nowackig Hi, I would ask - why the transfer between the OpenVPN client and the gateway using the udp protocol is slower in comparision to tcp? Thanks for your future answers, Gienek ------------------------ The experiment that was made was as follows: Diagram of my network: client OpenVPN ||| ||| ||| gateway OpenVPN | | | destination All three host have 1Gb interfaces and are running Centos7. On the client and destination I run the commands: On client: iperf -c destination -p 3000 On destination: iperf -s -p 3000 The results are: UDP: ~356 Mbits/sec TCP: ~545 Mbits/sec When gateway works as router (without OpenVPN) and forwards the packets only, the speed is: FWD: ~960 Mbits/sec ============================================== The configs of clients and servers are as follow: auth SHA1 ca ca.crt cert client.crt cipher AES-256-CBC client comp-lzo dev tun inactive 3600 key client.key nobind persist-key persist-tun proto udp remote 10.11.11.163 1194 reneg-sec 43200 tls-auth ta.key 1 tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA tls-client tls-timeout 8 verb 3 verify-x509-name "C=PL..., emailAddress=no@mail" explicit-exit-notify 10 auth RSA-SHA1 ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt cipher AES-256-CBC client-config-dir clients compat-names comp-lzo crl-verify /etc/openvpn/crl-verify.crl dev tun dh /etc/openvpn/dh1024.pem group openvpn ifconfig 10.16.48.2 10.16.48.1 ifconfig-pool 10.16.48.9 10.16.63.251 inactive 3600 keepalive 10 60 key /etc/openvpn/server.key local 10.11.11.163 management 127.0.0.1 7505 max-clients 50 mode server mute 10 persist-key persist-tun port 1194 proto udp reneg-sec 43200 script-security 3 tls-auth ta.key 0 tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA tls-server tls-timeout 8 user openvpn verb 3 connect-freq 20 60 auth SHA1 ca ca.crt cert client.crt cipher AES-256-CBC client comp-lzo dev tun inactive 3600 key client.key nobind persist-key persist-tun proto tcp remote 10.11.11.163 443 reneg-sec 43200 tls-auth ta.key 1 tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA tls-client tls-timeout 8 verb 3 verify-x509-name "C=PL..., emailAddress=no@mail" auth RSA-SHA1 ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt cipher AES-256-CBC client-config-dir clients compat-names comp-lzo crl-verify /etc/openvpn/crl-verify.crl dev tun dh /etc/openvpn/dh1024.pem group openvpn ifconfig 10.16.48.6 10.16.48.5 ifconfig-pool 10.16.48.9 10.16.63.251 inactive 3600 keepalive 10 60 key /etc/openvpn/server.key local 10.11.11.163 management 127.0.0.1 7506 max-clients 50 mode server mute 10 persist-key persist-tun port 443 proto tcp-server reneg-sec 43200 script-security 3 tls-auth ta.key 0 tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA tls-server tls-timeout 8 user openvpn verb 3 CentOS Linux release 7.6.1810 (Core) openvpn-2.4.6-1.el7.x86_64 openssl-libs-1.0.2k-16.el7.x86_64 openssl-1.0.2k-16.el7.x86_64 lzo-2.06-8.el7.x86_64 processor : 1 vendor_id : GenuineIntel cpu family : 6 model : 15 model name : Intel(R) Xeon(R) CPU 5160 @ 3.00GHz stepping : 11 microcode : 0xbc cpu MHz : 1992.000 cache size : 4096 KB physical id : 0 siblings : 2 core id : 1 cpu cores : 2 apicid : 1 initial apicid : 1 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good nopl aperfmperf eagerfpu pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm dca lahf_lm tpr_shadow vnmi flexpriority dtherm bogomips : 5984.87 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management:
TinCanTech I am no CPU expert but your CPU does not appear to have AES-NI ? https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
nowackig Yes, it is true, there isn't support of AES-NI. Please notice that TCP supports this. Gienek
nowackig To be exact - TCP doesn't support it, but it achieves better results. That's what I wanted to say.
