windows share through VPN are very slow

FranckFR

Hi,
i set up an openVPN server, on debian, so my users can access some windows share from home.
The navigation through folders works pretty good, but as soon as i try to open a file, its terrribly slow (over 2 min to open a 5mo xls file)
The connection between me and my work is perfect (ping is mostly between 20-50ms constantly, no packet loss) when im connected through VPN, but download is terribly slow 400kb/s, when its 40mb/s without VPN. I tried to download through https or FTP

I heard about some MTU settings to change, so i did use the ping method + change of packet size, and i got the result that the max MTU is 1472 when im connected to VPN.

My VPN server is behind a FW, this is why there is a port difference between client and server configuration. Also i changed the IP and port for obvious reasons

Here is the settings of my client :
client
dev tun
proto udp
remote 160.49.123.242 4443
resolv-retry infinite
nobind
ca ca.crt
cert user1.crt
key user1.key
tls-auth ta.key 1
persist-key
persist-tun

link-mtu 1472
cipher AES-256-CBC
comp-lzo
verb 3

and the one from my server
# Serveur UDP/443
mode server
proto udp
port 443
dev tun

# Cles et certificats
# On utilise les clés et certifcats générés
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
cipher AES-256-CBC

# Reseau
# La machine connectée sera dans le sous-réseau 10.8.0.0
# Les DNS utilisés seront ceux de google
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 4.4.4.4"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120

link-mtu 1472

# Securite
# Configuration de la sécurité du serveur
# Le processus sera chrooté dans /etc/openvpn/jail
user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo

# Log
# Configuration de la manière dont les fichiers de logs fonctionnent
# Enlever le ";" de la dernière ligne pour activer les logs
verb 3
mute 20
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log

Thanks for any help !

TinCanTech

FranckFR wrote i got the result that the max MTU is 1472 when im connected to VPN.

That is the normal MTU, which means the speed has nothing to do with MTU.

FranckFR

i can see this in the logs :
Thu Mar 18 18:03:04 2021 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 18 18:03:04 2021 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 18 18:03:04 2021 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1348)

where is this 1348 coming from ?

TinCanTech

FranckFR wrote where is this 1348 coming from ?

You set it..

FranckFR

I didnt... i only set the 1472 link-mtu for both client and server...

TinCanTech

FranckFR wrote I didnt... i only set the 1472 link-mtu for both client and server...

Exactly ..

FranckFR

i dont see the link between 1472 and 1348 😃
but, do you have any clue why my transferts are so slow, and my windows share too ?

TinCanTech

--link-mtu will not help you but it will make it worse ..

What is your internet upload speed ?

FranckFR

i just made a speedtest : 11Ms, 35mbps down, 13mbps up
At work ; i have 1gbps up and down

TinCanTech

Try adding --mtu-test to your configs and then post your logs at --verb 4

FranckFR

here it is :

