argyrg
I've installed an openvpn server on my Hetzner cloud server and can connect to it successfully: so that's proof of concept sorted...
I needed to do this so that I could tunnel from various raspberry pi clients, through the mobile data hotspot connection on a mobile phone to the internet to overcome a problem of using classic printers with google cloud print over a mobile hotspot.
My network is purely involved with the delivery of small (50KB) pdf documents from the server to the raspberry pi clients (this also requires that the USB connected printers announce their existence and presence to the google cloud infrastructure). I anticipate around 20 documents per day per client so the individual requirements are not significant, however, I want to build a system that can handle in excess of 1,000 active clients.
I'm becoming aware that at least cipher management and possibly authentication can place a heavy resource load on the server and I'm trying to understand the extent of the issue. With no basis for this assumption I assume that cipher management (both encryption and decryption) is likely to be the heavier resource user of the two and it is something that I can easily live without.
I like the idea of authentication but I understand that with TLS authentication every packet contains a signature which has to be calculated and checked by the server. I'm wondering how much server resource is needed to achieve this, particularly on a larger scale network?
Are these valid assumptions and can I reasonably safely assume that without encryption but with authentication I should be able to scale my network from the current single raspberry pi to beyond the 1,000 client mark without having to commit more than a single CPU core and say 2GB of memory? (I'm prepared to take flack on this :lol: ) My current server has 2x CPU cores and 4GB of RAM and I'll be scaling that up in the future.
As an aside, I intend to use TCP as the protocol rather than UDP so I'm already accepting a bandwidth hit which isn't really an issue but it does mean more packets to authenticate.
From an implementation perspective I understand that I can configure 'cipher none' and ensure that ncp-disable is set.
I look forward to hearing from you.
