OpenVPN Support Forum

Params:
Server: OpenVPN x86_64 2.3.14-1.el7 from epel repository
Server: CentOS Linux release 7.3.1611, 1 CPU @ 2.6 Ghz, 2048 RAM
Client1: OpenVPN 2.3.14 with GUI under Windows XP
Client2: OpenVPN 2.4.0 with GUI under Windows 7

What happens:
Regular network usage for surfing, youtube watching, ping -t'ing and so on works flawless. On both TCP and UDP protocols only occasional packet losses (poor server) and no disconnects. When I try to stress test bandwidth, OpenVPN client drops the connection and requests authentication. It happens on any stress test - uTorrent, FlashGet or IPERF between two openvpn clients in less than a minute of testing.

What have I tried:

• Switched betweed UDP and TCP protocols
• Tried setting ping-restart 0
• Different keepalive values
• Different tls-timeout values
• comp-lzo on and off
• increasing verbosity to 5
• looking into wireshark

Authentication with FreeRADIUS works fine. The issue appears only when I create around 10 Mbit/s of bandwidth.
Here're the logs:

• http://pastebin.com/raw/rjp1C0EV server
• http://pastebin.com/raw/4shNTPzR client

Could it be the issue of server performance? However, server isn't loaded more than on 20% of CPU (by htop data).
Any help would be extremely appreciated. Or even the direction of possible issue source or advice how to narrow the field to search in.

WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.

TLS: soft reset sec=-150 bytes=75320841/67108864 pkts=84686/0

The solution is to use cipher AES-256-CBC on both server and client.

I should read logs more careful. Thank you very much. I love how one quotation and a smile becomes the perfect solution =)
I was confused because first I didn't use cipher directive in config and it was set by default value. And the default was BF-CBC also.