Slow OpenVPN Speeds over Gigabit WAN

[tschaffner]

Hi Guys

This is my first post in this forum! Thanks for having me.

I am having troubles getting a good performance on an OpenVPN installation using latest Access Server and OpenVPN Connect Client.
We are a medium sized media group and due to the current situation in europe with the virus, we are looking to have a VPN solution that is trimmed to performance, instead of high security! On the Server side we have a symmetrical gigabit WAN connection, and the ESXI installation is connected over 40Gb/s fiber optics. We do have a Firewall running between the switches/OpenVPN Server and the WAN connection, so that is something to keep in mind. Speedtest of this Gigabit WAN to the nearest available external speedtest server gives us something around 800mbit/s up and download.

On the client side on a completely other ISP in a building 6 miles away i am also testing with a symmetrical gigabit connection. With speedtests i am coming in at around 700mbit/s up and down. So theoretically the highest available bandwith in this scenario on paper is 700mbit/s

I am running the Access Server ESXI virtual machine on 24 Cores Xeon CPU, 16GB RAM with the Virtual Harddrive having a tested 300-400MB/s read and write speeds. On the client side i am testing with a 8-Core MacOS client and a 12-Core Windows 10 client, both with a gigabit connection to a switch on the same gigabit WAN connection.

I have tested the speeds below with iperf3 both on the MacOS and Windows 10 VPN Client to iperf3 running on the VPN Access Server itself over the VPN Tunnel by using

Code: Select all

iperf -c <local VPN Server IP> -P 10

When i just set up OpenVPN Access Server and disable the cipher by setting "cipher none", i am getting around 60-80mbit/s
I have followed this guide to disable the cipher:
https://openvpn.net/vpn-server-resource ... ss-server/

I have then followed this guide and read through it to do some more testing and performance improving:
https://community.openvpn.net/openvpn/w ... orks_Linux

The best i could get was 200-250mbit/s by using the following settings on both the server and the client:
However, this only reflects in MacOS, in Windows it is still at 60-80mbit/s

Code: Select all

cipher none
txqueuelen 1000
mssfix 0
tun-mtu 24000

Those speeds i am seeing, pretty closely resemble what i am getting when transfering files over AFP on the MacOS and SMB on the Windows 10 machine. For this, i am using a 140TB fileserver we have in the same local subnet as the VPN Access Server connected over multi 20Gbit/s fiber optics. Local speeds on this fileserver over gigabit ethernet are saturating a gigabit connection with around 120MB/s.

Somewhere in the guide, it states that using MTU changes doesn't help if you're going over the WAN, but i'm not sure how that translates to my setup, since it seems tuning the MTU gets me alot better performance. Also what's kind of strange is that they get speeds with

Code: Select all

cipher none

that are nearly close to saturating a gigabit connection. A lot in this article is mainly for tuning the cipher and encryption method, so for me, this means i should see speeds closer to 600-700 mbit/s on both MacOS and Windows even without tuning most of the things in their guide, since i am using no encryption at all except that i have not set

Code: Select all

auth none

I am using only UDP for the VPN, i only opened up this Port and the HTTPS for the Webclient on the Firewall. I have set the VPN Server to use multi-daemon mode, and have set it accordingly to my 24 Core CPU to 24 daemons. I have checked CPU usage on both clients and the Server and it is pretty much zero as expected since i am not using any encryption for the traffic. I am not sure how to use the

Code: Select all

auth none

setting, because i think we do want authentication to the VPN by using local db users or RADIUS, and not just anybody can connect. But i am not sure if that is the same, or if this is some different auth setting...

The Firewall that is in between really is just configured to route traffic through from the WAN to the OpenVPN Server, i am not sure if it does anything with the packages. I will try to get more info on that by our partner that did the Firewall installation, but maybe we can find a solution that doesn't require reconfiguring the firewall but just optimizing the VPN itself.

Sorry if i forgot any important infos. Panic broke out here the last few days in the company because of COVID and that's why i had to look into OpenVPN really quick and dirty yesterday and have worked my way onto a working solution in just one day, but i am in no means a pro when it comes to OpenVPN! Thank you alot in advance for every single tip you can give me regarding Performance boosts!

[tschaffner]

Alright, i have done more tuning and testing

I have now disabled auth by disabling "TLS Auth Settings" in the advanced settings.
I also have tested the tunnel not over WAN, but using the local network. I now reach around 400mbit/s over LAN through the tunnel and i reach around 300mbit/s over WAN. If i test RAW performance using iperf not over the tunnel i get 940mbit/s. So this means i still only get half of what is expected through the tunnel, firewall aside. Any idea what settings can improve the tunnel?

[tschaffner]

More tuning:

Code: Select all

sndbuf 524288
rcvbuf 524288

does nothing!

Current settings:

Code: Select all

auth none
cipher none
txqueuelen 1000
mssfix 0
tun-mtu 1500

results in a LAN speed of 520mbit/s to 580mbit/s
It seems that a lower MTU does better... I also tested with 9000 but that's pretty much the same. But its better than 24000 or 48000 or 60000.
I also tested with iperf on another server in the same LAN, so that the VPN Server doesn't also have to do iperf and VPN traffic on the same server, but it doesn't make any difference.
When i run iperf on the VPN Server and another virtual machine running on the same ESXi that are connected to the same switch i get 4.2Gbit/s (lol) so there is definitely no network issue in the virtual environment.

Best i've gotten so far is 500+ mbit/s on local LAN, which expected should be 900+ mbit/s...

[tschaffner]

Okay, with those settings i get 900+ mbit/s over LAN, but only 150mbit/s over WAN...

Code: Select all

auth none
cipher none
txqueuelen 1000
mssfix 0
tun-mtu 9000

I don't know what to do...