Sun Mar 21 22:23:58 2021 us=489284 Current Parameter Settings:
Sun Mar 21 22:23:58 2021 us=489284   config = 'user1.ovpn'
Sun Mar 21 22:23:58 2021 us=489284   mode = 0
Sun Mar 21 22:23:58 2021 us=489284   show_ciphers = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   show_digests = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   show_engines = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   genkey = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   key_pass_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   show_tls_ciphers = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   connect_retry_max = 0
Sun Mar 21 22:23:58 2021 us=489284 Connection profiles [0]:
Sun Mar 21 22:23:58 2021 us=489284   proto = udp
Sun Mar 21 22:23:58 2021 us=489284   local = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   local_port = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   remote = '140.45.34.23'
Sun Mar 21 22:23:58 2021 us=489284   remote_port = '44443'
Sun Mar 21 22:23:58 2021 us=489284   remote_float = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   bind_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   bind_local = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   bind_ipv6_only = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   connect_retry_seconds = 5
Sun Mar 21 22:23:58 2021 us=489284   connect_timeout = 120
Sun Mar 21 22:23:58 2021 us=489284   socks_proxy_server = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   socks_proxy_port = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   tun_mtu = 1500
Sun Mar 21 22:23:58 2021 us=489284   tun_mtu_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   link_mtu = 1472
Sun Mar 21 22:23:58 2021 us=489284   link_mtu_defined = ENABLED
Sun Mar 21 22:23:58 2021 us=489284   tun_mtu_extra = 0
Sun Mar 21 22:23:58 2021 us=489284   tun_mtu_extra_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   mtu_discover_type = -1
Sun Mar 21 22:23:58 2021 us=489284   fragment = 0
Sun Mar 21 22:23:58 2021 us=489284   mssfix = 1450
Sun Mar 21 22:23:58 2021 us=489284   explicit_exit_notification = 0
Sun Mar 21 22:23:58 2021 us=489284 Connection profiles END
Sun Mar 21 22:23:58 2021 us=489284   remote_random = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   ipchange = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   dev = 'tun'
Sun Mar 21 22:23:58 2021 us=489284   dev_type = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   dev_node = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   lladdr = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   topology = 1
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_local = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_remote_netmask = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_noexec = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_nowarn = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_ipv6_local = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_ipv6_netbits = 0
Sun Mar 21 22:23:58 2021 us=489284   ifconfig_ipv6_remote = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   shaper = 0
Sun Mar 21 22:23:58 2021 us=489284   mtu_test = 1
Sun Mar 21 22:23:58 2021 us=489284   mlock = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   keepalive_ping = 0
Sun Mar 21 22:23:58 2021 us=489284   keepalive_timeout = 0
Sun Mar 21 22:23:58 2021 us=489284   inactivity_timeout = 0
Sun Mar 21 22:23:58 2021 us=489284   ping_send_timeout = 0
Sun Mar 21 22:23:58 2021 us=489284   ping_rec_timeout = 0
Sun Mar 21 22:23:58 2021 us=489284   ping_rec_timeout_action = 0
Sun Mar 21 22:23:58 2021 us=489284   ping_timer_remote = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   remap_sigusr1 = 0
Sun Mar 21 22:23:58 2021 us=489284   persist_tun = ENABLED
Sun Mar 21 22:23:58 2021 us=489284   persist_local_ip = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   persist_remote_ip = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   persist_key = ENABLED
Sun Mar 21 22:23:58 2021 us=489284   passtos = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   resolve_retry_seconds = 1000000000
Sun Mar 21 22:23:58 2021 us=489284   resolve_in_advance = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   username = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   groupname = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   chroot_dir = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   cd_dir = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   writepid = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   up_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   down_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   down_pre = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   up_restart = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   up_delay = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   daemon = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   inetd = 0
Sun Mar 21 22:23:58 2021 us=489284   log = ENABLED
Sun Mar 21 22:23:58 2021 us=489284   suppress_timestamps = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   machine_readable_output = DISABLED
Sun Mar 21 22:23:58 2021 us=489284   nice = 0
Sun Mar 21 22:23:58 2021 us=489284   verbosity = 4
Sun Mar 21 22:23:58 2021 us=489284   mute = 0
Sun Mar 21 22:23:58 2021 us=489284   gremlin = 0
