OpenVPN Bandwidth tweaking

[Tamo]

Hi all,

we are searching some tips or advices about vpn speed.

we try to connect 2 networks with OpenVPN in site to site connection. 1 router is a RT-AX88U (3004.388.4), the other one is an OpnSense router.
Both sites have 1Gb/s fiber connection but the bandwidth throught VPN is limited to ~40Mb/s.

We have tried hard to have successful connection but we need a better speed.
We tried a speed test with iperf. 440Mb/s with direct connection via Internet with a port forwarding. 40Mb/s throught OpenVPN.

The configuration is as follow :
Tun
UDP
Auth Mode with Static Key
KEys and certificates generated by AsusMerlin router.
HMAC : Auth SHA 256
Cipher : AES-128-CBC
Compression : LZO

Custom conf :
sndbuf 0 (also pushed)
rcvbuf 0 (also pushed)

Is someone as tips to have a better speed.

Regards

Tamo

 

[ColinTaylor]

Maybe the problem is the hardware in the OpnSense router.

 

[Tech9]

1 router is a RT-AX88U

This one can do about 200Mbps on OpenVPN.

Disable compression, deprecated in newer OpenVPN versions.

 

[RMerlin]

Also use AES-128-GCM - saves a bit of overhead as it won`t require a separate SHA hash.

 

[Quoc Huynh]

Custom conf :
sndbuf 0 (also pushed)
rcvbuf 0 (also pushed)

Maybe you can try:

fast-io
data-ciphers AES-128-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-128-GCM

 

[Tamo]

thanks we will try it.
GCM seems to be not supported. VPN server won't start and system logs says that
Dec 4 18:02:00 ovpn-server2[4086]: Cipher 'AES-128-GCM' mode not supported
Dec 4 18:02:00 ovpn-server2[4086]: Exiting due to fatal error


Perhaps we can add it by side.

 

[Nagy Imre]

Asus GT-AXE16000

my speed is only 200Mbit/sec.
If I read correctly, it should know 250 Mbit/sec.

Did I set everything up correctly?

Data ciphers: AES-128-GCM:AES-256-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305
THX

 

[RMerlin]

my speed is only 200Mbit/sec.
If I read correctly, it should know 250 Mbit/sec.

Not every server will be able to hit the theorical limit. If you get 200+, then you are within the expected range.

 

[L&LD]

Yes, 'up to'.