OpenVPN Support Forum

Hi.

My first post.

I had setup openvpn and connect 2 networks to my company network, I use pfsense 2.0RC3 server+clients Site2Site PKI.

The networks I join to the company are windows machines, I'm sharing files(samba), http servers, mysql servers is most of the services they are accessing.

One topic took my attention, mtu, how important it is for tunning our VPN.

Exist a option in openvpn to know what are the values both ends are using(mtu size)?

Because I see that we have a option called mtu-test that went a server-client start the connection the server do a test to get the best value for the connection, but in my case, testing the log say:

Empirical MTU test completed [Tried,Actual] local->remote=[1557,1557] remote->local=[1557,1557]

But if I try from both sides with the don't fragment the size specify 1557 won't work, the maximum size I can cross without fragmenting the packet is 1472 testing with ping.

This is a server, could I setup this value for each client?

openvpn 2.2 thanks

the MTU tests shows that your network is capable of at least transmitting 1500 byte packets , which is normal for TCP/IP networks and which is also very good!

the maximum 'ping' payload for a standard ethernet network, and for your VPN, is 1472 bytes, the other 28 bytes are overhad. So it seems that your VPN is tuned pretty well and there is no need to use the 'fragment' parameter.

the reason that you're seeing values LARGER than 1500 is due to the encryption and possible compression that OpenVPN performs - as long as you're seeing values over ~ 1540 bytes then you're in good shape.

Thanks janjust for your input, them my vpn is ready to rock