need to reduce keepalive / idle openvpn traffic

NewtownGuy

I need to reduce the keepalive / idle traffic because I use wireless networks where every byte per hour counts. I need to configure both the client and server to reduce the bandwidth wasted by failed attempts to connect.

I've been using keepalive 10 120 in server.conf, but that gives way too much idle traffic when a connection is up. I've tried changing it to keepalive 60 120, but I don't know what the effects on performance and reliability are. What is the system-level impact of these and other, possibly larger, values ?

How do I configure the client so that even if it can't connect, it does not flood its end with excessive attempts to restart the connection ?

Thank you in advance.

-- NewtownGuy

janjust

you could even turn off keepalives altogether, with the risk of losing your connection and not knowing about it.

To limit the number of reconnects use

--connect-retry-max n

NewtownGal

to: JanJust

Thank you, but that doesn't help. I need the client to keep trying indefinitely because there can be long periods without a connection. I just to minimize how frequently the client tries to connect, and thus much bandwidth the client wastes trying to connect. And, I need to reduce the bandwidth used by keepalive when there is a connection.

--

janjust

in tcp mode you can specify an interval between (re)connects using

--connect-retry n

this does not work in udp mode as the client has no way of knowing if a packet arrives or not; the best thing to do there is to have openvpn try to connect once, then use a 'sleep' command in a script and try again.

Keepalives don't have an impact on performance, unless you specify the interval to be 1 second. The longer the keep-alive interval the longer it will take either end of the openvpn connection to detect whether the connection is no longer alive. On a stable line you could easily use

keepalive 600 600

but on a wifi connection this might lead to spurious results - YMMV.

NewtownGuy

to: JanJust

Thank you.

In my low bandwidth world, keepalives DO affect performance -- just not in the way you may be used to thinking. I often have only a 128 Kbps uplink, which is much less than the amount of keepalive 10 120 traffic, so the keepalive traffic starves my data transmission for bandwidth.

I'm still not clear how I configure a udp client to minimize how often it tries to connect. I'm not talking keepalive at this point since there's no connection yet, and keepalive is set in the server not the client, unless there's a keyword I'm missing.

How do I configure a udp client to control how many times, and how often, it tries to make a connection ?

How do I configure a tcp client to control how often it tries to make a connection ?

And, if I'm trying to have multiple OpenVPN tunnels running simultaneously, how can I tell which is which in Ubuntu 'ps -A' to be able to tell if there's an active connection or not in case I want to restart only the ones that are not active, as you suggested with a cron script ?

--

Bebop

NewtownGuy wroteIn my low bandwidth world, keepalives DO affect performance -- just not in the way you may be used to thinking. I often have only a 128 Kbps uplink, which is much less than the amount of keepalive 10 120 traffic, so the keepalive traffic starves my data transmission for bandwidth

You do realize how ridiculous this sounds right?

First:

Keepalive only sends packets when the connection to the client is idle. Read the man page. Also, If you think 10 seconds is too short -- make it 45 seconds (--keepalive 45 60)

Second:

128 kbps uplink = 120,000 bytes per second
Keepalive = 4 bytes per 10 seconds second = 0.4 bytes per second.

So keepalive uses 0.000001 % of your total bandwidth, and you say its starving your connection? Janjust has already told you that keepalives will not affect your performance, and I can tell you that janjust is right.

NewtownGuy

to: bebop

typo: I meant 128 bps, not Kbps.

Your figure of 4 bytes every 10 seconds for keepalive is way too low. A typical ping packet has 64 bytes, which, if sent once every 10 seconds, gives an average of 51 bps for the uplink alone. That's 40% of my uplink speed. And, I keep connections to several OpenVPN servers open as fallbacks, multiplying the bandwidth requirements.

You said keepalive only runs when the link is idle. What algorithm does OpenVPN use to determine idle ?

What size of ping packet does OpenVPN use ? How do I change it ?

--

Bebop

NewtownGuy wrote typo: I meant 128 bps, not Kbps

Less than 1 packet per second? I call BS.

That is 437 times slower than a 56K modem.

1 packet is 1400 bytes, unless you set the MTU to less than 128, which means a regular single packet of 1400 bytes would take more than 10 seconds to send.

So, 1 regular size packet per 10 seconds.

At this speed, 1 MB would take more than 2 hours to transfer.

And still -- if all that were somehow accurate -- keepalive only transfers when the connection is idle, so keepalive would be the least of your problems.

Since you didn't know that keepalives are only activated on an idle connection, I do believe you haven't fully read the man page yet.

HINT: read the man, and look for this: "Ping remote over the TCP/UDP control channel if no packets have been sent for at least n seconds".

NewtownGuy wroteI've tried changing it to keepalive 60 120, but I don't know what the effects on performance and reliability are

Performance: No affect
Reliability: Slower to realize disconnections

Bebop

Double post

janjust

I fully agree with Bebop: your bandwidth cannot be 128 bps - that's worse than a 300 baud modem from the 70s.

q305noonce

I arrived at this OpenVPN forum page via https://encrypted.google.com/search?q=openvpn+too+much+keep+alive+bandwidth.

