SSH tunnel for socks5 proxy is slow with concurrent load

Question

I ssh to a remote AWS server using Ubuntu. I use ssh's port forwarding capabilities to do this. I have tried forwarding a dynamic port (ssh -D) or a single port (ssh -L with dante running as a remote socks server). Both are equally slow. I also tried different ciphers (ssh -c).

Concurrent TCP connections pretty much do not work. For example, I can go to speedtest.net and start a test (which is fairly fast, probably maxes out my line speed) and if I try and do anything (i.e. load google.com) while the test is still running, all the additional connections seem to hang until the speed test is over.

I realize OpenSSH is single-threaded. Is this the problem? It doesn't even show up on my top. Same goes for sshd on the remote server -- no processor hit.

Is there anyway to bump ssh performance or should I step up to OpenVPN or something better suited for this?

Answer 1

Try to remove dante out of equation.
Simple

ssh -D 1080 username@server

Followed by setting in the browser your socks 5 proxy as localhost:1080

And repeat your test.

Let's say I'm not using proxy right now and I'm in Chicago area
Below test was done from me to the nearest server possible, no proxy involved

http://beta.speedtest.net/result/5790745951

Now let's set up ssh -D proxy and set my browser to use proxy. Speed test now will detect that my traffic exit point is somewhere in California (since I'm running my AWS in California availability zone)
Here is my test with socks 1080 (no dante)

http://beta.speedtest.net/result/5790754004

It's obvious there is speed decrease. First of all my traffic needs to go from me to California, and then exit on another side of the ssh tunnel and hit speedtest server, then come back. On top of this since it's running inside ssh tunnel - there is also added latency since ssh needs to encrypt / decrypt every packet.

However while speed test was running I was able to browse other sites just fine. Slower but not to the point where it's painful

I will now remove proxy from my browser settings and will select direct connection to somewhere in California.

http://beta.speedtest.net/result/5790802203

So obviously it's faster now, it's actually practically same speed as direct connection to Chicago.
That proves that 99% of latency is added by ssh tunnel.
As others suggested - you can setup squid and test your speed with squid. Perhaps it will have better performance.

Answer 2

This is likely because every time SSH needs to setup a connection to the host it needs to go all the way to AWS then back out to the server you are trying to contact. Basically this adds the latency from your machine to the AWS machine and the AWS machine to the server your contacting.

Try ping the AWS machine from your workstation and record the latency, then ping the host your contacting from the AWS machine and record that latency. Add the two together and that is the theoretical maximum latency that you can achieve over that link. OpenVPN and SSH cannot beat this limit, however if your traffic is mostly HTTP then you could setup a caching squid server on the AWS machine, or your local machine to decrease the amount of requests that have to travel over this link.