Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've set up an OpenVPN server on a VPS running Centos 5.7 via UDP. Clients connect to it on boot and if-up, get issued a 10.5.5.x address. The server runs mail, samba and jabber servers. OpenVPN is set up so that clients can see each other, so ping, jabber, ssh, scp, etc. work. The tun interface is for this subnet only, so normal internet traffic doesn't get routed. All clients are Ubuntu 11.10.

I'm having issues with network traffic though. It seems that whenever there is a larger amount of data to be transferred (scp peer-to-peer, sending larger mail attachments to the server, file transfer via Pidgin/XMPP, VNC peer-to-peer) the activities time out. At least I think they do, because the activity just hangs. For example:

user@somehost:~$ scp Desktop/ss.png root@10.5.5.55:/home/otheruser/Desktop/
ss.png                                      100% 849KB 848.7KB/s 00:00

and it just hangs there. ctrl-c doesn't work. smaller files go trough without a problem. scp'ing that file to the server and then scp'ing it to the intended peer works.

Ping latency over VPN (client to server) varies from 90 to 300 ms, depending on client.

So I'd appreciate some pointers on stuff to read up on regarding tweaking the network settings so that all intended transfers go trough as intended.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

This feels like an MTU issue: small files work, large ones don't.

openvpn has a --mtu-test option to probe for the size of the MTU over the link. You can run that.

If it shows an MTU of less than 1500, you might want to look at the "fragment" and/or "mssfix" options.

Look at the docs http://openvpn.net/index.php/manuals/427-openvpn-22.html for MTU-related options/discussion.

share|improve this answer
    
yeah, adding mssfix 1400 on the server fixed it. thanks. –  sostacked Apr 26 '12 at 9:43

I've done quite a bit of OpenVPN speed testing in the past, and it's always come down to my CPU maxing out for the speeds. Since OpenVPN doesn't support multiple processors, it can only run as fast as the one processor will allow it. So I would highly recommend looking at the CPU usage of the server when downloading these large files. From here you will have to start tuning your server.conf settings.

  • Test various encryption standards (I ended up using AES-128-CBC for the fastest/best encryption from my testing)
  • Test udp vs tcp (I ended up using udp)
  • Use a smaller dh key size (1024 over 2048)
  • Lower the verbosity of the logging (this will eat up less CPU and leave more room for the encryption)
  • Test various settings such as rcvbuf, sndbuf, tun-mtu, tun-mtu-extra, mssfix, fragment, fast-io, auth-none (after most of these tests I ended up just using fast-io because the others didn't affect the speed much on my tests)

Every setup is going to be slightly different but those are a few things I would look into if I were you. Unfortunately I can't find the document of my actual speed tests.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.