Hello!
I've configured OpenVPN such that a number of external networks are able to connect back to the primary network
net01 through a gateway machine running OpenVPN AS server.
However, clients behind the gateways still get poor performance. Is there any additional configuration that can be made on the gateway machines to improve performance on clients that are behind the gateway?
A simple illusrtration of this network is:
net01client01 --------| |-------- net02gw -------- +
net01client02 --------| | |-------- net02client01
net01clientYY --------| | |-------- net02client02
+ ----- net01gw ----- +
|
|
|-------- netXXgw -------- +
|-------- netXXclientYY
I followed the
directions found on the OpenVPN wiki to get excellent throughput between the gateway machines
netXXgw in the diagram above. The edits made to the OpenVPN AS config are:
tun-mtu 48000
fragment 0
mssfix 0
cipher aes-256-cbc
The line that made a massive difference is
tun-mtu 48000.
I was able to validate the speed between
net02gw and
net01gw, for example:
root@net02gw:~# iperf -c 172.27.224.1
------------------------------------------------------------
Client connecting to 172.27.224.1, TCP port 5001
TCP window size: 1.25 MByte (default)
------------------------------------------------------------
[ 3] local 172.27.232.2 port 43488 connected with 172.27.224.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 1.46 GBytes 1.25 Gbits/sec
Clients behind this machine still get poor network performance. For instance, running iperf on
net02client01:
root@net02client01:~# iperf -c 172.27.224.1
------------------------------------------------------------
Client connecting to 172.27.224.1, TCP port 5001
TCP window size: 1.25 MByte (default)
------------------------------------------------------------
[ 3] local 10.11.0.4 port 60504 connected with 172.27.224.1 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0-10.0 sec 178 MBytes 149 Mbits/sec
These are virtual machines and I don't have control over the private network. Here is the private interface configuration on the gw and client machines:
root@net02gw:~# ifconfig eth1
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.116.0.3 netmask 255.255.240.0 broadcast 10.116.15.255
ether xx:xx:xx:xx:xx:xx txqueuelen 1000 (Ethernet)
root@net02client01:~# ifconfig eth1
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.116.0.9 netmask 255.255.240.0 broadcast 10.116.15.255
ether xx:xx:xx:xx:xx:xx txqueuelen 1000 (Ethernet)
Is there a way to configure the gateways such that client performance can be improved without making network configuration changes on the client machines?
Thank you!