Sun Mar 21 22:23:58 2021 us=489284   status_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=489284   status_file_version = 1
Sun Mar 21 22:23:58 2021 us=489284   status_file_update_freq = 60
Sun Mar 21 22:23:58 2021 us=489284   occ = ENABLED
Sun Mar 21 22:23:58 2021 us=489284   rcvbuf = 0
Sun Mar 21 22:23:58 2021 us=489284   sndbuf = 0
Sun Mar 21 22:23:58 2021 us=490282   sockflags = 0
Sun Mar 21 22:23:58 2021 us=490282   fast_io = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   comp.alg = 2
Sun Mar 21 22:23:58 2021 us=490282   comp.flags = 1
Sun Mar 21 22:23:58 2021 us=490282   route_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   route_default_gateway = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   route_default_metric = 0
Sun Mar 21 22:23:58 2021 us=490282   route_noexec = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   route_delay = 5
Sun Mar 21 22:23:58 2021 us=490282   route_delay_window = 30
Sun Mar 21 22:23:58 2021 us=490282   route_delay_defined = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   route_nopull = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   route_gateway_via_dhcp = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   allow_pull_fqdn = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   Pull filters:
Sun Mar 21 22:23:58 2021 us=490282     ignore "route-method"
Sun Mar 21 22:23:58 2021 us=490282   management_addr = '127.0.0.1'
Sun Mar 21 22:23:58 2021 us=490282   management_port = '25340'
Sun Mar 21 22:23:58 2021 us=490282   management_user_pass = 'stdin'
Sun Mar 21 22:23:58 2021 us=490282   management_log_history_cache = 250
Sun Mar 21 22:23:58 2021 us=490282   management_echo_buffer_size = 100
Sun Mar 21 22:23:58 2021 us=490282   management_write_peer_info_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   management_client_user = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   management_client_group = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   management_flags = 6
Sun Mar 21 22:23:58 2021 us=490282   shared_secret_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   key_direction = 1
Sun Mar 21 22:23:58 2021 us=490282   ciphername = 'AES-256-CBC'
Sun Mar 21 22:23:58 2021 us=490282   ncp_enabled = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sun Mar 21 22:23:58 2021 us=490282   authname = 'SHA1'
Sun Mar 21 22:23:58 2021 us=490282   prng_hash = 'SHA1'
Sun Mar 21 22:23:58 2021 us=490282   prng_nonce_secret_len = 16
Sun Mar 21 22:23:58 2021 us=490282   keysize = 0
Sun Mar 21 22:23:58 2021 us=490282   engine = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   replay = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   mute_replay_warnings = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   replay_window = 64
Sun Mar 21 22:23:58 2021 us=490282   replay_time = 15
Sun Mar 21 22:23:58 2021 us=490282   packet_id_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   use_iv = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   test_crypto = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   tls_server = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   tls_client = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   key_method = 2
Sun Mar 21 22:23:58 2021 us=490282   ca_file = 'ca.crt'
Sun Mar 21 22:23:58 2021 us=490282   ca_path = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   dh_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   cert_file = 'user1.crt'
Sun Mar 21 22:23:58 2021 us=490282   extra_certs_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   priv_key_file = 'user1.key'
Sun Mar 21 22:23:58 2021 us=490282   pkcs12_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   cryptoapi_cert = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   cipher_list = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   cipher_list_tls13 = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   tls_cert_profile = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   tls_verify = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   tls_export_cert = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   verify_x509_type = 0
Sun Mar 21 22:23:58 2021 us=490282   verify_x509_name = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   crl_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   ns_cert_type = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_ku[i] = 0
Sun Mar 21 22:23:58 2021 us=490282   remote_cert_eku = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   ssl_flags = 0
Sun Mar 21 22:23:58 2021 us=490282   tls_timeout = 2
Sun Mar 21 22:23:58 2021 us=490282   renegotiate_bytes = -1
Sun Mar 21 22:23:58 2021 us=490282   renegotiate_packets = 0
Sun Mar 21 22:23:58 2021 us=490282   renegotiate_seconds = 3600
Sun Mar 21 22:23:58 2021 us=490282   handshake_window = 60
Sun Mar 21 22:23:58 2021 us=490282   transition_window = 3600
Sun Mar 21 22:23:58 2021 us=490282   single_session = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   push_peer_info = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   tls_exit = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   tls_auth_file = 'ta.key'
Sun Mar 21 22:23:58 2021 us=490282   tls_crypt_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_protected_authentication = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_private_mode = 00000000
