How can we make openvpn to utilize multiple cores ?

chariac463

Hi,

I understood that OpenVpn uses single core/cpu for processing and I want to understand the config changes to be done for making the OpenVpn utilizing multiple cores and it should be based on load but not for different subnets.

Can anyone help me on answering my question please.

TinCanTech

Openvpn is single threaded.

openvpn_inc

Hi char,

OpenVPN Access Server uses a kludge to distribute client connections among multiple listening openvpn daemons, which are one per CPU core, on different cores. The VPN address pools are split up into parts; for example, with 4 CPU cores and a /20 netblock and one daemon per each of TCP and UDP, each daemon would get a /23 of addresses. (The pool/pools is/are divided into 8 parts.) Elaborate iptables(8) DNAT rules direct a new client connection to the least busy core.

To be honest I do not know how those processes are assigned to the separate cores. I always have wondered about that. I guess I am in a good position to ask. 🙂

Access Server is free (gratis) for use for no more than 2 concurrent connections, so feel free to check it out if you're interested.

Community openvpn version 2.6 will have a DCO (data channel offload) feature which will do a cleaner job of sharing the workload among multiple CPU cores. It's in active development now, available for Linux (using a kernel module) and soon as a patch for the BSD kernel. See https://community.openvpn.net/openvpn/wiki/StatusOfOpenvpn26 for information

Perhaps you'd be interested in helping to beta test it? If so IRC is a good place for that. Every Wednesday afternoon (European time) is a community meeting on IRC. See https://community.openvpn.net/openvpn/wiki/IrcMeetings for information, including agendas and chat logs. I can rarely go because I'm in UTC-5.

regards, rob0

chariac463

Hi ,

Do you mean openvpn access utilizes 1 core for 1 subnet ?

Another query is, If we run multiple instances of openvpn, does one instance takes one core ?