Okay, so I followed this guide:
https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-an-openvpn-server-on-centos-7
My ISP has me behind a double NAT, and I am experimenting with using a VPS from OVH (1 vCPU 1GB Ram) to get me a public IPv4 connection, and then using iptables to route the traffic to a VM (openvpn client) inside of my network, and I use iptables again to route packets to the correct places.
Everything connects and flows fine. I have an emby and nextcloud virtualmachines that are accessible externally. It should also be worth noting that I am currently using
cipher no
to remove the CPU Throttling. CPU rarely goes over 5% this way. (Also all my data is SSL encrypted over port 443).
Here is the basic behavior I see. (Note internally, I get about 20-35 MB/s from downloading from nextcloud)
- Download starts at about 600 KB/s
-Stays here for about 45 seconds
-Jumps up to 3-5 MB/s
-Drops down to 800KB/s - 1.5MB/s
-another 15 seconds or so, jumps back up to 3-5 MB/s
-Behavior continues. Eventually seems to stabilize around 3-5 MB/s
Through the OpenVPN connection iperf gets about 50Mb/s (~6 MB/s)
Every download I test directly with the VPS (using wget or something similar), I get a solid 10-12 MB/s Download. Memory and CPU have plenty of overhead and I am trying to figure out what exactly is going on. Not convinced it's the VPN tunnel, but I am not sure what else I can check.
I have also tried messing with the tun-MTU settings (bumping to 6000 on client and server). Sorry for the lengthy post! Looking forward to anyones suggestions
Client Config:
client
tls-client
ca /path/to/ca.crt
cert /path/to/client.crt
key /path/to/client.key
tls-crypt /path/to/myvpn.tlsauth
remote-cert-eku "TLS Web Client Authentication"
proto udp
remote your_server_ip 1194 udp
dev tun
topology subnet
pull
user nobody
group nobody
Server Config:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 172.x.x.x 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