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_cert_private = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_pin_cache_period = -1
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_id = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   pkcs11_id_management = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   server_network = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   server_netmask = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   server_network_ipv6 = ::
Sun Mar 21 22:23:58 2021 us=490282   server_netbits_ipv6 = 0
Sun Mar 21 22:23:58 2021 us=490282   server_bridge_ip = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   server_bridge_netmask = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   server_bridge_pool_start = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   server_bridge_pool_end = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_pool_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_pool_start = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_pool_end = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_pool_netmask = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_pool_persist_filename = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_pool_persist_refresh_freq = 600
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_ipv6_pool_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_ipv6_pool_base = ::
Sun Mar 21 22:23:58 2021 us=490282   ifconfig_ipv6_pool_netbits = 0
Sun Mar 21 22:23:58 2021 us=490282   n_bcast_buf = 256
Sun Mar 21 22:23:58 2021 us=490282   tcp_queue_limit = 64
Sun Mar 21 22:23:58 2021 us=490282   real_hash_size = 256
Sun Mar 21 22:23:58 2021 us=490282   virtual_hash_size = 256
Sun Mar 21 22:23:58 2021 us=490282   client_connect_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   learn_address_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   client_disconnect_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   client_config_dir = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   ccd_exclusive = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   tmp_dir = 'C:\Users\Franck\AppData\Local\Temp\'
Sun Mar 21 22:23:58 2021 us=490282   push_ifconfig_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   push_ifconfig_local = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   push_ifconfig_remote_netmask = 0.0.0.0
Sun Mar 21 22:23:58 2021 us=490282   push_ifconfig_ipv6_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   push_ifconfig_ipv6_local = ::/0
Sun Mar 21 22:23:58 2021 us=490282   push_ifconfig_ipv6_remote = ::
Sun Mar 21 22:23:58 2021 us=490282   enable_c2c = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   duplicate_cn = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   cf_max = 0
Sun Mar 21 22:23:58 2021 us=490282   cf_per = 0
Sun Mar 21 22:23:58 2021 us=490282   max_clients = 1024
Sun Mar 21 22:23:58 2021 us=490282   max_routes_per_client = 256
Sun Mar 21 22:23:58 2021 us=490282   auth_user_pass_verify_script = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   auth_user_pass_verify_script_via_file = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   auth_token_generate = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   auth_token_lifetime = 0
Sun Mar 21 22:23:58 2021 us=490282   client = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   pull = ENABLED
Sun Mar 21 22:23:58 2021 us=490282   auth_user_pass_file = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   show_net_up = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   route_method = 3
Sun Mar 21 22:23:58 2021 us=490282   block_outside_dns = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   ip_win32_defined = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   ip_win32_type = 3
Sun Mar 21 22:23:58 2021 us=490282   dhcp_masq_offset = 0
Sun Mar 21 22:23:58 2021 us=490282   dhcp_lease_time = 31536000
Sun Mar 21 22:23:58 2021 us=490282   tap_sleep = 0
Sun Mar 21 22:23:58 2021 us=490282   dhcp_options = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   dhcp_renew = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   dhcp_pre_release = DISABLED
Sun Mar 21 22:23:58 2021 us=490282   domain = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   netbios_scope = '[UNDEF]'
Sun Mar 21 22:23:58 2021 us=490282   netbios_node_type = 0
Sun Mar 21 22:23:58 2021 us=490282   disable_nbt = DISABLED
Sun Mar 21 22:23:58 2021 us=490282 OpenVPN 2.4.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 25 2019
Sun Mar 21 22:23:58 2021 us=490282 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Mar 21 22:23:58 2021 us=490282 library versions: OpenSSL 1.1.0j  20 Nov 2018, LZO 2.10
Enter Management Password:
Sun Mar 21 22:23:58 2021 us=491712 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Mar 21 22:23:58 2021 us=491712 Need hold release from management interface, waiting...
Sun Mar 21 22:23:58 2021 us=984264 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Mar 21 22:23:59 2021 us=89219 MANAGEMENT: CMD 'state on'
Sun Mar 21 22:23:59 2021 us=89759 MANAGEMENT: CMD 'log all on'
Sun Mar 21 22:23:59 2021 us=198539 MANAGEMENT: CMD 'echo all on'
Sun Mar 21 22:23:59 2021 us=198966 MANAGEMENT: CMD 'bytecount 5'
Sun Mar 21 22:23:59 2021 us=201056 MANAGEMENT: CMD 'hold off'
Sun Mar 21 22:23:59 2021 us=202054 MANAGEMENT: CMD 'hold release'
