I have server with following config:
port 1194
local ipofserver
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
txqueuelen 1000
mtu-test
fast-io
sndbuf 524288
rcvbuf 524288
push "sndbuf 524288"
push "rcvbuf 524288"
topology subnet
server 10.8.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server.crt
key server.key.
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
log-append /var/log/openvpn.log
verb 4
clients:
client
proto udp
remote ip port
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
iptables rules:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i venet0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o venet0 -j ACCEPT
iptables -A INPUT -i venet0 -p udp --dport 443-j ACCCEPT
Server performance:
root@xxx:~# openssl speed -evp aes-128-ctr
Doing aes-128-ctr for 3s on 16 size blocks: 68072774 aes-128-ctr's in 2.98s
Doing aes-128-ctr for 3s on 64 size blocks: 55745735 aes-128-ctr's in 3.00s
Doing aes-128-ctr for 3s on 256 size blocks: 27433771 aes-128-ctr's in 2.99s
Doing aes-128-ctr for 3s on 1024 size blocks: 8836646 aes-128-ctr's in 3.00s
Doing aes-128-ctr for 3s on 8192 size blocks: 1202146 aes-128-ctr's in 2.99s
OpenSSL 1.0.2g 1 Mar 2016
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-ctr 365491.40k 1189242.35k 2348844.61k 3016241.83k 3293638.81k
root@xxx:~# openssl speed -evp aes-128-gcm
Doing aes-128-gcm for 3s on 16 size blocks: 57722508 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 64 size blocks: 32801353 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 256 size blocks: 17745536 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 1024 size blocks: 6253042 aes-128-gcm's in 3.00s
Doing aes-128-gcm for 3s on 8192 size blocks: 981436 aes-128-gcm's in 3.00s
OpenSSL 1.0.2g 1 Mar 2016
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128-gcm 307853.38k 699762.20k 1514285.74k 2134371.67k 2679974.57k
root@xxx:~# openssl speed -evp aes-256-gcm
Doing aes-256-gcm for 3s on 16 size blocks: 44613105 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 64 size blocks: 28096517 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 256 size blocks: 14952946 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 1024 size blocks: 4721630 aes-256-gcm's in 3.00s
Doing aes-256-gcm for 3s on 8192 size blocks: 710112 aes-256-gcm's in 3.00s
OpenSSL 1.0.2g 1 Mar 2016
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-256-gcm 237936.56k 599392.36k 1275984.73k 1611649.71k 1939079.17k
root@xxx:~#
wget http://mirror.math.princeton.edu/pub/ubuntu-iso/18.10/ubuntu-18.10-desktop-amd64.iso
--2019-05-01 01:40:40-- http://mirror.math.princeton.edu/pub/ubuntu-iso/18.10/ubuntu-18.10-desktop-amd64.iso
Resolving mirror.math.princeton.edu (mirror.math.princeton.edu)... 128.112.18.21
Connecting to mirror.math.princeton.edu (mirror.math.princeton.edu)|128.112.18.21|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1999503360 (1.9G) [application/octet-stream]
Saving to: 'ubuntu-18.10-desktop-amd64.iso'
ubuntu-18.10-desktop-amd64.iso 21%[===============================> ] 411.77M 49.2MB/s eta 34s ^
it is fast VPS on gigabit uplink..
I have following problem even client can get 50-100 mbits download speed - all clients have 0.03-0.12 upload. and even this upload is inconsistent.
I have 2 ips on server
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:16259276 errors:0 dropped:0 overruns:0 frame:0
TX packets:14440905 errors:0 dropped:18260 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:11785723385 (11.7 GB) TX bytes:8622537937 (8.6 GB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:firstIPofServer P-t-P:firstIPofServer Bcast:firstIPofServer Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
venet0:1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:secondIpOfServer P-t-P:secondIpOfServer Bcast:secondIpOfServer Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
the weird thing i found testing with iperf
client:
iperf -c secondIpOfServer -u -i 10 -e -m -P 5 -b 100m
------------------------------------------------------------
Client connecting to secondIpOfServer, UDP port 5001 with pid 24692
Sending 1470 byte datagrams, IPG target: 117.60 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 3] local ipofIperfClient port 49635 connected with secondIpOfServer port 5001
[ 4] local ipofIperfClient port 46082 connected with secondIpOfServer port 5001
[ 5] local ipofIperfClient port 60796 connected with secondIpOfServer port 5001
[ 6] local ipofIperfClient port 60342 connected with secondIpOfServer port 5001
[ 7] local ipofIperfClient port 37316 connected with secondIpOfServer port 5001
[ ID] Interval Transfer Bandwidth PPS
[ 3] 0.00-10.00 sec 604 KBytes 495 Kbits/sec 42 pps
[ 3] Sent 421 datagrams
[ 4] 0.00-10.00 sec 119 MBytes 100 Mbits/sec 8503 pps
[ 4] Sent 85026 datagrams
[ 5] 0.00-10.00 sec 601 KBytes 493 Kbits/sec 41 pps
[ 5] Sent 419 datagrams
[ 6] 0.00-10.00 sec 600 KBytes 492 Kbits/sec 41 pps
[ 6] Sent 418 datagrams
[ 7] 0.00-10.00 sec 119 MBytes 100 Mbits/sec 8503 pps
[SUM] 0.00-10.00 sec 240 MBytes 201 Mbits/sec 93655 pps
[ 7] 0.00-10.00 sec 119 MBytes 100 Mbits/sec 8502 pps
[ 7] Sent 85028 datagrams
[ 3] WARNING: did not receive ack of last datagram after 10 tries.
[ 4] WARNING: did not receive ack of last datagram after 10 tries.
[ 6] WARNING: did not receive ack of last datagram after 10 tries.
[ 5] WARNING: did not receive ack of last datagram after 10 tries.
[ 7] WARNING: did not receive ack of last datagram after 10 tries.
/etc/openvpn# iperf -s -t 3600 -u
------------------------------------------------------------
Server listening on UDP port 5001
Receiving 1470 byte datagrams
UDP buffer size: 64.0 KByte (default)
------------------------------------------------------------
[ 3] local firstIPofServer port 5001 connected with ipofIperfClient port 60796
[ 4] local firstIPofServer port 5001 connected with ipofIperfClient port 60342
[ 5] local firstIPofServer port 5001 connected with ipofIperfClient port 49635
[ 6] local firstIPofServer port 5001 connected with ipofIperfClient port 46082
[ 8] local firstIPofServer port 5001 connected with ipofIperfClient port 37316
iperf listens on 0.0.0.0 and gets the incoming connection to second ip however inside it`s log it show first ip as a sonnected... and but never ack.
moreover binding iperf to single ip with "-B IP" - works fine.
errors i see in log:
PID_ERR replay-window backtrack occurred [1] [SSL-0] [0_00000000000000000000000000011111111111111111111111111111111111] 0:282 0:281 t=1556634801[0] r=[-1,64,15,1,1] sl=[38,64,64,528]
once:
Tue Apr 30 10:34:43 2019 us=910043 Linux ip addr del failed: external program exited with error status: 2
MULTI: bad source address from client [192.168.0.5], packet dropped
openvpn is binded to second ip.
I tried all stuff
mtu, mss, bind to another ip.
but average upload performance is the same.
