Slow connection

snapplepop

I have an OpenVPN server running on a burst.net vps with an open-wrt router as the only client. When OpenVPN is enabled, the download speed is very slow. I would love it if you could take a look at my configs and/or offer any advice to fix this. To test my speeds, I've been using a curl script:

curl -o /dev/null http://speedtest.wdc01.softlayer.com/downloads/test500.zip

I've turned the encryption off, and my speeds are still terribly slow.

speed test of VPS (openVPN server):

root@265122:~# curl -o /dev/null http://speedtest.wdc01.softlayer.com/downloads/test500.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  500M  100  500M    0     0  11.1M      0  0:00:44  0:00:44 --:--:-- 11.1M

speed test of openVPN client (with openVPN enabled):

root@OpenWrt:/etc/openvpn# curl -o /dev/null http://speedtest.wdc01.softlayer.co
m/downloads/test500.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  2  500M    2 11.0M    0     0  40249      0  3:37:06  0:04:47  3:32:19 30913^C

As you can see, I couldn't even wait for it to finish.

speed test of openVPN client (with openVPN disabled):

root@OpenWrt:~# curl -o /dev/null http://speedtest.wdc01.softlayer.com/downloads
/test500.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  500M  100  500M    0     0  1761k      0  0:04:50  0:04:50 --:--:-- 2961k

Server.conf

local 1.2.3.4
port 443
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/serverdefault.crt
key /etc/openvpn/keys/serverdefault.key  # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist serverdefault-ipp.txt
client-config-dir ccd
route 192.168.1.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher none
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/serverdefault-status.log
log-append  /var/log/openvpn/serverdefault.log
verb 3
mute 20

Client (open-wrt) config file:

config openvpn sample_client
        option enable 1
        option client 1
        option dev tun
        option proto tcp
        list remote "1.2.3.4 443"
        option resolv_retry infinite
        option nobind 1
        option persist_key 1
        option persist_tun 1
        option mute_replay_warnings 1
        option ca /etc/openvpn/keys/ca.crt
        option cert /etc/openvpn/keys/owrt.crt
        option key /etc/openvpn/keys/owrt.key
        option ns_cert_type server
        option cipher none
        option comp_lzo 1
        option verb 10
        option log      /etc/openvpn/openvpn.log
        option mute 20

Any ideas why my downloads are so slow? Thanks guys!

rainbow6

Check if your vps is having 10.0.0.0 for softlayer own vpn for its server management.
Trying using 172 or some private ip subnet.

snapplepop

rainbow6- i don't think my vps is using 10.0.0.0 for anything, but I tried your advice and I still had the same problems.

As a test for myself, I took the open-wrt router out of the question entirely and ran openvpn on a laptop plugged directly into my cable modem. My speeds on the laptop running openvpn were ~1 Mbps vs. the 1.6 Mbps down on laptop plugged into the cable modem without openvpn running. This leads me to believe that something is wrong with my openvpn/firewall/network config on the open-wrt box. ...right?

Here are my configs:

Open-wrt firewall config:

config defaults
        option syn_flood        1
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT
config zone
        option name             lan
        option network          'lan'
        option input            ACCEPT
        option output           ACCEPT
        option forward          ACCEPT
config zone
        option name             wan
        option network          'wan'
        option input            REJECT
        option output           ACCEPT
        option forward          ACCEPT
        option masq             1
        option mtu_fix          1
config forwarding
        option src              lan
        option dest             wan
config rule
        option name             Allow-DHCP-Renew
        option src              wan
        option proto            udp
        option dest_port        68
        option target           ACCEPT
        option family           ipv4
config rule
        option name             Allow-Ping
        option src              wan
        option proto            icmp
        option icmp_type        echo-request
        option family           ipv4
        option target           ACCEPT
config rule
        option name             Allow-DHCPv6
        option src              wan
        option proto            udp
        option src_ip           fe80::/10
        option src_port         547
        option dest_ip          fe80::/10
        option dest_port        546
        option family           ipv6
        option target           ACCEPT
        option name             Allow-ICMPv6-Forward
        option src              wan
        option dest             *
        option proto            icmp
        list icmp_type          echo-request
        list icmp_type          destination-unreachable
        list icmp_type          packet-too-big
        list icmp_type          time-exceeded
        list icmp_type          bad-header
        list icmp_type          unknown-header-type
        option limit            1000/sec
        option family           ipv6
        option target           ACCEPT
config include
        option path /etc/firewall.user
config  rule
        option target ACCEPT
        option dest_port        443
        option src      wan
        option proto    tcp
        option family   ipv4
config  rule
        option target ACCEPT
        option dest_port        1194
        option src      wan
        option proto    udp
        option family   ipv4

my firewall user script is:

iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT

and my open-wrt network config:

config 'interface' 'loopback'
        option 'ifname' 'lo'
        option 'proto' 'static'
        option 'ipaddr' '127.0.0.1'
        option 'netmask' '255.0.0.0'

config 'interface' 'lan'
        option 'type' 'bridge'
        option 'proto' 'static'
        option 'ipaddr' '192.168.1.10'
        option 'netmask' '255.255.255.0'
        option 'gateway' '192.168.1.1'
        option '_orig_ifname' 'eth1'
        option '_orig_bridge' 'true'
        option 'ifname' 'eth1 tun0'

config 'interface' 'wan'
        option 'ifname' 'eth0'
        option 'proto' 'dhcp'

config 'switch'
        option 'name' 'eth1'
        option 'reset' '1'
        option 'enable_vlan' '1'

config 'switch_vlan'
        option 'device' 'eth1'
        option 'vlan' '1'
        option 'ports' '0 1 2 3 4'
        option 'vid' '1'

config 'switch_port'
        option 'pvid' '1'
        option 'port' '0'

config 'switch_port'
        option 'pvid' '1'
        option 'port' '1'

config 'switch_port'
        option 'pvid' '1'
        option 'port' '2'

config 'switch_port'
        option 'pvid' '1'
        option 'port' '3'

config 'switch_port'
        option 'pvid' '1'
        option 'port' '4'

config 'switch_port'
        option 'pvid' '1'
        option 'port' '5'

Does anything look like poorly configured?

padhu

what os are you using?I am having same problem... 🙁

Mimiko

snapplepop, as you've already seen, the laptop has the almost whole speed over OpenVPN. Definatelly a problem with the router. You've better post same results to openwrt forums. In the router may be some traffic shapping enabled. Or QoS interfere. Even may be that the internal processing power of the router can't handle the vpn traffic.