OpenVPN Performance, specifically number of connections

limecat

I am trying to figure out how one determines max number of active OpenVPN tunnels a server can handle. My understanding is that CPU determines the number of connections per second and aggregate bandwidth that a server can handle, while max active sessions is determined by RAM-- is that accurate?
Using this server as a reference (running pfSense, a FreeBSD OS),
http://www.hacom.net/catalog/jupiter-iii-1u-server-pfsense-appliance
Is there any reason it couldnt handle 1000+ active OpenVPN tunnels (as it can handle several thousand IPsec tunnels)?

Any pointers would be appreciated.

I would also be interested in knowing, on a (eg) quad core processor, if I have a single OpenVPN server instance, will multiple clients be distributed across cores, or would I need one OpenVPN instance per core I wished to utilize? Or would the base OS determine that?

ecrist

A single instance of OpenVPN tends to be limited around 250 connections, in practice. There is no real hard limit, but that's what the limit seems to be. After that, you end up doing too much context switching within the kernel, performance falls way off. OpenVPN is single-threaded. HTH

Sent from my HTC Glacier using Tapatalk

limecat

It does help, but raises a few other questions.

First, if context switching is the cause, and assuming the CPU was single core / single thread, would creating additional instances help at all?
If the CPU was multi-threaded (ie, Xeon with HT), would that change the answer to my first question?

Finally, is this something specific to OpenVPN? Is there any reason it would or would not apply to, for example, IPsec or PPTP (assuming same OS and CPU)?

Thanks.

Edit:
Ecrist answered my questions in IRC, this topic can be closed.
For the record, multiple instances on a 1 thread 1 core CPU would not have helped, and using HT is not generally recommended. Multiple instances on multiple processors would however help, and could be done gracefully with DNS round robin.