OpenVPN Site-To-Site without static key but 2 fixed IPs

bartjoo

Hello, i setup my 2 routers with OpenVPN
(http://www.dd-wrt.com/wiki/index.php/OpenVPN_-_Site-to-Site_routed_VPN_between_two_routers)

It works but its to slow because of the VPN encryption (1.6MB/s). When i disable the static key its 3.3MB/s.
So, i want to disable it but then everyone can connect.

So how can i made a IP check of the connection? So if router 2 want to connect without a static key and router 1 checks the IP adres if its correct. Then its oke for now.

Who can help me? tnx in advance!

janjust

try using

local <ip1>
remote <ip2>

on one end, and the address reversed on the other end.

bartjoo

Hello JanJust

I think the question is something else.

I have 1 server router. IP X
I have 3 client routers. IP A,B,C

I want to disable the encryption function at the routers.
So i need something else (secure). So i want a check on server side.

Router X must check if Router A got the WAN IP adress A en then its oke.
If it is WAN IP "G" he must drop the connection.

janjust

the 'local+remote' config is the way to specify the remote address for both endpoints.
How will 3 clients connect to 1 server using static keys? are you running three separate openvpn processes on the server router?

bartjoo

Deleted

janjust

why are you putting the tun adapters in promiscuous mode? it will not achieve much except induce a performance penalty...

as for the 'remote' statements:

in 'Config for Site-to-Site Server-Client1' add

remote client1-ip

and similarly for client2 and client3.

bartjoo

Hoi JanJust, je komt uit Amsterdam zie ik 🙂 dus net zo goed in het Nederlands.

Kunnen we misschien even bellen?

bartjoo

Ik heb Remote toegevoegd en werkt inderdaad. (geen encryptie is ook minder beveiligd voor nu maar ALLA.🙂

De performance is nog steeds niet om over naar huis te schrijven. ook zonder die promisc up statement. (dus weg gehaald).
2,5MB/s haal ik maar terwijl het 5 - 18 moet kunnen zijn.

nog meer tips? mijn router laat niet echt pieken zien. dus zou volgens mij meer aan moeten kunnen.
Anders een idee om op mijn server OPENvpn te installeren? werkt dat? heb het wel eens geprobeerd maar kom niet ui de settings om netwerken aaan elkaar te knopen.

janjust

a dd-wrt box should be able to do ~ 40 Mbps, esp without any encryption. Try adding

fragment 1400
mssfix

to all config files and reconnect them

bartjoo

Oke tnx! are there more options? i got 3MB's now. i need 4-5 for HD movies 🙂

janjust

hmm what is the 'raw' iperf performance between 2 routers (or between 2 pcs behind the routers) ?

also, play with the fragment size a bit: try values in order of 1400 -> 1000 -> 1300 -> 1100 -> 1200 to see which value gives you the best performance. I'd try it with one connection first, then copy it over to the others.

bartjoo

Hello, what do you mean with :
hmm what is the 'raw' iperf performance between 2 routers (or between 2 pcs behind the routers) ???

the network behind the routers is 1GB. connection 🙂

I will try the other options. tnx

bartjoo

I tried 1100 - 1400 but its not better 🙁

# Config for Site-to-Site Server-Client3
echo "
proto udp
port 1998
dev tun2
fragment 1100
mssfix
remote X.X.X.X
#secret /tmp/static.key
verb 3
comp-lzo
keepalive 15 60
daemon
" > Server-Client3.conf

But i got only 1,5 - 3MB's 🙁 🙁

janjust

hmm what is the 'raw' iperf performance between 2 routers (or between 2 pcs behind the routers) ???

what kind of performance does 'iperf' report when testing between two different networks, each behind a dd-wrt box?

bartjoo

Hello JanJust, how do i check this?

My network without VPN = 20MB/s
Internal is 60MB/s

janjust

run iperf on one of the dd-wrt boxes , or run it on a PC behind the dd-wrt box, then use port forwarding + firewalling on the dd-wrt to forward TCP port 5001 to that PC ; you should be able to launch an iperf session from the other network using

  iperf -c <remote-ip>