I use SecurityKISS VPN (http://www.securitykiss.com/) and Klink - Tether Without Root (https://play.google.com/store/apps/details?id=com.faveset.klink). Klink does an exceptional job of getting my android cell phone to share its Internet connection with my MacBook computer and SecurityKISS VPN, which makes use of OpenVPN, does an exemplary job of providing a virtual private network(VPN) through which I use the Internet.

In various contexts, I have, for years, heard the phrase "innocence lost" used and, often enough, I felt the term was misapplied. However, with all the talk about SSL/TLS possibly being broken (https://luxsci.com/blog/is-ssltls-really-broken-by-the-beast-attack-what-is-the-real-story-what-should-i-do.html / http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/print.html), etcetera, I kind of feel that some manner of "innocence" has been lost with regard to my Internet use. And although I have probably never been naive when it comes to the potential dangers of using the Internet, I, for example, installed antivirus and a third party firewall on my MacBook as soon as I got it some years ago, I am feeling, more and more, like I should never use the Internet without a virtual private network.

For more than one reason, however, it is important to me to limit the bandwidth associated with my Internet use, as closely as I can, to only what is absolutely necessary. So, the first thing I do when "idle Internet traffic" gets my attention is try to determine the minimum amount of such traffic that is necessary.

I have, of necessity, used Internet "pinging/keepalive" for a good number of years. The point of pinging, of course, is to regularly send data packets to keep the connection(link) from breaking, as I came to understand, but, in my quest to use as little idle bandwidth as possible, I tried smaller and smaller packet(data) sizes. Ultimately, I found I could ping 1 byte every 3 seconds, or so, and still succeed in keeping the Internet connection from breaking or "stalling/pausing".

When I first started using SecurityKISS VPN, however, I immediately noticed that OpenVPN was, apparently, engaged in some manner of keepalive of its own. SecurityKISS can make use of OpenVPN, L2TP, or PPTP, but OpenVPN is what I prefer SecurityKISS to use. Further, I realized that the OpenVPN keepalive packets were, apparently, considerably larger than I was comfortable with. Naturally, I turned off my own pinger, because SecurityKISS' OpenVPN pinging was certainly enough to sustain the connection, but, as I watched my bandwidth accumulate on a daily, even hourly, basis I still longed to do something more to reduce the bandwidth consumed by OpenVPN's keepalive packets.

The next thing I did was begin turning off my Internet connection, remember, I use Klink - Tether Without Root to share my cell phone's Internet connection, entirely unless I was actively doing something on the Internet. My bandwidth numbers were still higher than I needed, though.

Although it was important for me to reduce the amount of idle bandwidth consumed by OpenVPN'S keepalive packets I should also mention that the particulars of my Internet situation are probably somewhat unique. I roughly estimated OpenVPN's keepalive traffic would consume somewhere between 1 and 3 gigabytes per month in additional(idle) bandwidth and I realize that would, likely, not be of concern to the majority of Internet users. For me, however, it was/is very important to avoid avoid accumulating that additional monthly bandwidth and, at the same time, I also felt(feel) that the increasingly dangerous environment of the Internet meant that it would not be a good idea to stop using a virtual private network. SecurityKISS VPN with OpenVPN also seems like the best virtual private network solution I have found, based on speed and ease of use; so, I felt there were no alternatives that made sense for me to use.

I only contacted http://SecurityKISS.com support reluctantly, because the OpenVPN keepalive bandwidth, ultimately, seemed reasonable and, at the time that I contacted them, I did not think there would be anything they could do. They confirmed that OpenVPN does "send keep-alive messages" and they told me "it's not a lot of traffic". So, considering that the SecurityKISS VPN package I am using includes 50GB per month I, again, feel that it is only because of the unique particulars of my Internet situation that the OpenVPN keepalive traffic causes me concern. And when I am using free WIFI, available at a good number of locations where I live, then, I do not worry about bandwidth consumed by OpenVPN keepalive traffic at all.

The next thing I did was search Google for "openvpn too much keep alive bandwidth", which referred me to this forum. I learned, by reading this thread, that "OpenVPN keepalive only sends packets when the connection to the client is idle". As a result, I turned my own pinger back on, 1 byte every 3 seconds, and my bandwidth usage seemed to drop to the levels I was accustomed to, despite the fact that I was(am) still using SecurityKISS VPN with its OpenVPN implementation. So, my understanding, based on what I have read in this thread, is that SecurityKISS' openvpn process sends no keepalive packets at all, because it "detects" that my connection is active, not idle, since I am pinging a server every 3 seconds, with 1 byte of data. Is that right?

valent

q305noonce wroteI roughly estimated OpenVPN's keepalive traffic would consume somewhere between 1 and 3 gigabytes per month in additional(idle) bandwidth and I realize that would, likely, not be of concern to the majority of Internet users.

I would like to know how did you estimage OpneVPN usage to 1-3GB per month? I'm running OpenVPN (tcp not udp) and I'm seeing around 1GB of idle usage per month. tcpdump showed that OpenVPN sends multiple pakets per second, why? Isn't it enough to send some keepalive every few seconds?

Screenshot of Wireshark: http://imgur.com/XzP4xxV

Traffic

valent wroteI'm running OpenVPN (tcp not udp)

I have been running a TCP VPN for 12 hours and have not had a single packet transferred over the VPN and no time-outs.

For --dev tun over TCP only, simply disable --keepalive and --ping/--ping-restart etc.