Sun Mar 21 22:23:59 2021 us=202054 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Mar 21 22:23:59 2021 us=204079 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 21 22:23:59 2021 us=204079 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 21 22:23:59 2021 us=204079 LZO compression initializing
Sun Mar 21 22:23:59 2021 us=204079 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1350)
Sun Mar 21 22:23:59 2021 us=204079 Control Channel MTU parms [ L:1472 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Mar 21 22:23:59 2021 us=204079 Data Channel MTU parms [ L:1472 D:1450 EF:122 EB:381 ET:0 EL:3 ]
Sun Mar 21 22:23:59 2021 us=204079 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1472,tun-mtu 1350,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Sun Mar 21 22:23:59 2021 us=204079 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1472,tun-mtu 1350,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Sun Mar 21 22:23:59 2021 us=204079 TCP/UDP: Preserving recently used remote address: [AF_INET]140.45.34.23:44443
Sun Mar 21 22:23:59 2021 us=204079 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Mar 21 22:23:59 2021 us=204079 UDP link local: (not bound)
Sun Mar 21 22:23:59 2021 us=204079 UDP link remote: [AF_INET]140.45.34.23:44443
Sun Mar 21 22:23:59 2021 us=204079 MANAGEMENT: >STATE:1616361839,WAIT,,,,,,
Sun Mar 21 22:23:59 2021 us=225791 MANAGEMENT: >STATE:1616361839,AUTH,,,,,,
Sun Mar 21 22:23:59 2021 us=225791 TLS: Initial packet from [AF_INET]140.45.34.23:44443, sid=e613749a 096d08b4
Sun Mar 21 22:23:59 2021 us=245176 VERIFY OK: depth=1, CN=Easy-RSA CA
Sun Mar 21 22:23:59 2021 us=246545 VERIFY OK: depth=0, CN=server
Sun Mar 21 22:23:59 2021 us=280067 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sun Mar 21 22:23:59 2021 us=280067 [server] Peer Connection Initiated with [AF_INET]140.45.34.23:44443
Sun Mar 21 22:24:00 2021 us=501022 MANAGEMENT: >STATE:1616361840,GET_CONFIG,,,,,,
Sun Mar 21 22:24:00 2021 us=501022 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Mar 21 22:24:00 2021 us=538872 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 4.4.4.4,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 1,cipher AES-256-GCM'
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: timers and/or timeouts modified
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: --ifconfig/up options modified
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: route options modified
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: peer-id set
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: WARNING: peer-id set, but link-mtu fixed by config - reducing tun-mtu to 1347, expect MTU problems
Sun Mar 21 22:24:00 2021 us=538872 OPTIONS IMPORT: data channel crypto options modified
Sun Mar 21 22:24:00 2021 us=538872 Data Channel: using negotiated cipher 'AES-256-GCM'
Sun Mar 21 22:24:00 2021 us=538872 Data Channel MTU parms [ L:1472 D:1450 EF:53 EB:381 ET:0 EL:3 ]
Sun Mar 21 22:24:00 2021 us=539867 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Mar 21 22:24:00 2021 us=539867 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Mar 21 22:24:00 2021 us=539867 interactive service msg_channel=624
Sun Mar 21 22:24:00 2021 us=546532 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=24 HWADDR=90:cc:df:39:82:03
Sun Mar 21 22:24:00 2021 us=574131 open_tun
Sun Mar 21 22:24:00 2021 us=575124 TAP-WIN32 device [Ethernet 5] opened: \\.\Global\{0B0173B1-664D-4380-8DEC-791607A2A92C}.tap
Sun Mar 21 22:24:00 2021 us=575124 TAP-Windows Driver Version 9.23 
Sun Mar 21 22:24:00 2021 us=575124 TAP-Windows MTU=1500
Sun Mar 21 22:24:00 2021 us=576758 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {0B0173B1-664D-4380-8DEC-791607A2A92C} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Mar 21 22:24:00 2021 us=576758 DHCP option string: 06080404 04040808 0808
Sun Mar 21 22:24:00 2021 us=576758 Successful ARP Flush on interface [3] {0B0173B1-664D-4380-8DEC-791607A2A92C}
Sun Mar 21 22:24:00 2021 us=579750 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sun Mar 21 22:24:00 2021 us=580747 MANAGEMENT: >STATE:1616361840,ASSIGN_IP,,10.8.0.6,,,,
Sun Mar 21 22:24:02 2021 us=297934 NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes.
Sun Mar 21 22:24:05 2021 us=842754 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Mar 21 22:24:05 2021 us=842754 C:\Windows\system32\route.exe ADD 140.45.34.23 MASK 255.255.255.255 192.168.1.1
Sun Mar 21 22:24:05 2021 us=857233 Route addition via service succeeded
Sun Mar 21 22:24:05 2021 us=857233 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Mar 21 22:24:05 2021 us=865141 Route addition via service succeeded
Sun Mar 21 22:24:05 2021 us=865141 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Mar 21 22:24:05 2021 us=871590 Route addition via service succeeded
Sun Mar 21 22:24:05 2021 us=871590 MANAGEMENT: >STATE:1616361845,ADD_ROUTES,,,,,,
Sun Mar 21 22:24:05 2021 us=871590 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Mar 21 22:24:05 2021 us=877088 Route addition via service succeeded
Sun Mar 21 22:24:05 2021 us=878063 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Mar 21 22:24:05 2021 us=878063 Initialization Sequence Completed
Sun Mar 21 22:24:05 2021 us=878063 MANAGEMENT: >STATE:1616361845,CONNECTED,SUCCESS,10.8.0.6,140.45.34.23,44443,,

