Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I have OpenVPN successfully running on a VPS server which I'm connecting to from my laptop whenever I need it. The performance, once I connect, is really really poor. It's like 10% of my performance without being connected to the VPN - by performance I mean internet speed.

So I read on the internet that tcp is not good and I should switch to udp on the server and client for a better experience. Problem is, I can't make my client-server connection work under udp protocol. TCP is fine, I have a new ip, encryption etc but not UDP.

Here's my server config:

mode server
dev tun
proto udp
port 1194
script-security 3
tls-auth ta.key 0
keepalive 10 120
client-cert-not-required
username-as-common-name
auth-user-pass-verify "/usr/bin/python /etc/openvpn/auth.py" via-env
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
tls-auth /etc/openvpn/easy-rsa/2.0/keys/ta.key 0

user nobody
group nogroup
server 10.8.0.0 255.255.192.0

persist-key
persist-tun
status openvpn-status.log

verb 3

push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
log-append /var/log/openvpn
comp-lzo

And my client config:

dev tun
client
script-security 3
proto udp
remote xxx.xxx.xxx.xxx 1194
nobind
persist-key
persist-tun
ca ca.crt
tls-auth ta.key 1
comp-lzo
verb 0
auth-user-pass /home/manilodisan/Desktop/vpn/auth.txt

if I change the 'proto' directive to udp all starts working. Any ideas?

share|improve this question

1 Answer

up vote 0 down vote

The following are taken from my working OpenVPN configuration that connects several machines, my laptop included, to my VPS. One key difference of note is that I'm actually using the X.509 certificates for authentication of my clients but that shouldn't make a difference between using TCP or UDP.

First the server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.x.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

And finally the client.conf

client
dev tun
proto udp
remote vpn.example.com 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3
share|improve this answer
Unfortunately that doesn't change anything besides things I already tried so far. Thanks for trying tough :) – Romeo M. Jul 24 '11 at 15:56
Are you running through a firewall? Have you tried to run a sniffer and see what's going on network wise? – Jeremy Bouse Jul 24 '11 at 16:16
No firewall. I flushed all possible iptables rules just to make sure. The box is new with ubuntu installed and no firewall configured. I have no idea why tcp works out of the box while udp doesn't answer. – Romeo M. Jul 24 '11 at 16:36
And nothing showing up in the log files to indicate why the connection is not being established? – Jeremy Bouse Jul 24 '11 at 23:41
Found out I was connecting to one of the ips on that server and not the main ip. I guess I have to explicitly allow udp traffic in this case. – Romeo M. Jul 25 '11 at 1:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.