255.255.255.0 #Encryption and Security# tls-crypt /etc/openvpn/certs/keys/ta.key tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 ncp-ciphers AES-256-GCM:AES-192-GCM:AES-128-GCM auth SHA512 remote-cert-tls client #Enable LZ4 compression# compress lz4 #Certificates# ca /etc/openvpn/certs/keys/ca.crt cert /etc/openvpn/certs/keys/server.crt key /etc/openvpn/certs/keys/server.key dh /etc/openvpn/certs/keys/dh4096.pem #Check revoked certs# crl-verify /etc/openvpn/crl.pem #Networking# push "route 10.10.0.0 255.255.255.0" push "dhcp-option DNS 10.10.0.1" push "dhcp-option DOMAIN xyz.com" keepalive 10 120 max-clients 2 sndbuf 393216 rcvbuf 393216 push "sndbuf 393216" push "rcvbuf 393216" #Logging# status /etc/openvpn/log/lan-status.log log /etc/openvpn/log/lan.log verb 4 mute 10 #Rights# persist-key persist-tun user openvpn group nogroup [/code] Client Config: [code] #Main Configuration# client dev tun proto udp remote xyz.dom.org 1194 resolv-retry infinite #Enable LZ4 compression# compress lz4 #Certificates# ca ca.crt cert user.crt key user.key tls-crypt ta.key #Networking# mute-replay-warnings nobind register-dns #Logging# verb 3 mute 10 #Rights# persist-key persist-tun #Security# remote-cert-tls server auth-nocache auth SHA512 [/code] If I copy an ISO file trough VPN I get a speed around 7-10 MBit/s and it's randomly breaking down to 2-4 MBit/s. I added already the sndbuff and rcvbuff values wich actually improves the speed a little bit. There should be a bit more possbile with my 50 MBit/s Up. So I thaught about playing around with the MTU, but I'm not sure what to do there and if this makes sense. Perhaps you guys have some hints. As fas as I disvcovered the MTU should be 1500 from my ISP, however with ping testing I came up with a value of 1470...?! (In the ASUS Router it's set to 1500) And of course, if you have any other recommondations regarding the above config I'm happy to hear them ;) Thanks!

[quote=TinCanTech post_id=80479 time=1533554672 user_id=37053] All you can do by changing MTU is make it worse .. [/quote] Hm, ok. thanks for that hint. Some guides I found recommend to experiment with MTU... [quote=TinCanTech post_id=80479 time=1533554672 user_id=37053] You do not need this in either server or client config. The default is --auth SHA1 and is sufficient. (Unless you want to waste your CPU cycles) [/quote] Sure? SHA1 should not be used anymore, or am I wrong? [quote=TinCanTech post_id=80479 time=1533554672 user_id=37053] ISP: Vodafone Kabel Deutschland (cable connection): 200 Down / 50 Up Is that server or client .. ? [/quote] It's server side. On the client side it differs. One has 100/50. Another one has 50/25. And the mobile clients has LTE, there it depends on the signal quality of course. [quote=TinCanTech post_id=80479 time=1533554672 user_id=37053] This may help: [url]https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux[/url] [/quote] Thanks, will read & try.

Tuning possibilities?

oggy512

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

oggy512 wrote I thaught about playing around with the MTU, but I'm not sure what to do there

All you can do by changing MTU is make it worse ..

oggy512 wroteauth SHA512

You do not need this in either server or client config. The default is --auth SHA1 and is sufficient. (Unless you want to waste your CPU cycles)

oggy512 wrote ISP: Vodafone Kabel Deutschland (cable connection): 200 Down / 50 Up

Is that server or client .. ?

This may help:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux

oggy512

TinCanTech wrote All you can do by changing MTU is make it worse ..

Hm, ok. thanks for that hint. Some guides I found recommend to experiment with MTU...

TinCanTech wrote You do not need this in either server or client config. The default is --auth SHA1 and is sufficient. (Unless you want to waste your CPU cycles)

Sure? SHA1 should not be used anymore, or am I wrong?

TinCanTech wrote ISP: Vodafone Kabel Deutschland (cable connection): 200 Down / 50 Up
Is that server or client .. ?

It's server side.
On the client side it differs. One has 100/50. Another one has 50/25. And the mobile clients has LTE, there it depends on the signal quality of course.

TinCanTech wrote This may help:
https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux

Thanks, will read & try.

TinCanTech

oggy512 wrote Some guides I found recommend to experiment with MTU...

Only if your PMTU is broken and openvpn is performing badly .. Yours looks to be normal.

oggy512 wrote SHA1 should not be used anymore, or am I wrong?

SHA1 for --auth is perfectly acceptable it is not a form of encryption.
The developers know what they are doing .. but you can take it up with them if you choose ..

Overall, SHA1 or SHA512 for --auth will not make much difference on a small installation but if you have 10k clients then it does.

oggy512 wrote Server: Debian 9 VM

In my experience, VMs are more of a bottle neck that most other things.