TinCanTech

FranckFR wrote Sun Mar 21 22:24:02 2021 us=297934 NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes.

You have to wait for this to complete.

FranckFR

Sun Mar 21 23:53:47 2021 us=434047 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1444,1444] remote->local=[1447,1447]

TinCanTech

Yeah, that looks like your network MTU is broken.

FranckFR

Ok, and how/where should i fix it ? its it at my home ? at my work ? on the server ? on the router ?
what should a correct test look like in the results ?

FranckFR

when i set up tun-mtu 1472 for both server and client, i still have very bad transfert rates, but the test works, even tho im getting new errors :
Mon Mar 22 14:53:41 2021 us=418761 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:54:00 2021 us=521178 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:54:06 2021 us=431223 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1497,1497] remote->local=[1497,1497]
Mon Mar 22 14:54:17 2021 us=517815 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:54:27 2021 us=528240 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:54:35 2021 us=259271 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:54:39 2021 us=801266 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:54:44 2021 us=804681 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:55:00 2021 us=634476 PID_ERR replay-window backtrack occurred [18] [SSL-0] [0__________________000000000000000000000000000000000000000000000] 0:16058 0:16040 t=1616421300[0] r=[-2,64,15,18,1] sl=[6,64,64,528]
Mon Mar 22 14:55:03 2021 us=517081 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:55:08 2021 us=301865 read from TUN/TAP : Unknown error (code=234)
Mon Mar 22 14:55:13 2021 us=291924 read from TUN/TAP : Unknown error (code=234)

Pippin

Remove MTU related directives from server/client config.
Then try client side:

mssfix 1400

FranckFR

Pippin wrote Remove MTU related directives from server/client config.
Then try client side:

mssfix 1400

Hi Pippin, and thanks for trying to help me too !
I tried.
The DL rate increased, from 20ko/s to 200ko/s.
But it's still far from the 5mo/s i have without VPN.
When i try to open a xlsx file through a windows share (4Mo) it stills take more than 2minutes

Mon Mar 22 17:13:53 2021 us=340052 PID_ERR replay-window backtrack occurred [2] [SSL-0] [00_0002222222222222333333445788888888888888888888888888888888888] 0:325 0:323 t=1616429633[0] r=[-2,64,15,2,1] sl=[59,64,64,528]
Mon Mar 22 17:13:53 2021 us=489073 PID_ERR replay-window backtrack occurred [3] [SSL-0] [0_0_000000022222222222223333334457888888888888888888888888888888] 0:330 0:327 t=1616429633[0] r=[-2,64,15,3,1] sl=[54,64,64,528]
Mon Mar 22 17:13:53 2021 us=492064 PID_ERR replay-window backtrack occurred [4] [SSL-0] [00_0_00000000000222222222222233333344578888888888888888888888888] 0:335 0:331 t=1616429633[0] r=[-2,64,15,4,1] sl=[49,64,64,528]
Mon Mar 22 17:13:56 2021 us=324676 PID_ERR replay-window backtrack occurred [7] [SSL-0] [0_0_0_0_00000000000000000000000000000000000000000000000000000000] 0:798 0:791 t=1616429636[0] r=[0,64,15,7,1] sl=[34,64,64,528]
Mon Mar 22 17:16:37 2021 us=577252 NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1525,1525] remote->local=[1525,1525]

Pippin

Now add

sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

to the server side and try again.

FranckFR

Pippin wrote Now add

sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

to the server side and try again.

it's now around 400ko/s