openvpn performance issue MTU

[isillo]

server broadband speed: download 26 Mbps, upload 2.7Mbps.

1) Whats speeds should I expect when connected through this openvpn? Im getting download 2.4Mbps, upload 2.1Mbps. Is that right? Both clients speeds cannot be faster than 3/4 of servers upload speed?


Another question:
Im having problems with connecting to this openvpn from one of the places Im visiting. I think there is a MTU issue in that network. Clients connect to openvpn server and some thing works, other things not.
Sometimes connection stalls, usually with upload not coming through vpn. So I think there is MTU issue in that particular network.

I have run ping test from that network and output is:
from windows:
ping google.com -f -l 1416 - thats the biggest ping I can make it work (1416).
Now the bit that I dont understand: when testing this with android app in logs Im getting info that biggest transferable packet is 1444. That would make sense (1416 + 28 overhead is 1444).
But in wireshark that ping (1416) is shown as 1458 (so 1416 + 42). Where that 42 comes from? I thought calculation is like data (1416) + udp overhead (28) + 20 IP overhead, but that would give 48, not 42.

Anyway, I want to configure client and server for best performance in that network.

Running client with mtu-test option I got output that best MTU is 1413. Why 1413 and not 1416?

I was playing around with client/server settings and I used link-mtu 1413 on both client and server and that seems to be working ok. Is that best solution for performance in this particular network?
Maybe link-mtu 1416 would be better?
Or should I forgot about link-mtu and set some tun-mtu, mssfix and fragment? If so, can you tell me what values should I put?
Also I dont want to this server to be downgraded to use link-mtu 1413 from all places Im connecting to it, so is it possible to make this client working on lower MTU settings and other clients from other
networks works on default settings for best performance?
I think its possible to use link-mtu, tun-mtu and mssfix only on client config and not on server config (with warnings, no errors). Only fragment settings needs to be on both settings.

Please tell me how to solve it.


CLIENT CONFIG:
client
dev tun
proto udp
remote my_domain.com 500
float
cipher AES-256-CBC
comp-lzo yes
keepalive 15 60
auth-user-pass
ns-cert-type server
key-direction 1
resolv-retry infinite
nobind


SERVER CONFIG:
server 10.0.0.0 255.255.255.0
proto udp
port 500
dev tun
cipher AES-256-CBC
comp-lzo yes
keepalive 15 60
verb 3
push "route 10.10.10.0 255.255.255.0"
client-config-dir ccd
client-to-client
ccd-exclusive
route 192.168.2.0 255.255.255.0
push "route 192.168.2.0 255.255.255.0"
route 192.168.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
route 192.168.1.0 255.255.255.0
route 192.168.3.0 255.255.255.0
push "route 192.168.3.0 255.255.255.0"
push "redirect-gateway def1"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
max-clients 10

 

[L&LD]

What router? What firmware?

You are limited by the router's cpu for VPN performance and this may be all you can achieve.

 

[System Error Message]

this is not related to the MTU. What router are you using?

 

[isillo]

My router is Asus RT-AC68U. Firmware 3.0.0.4.378_4585. Shouldnt be that bad with this router I think. System Error Message why you think its not with MTU?

 

[System Error Message]

Because with the wrong MTU setting all the router does is fragment the packets which can cause a performance problem if the processor thats fragmenting it is overly loaded. It is known that openvpn server is not yet optimised so it runs on one core only

The throughput you listed is correct because the link is limited by the slowest link. Any server is limited by its upload.

 

[isillo]

I understand now why throughput is correct. During openvpn session the Asus rotuer shows cpu usage around 50-80%.
I dont agree with that bit regarding MTU. Openvpns network has correct MTU, but clients network (behind some fancy watchguard router with deep packet inspection etc) has MTU lowered for some reason and this watchguard router not fragmenting too big packets as from whan I can see with ping they not coming through at all. Without link-mtu setting the openvpn tunnel dies after 20-30 seconds. With link-mtu 1413 it works as it should with 2.4/2.1Mbps speed. Can I do any further configuration changes to get better proformance? Like tun-mtu, mssfix, fragment instead link-mtu?

 

[System Error Message]

the link MTU works on layer 4. PPPOE works on layer 2. Its basically squeezing a layer 4 packet into a layer 3 packet into some layer 2 packet.

 

[sfx2000]

Because with the wrong MTU setting all the router does is fragment the packets which can cause a performance problem if the processor thats fragmenting it is overly loaded. It is known that openvpn server is not yet optimised so it runs on one core only

The throughput you listed is correct because the link is limited by the slowest link. Any server is limited by its upload.

Couple of things...

1) OpenVPN doesn't need to be pinned to a particular core - and in ARM, OpenVPN, is erm interesting due to particulars with the cores and context switching - the fact that OpenVPN is userland, and single threaded, sometimes it's better to pin it to a core, but not a requirement - the context switching - app sends packets to the stack in the kernel, the tun driver redirects to userland, and then back down - pretty inefficient... happens on the other end as well. And we won't disucss OpenSSL impact or efficiency here...

As a result - OpenVPN, while being highly portable, will always be the least efficient of the bunch, compared to L2TP/PPTP/IPSec, which all live in Kernel space...

2) On Linux - It's not OpenVPN that is constrained, it's the TUN/TAP driver that is pinned in the kernel - it has to maintain the message queues and keys, so for security purposes, it's pinned, not the OpenVPN process..

3) Since OpenVPN is using UDP as transport, should open up MTU/MSS for TCP - experiment to see what the other end allows - but consider that for all intents and purposes, MTU size is largely not an issue, but an opportunity to improve by seeing how many TCP frames we can stuff into that pipe...

 

[sfx2000]

Example of why OpenVPN is a design issue...

 

[kvic]

If OpenVPN endpoint 2 is a "VPN router" such as ARM based Asus, are there any routing tricks could apply to increase the throughput from VPN to "the world" ?

I found that throughput to iperf on LAN in OpenVPN endpoint 2 is much higher than throughput to "the world". Curious to know what makes a difference. I checked CPU is not the limiting factor in the latter scenario.