Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question is whether to use TCP of UDP for my openVPN connection. I've set up a simple network for a startup company that allows users from the outside to acces the network via an openvpn server (in routing mode). The only thing users will do with the vpn is accessing files.

The priority is to keep the integrity of the files intact. With that in mind, should i use the UDP of TCP protocol for my vpn tunnel? I've read up on reliability-layer collisions (i.e. on http://openvpn.net/index.php/open-source/documentation/security-overview.html) but since tcp, the openvpn transport layer and the tunneled TCP session can all provide the reliability checks for me it leaves me wondering what would work best for me.

So, should i use TCP or UDP in this situation?

Thank you for your help.

share|improve this question

1 Answer 1

UDP. Always UDP for tunneled connections if you can swing it from a network/firewall perspective. The underlying TCP flows will take care of retries if necessary. If you used TCP at the OpenVPN layer, you end up in a situation where both layers can send duplicate packets in the case of loss. This can cause significant performance problems.

share|improve this answer
2  
one thing to add. always UDP unless we're setting up 'road warrior' scenario for users connecting from different networks/locations. for them VPN running on 443/tcp might be the last resort to access internal resources from some hotels, airports and other locations where the traffic is heavily filtered. –  pQd Mar 25 '13 at 12:55
    
Good catch, @pQd. I would add that it's not hard to set up another "server" on the same physical host serving as a OpenVPN gateway which would listen 443/tcp. So the OP could first go with normal UDP setup and amend it with the TCP later, if needed. –  kostix Mar 25 '13 at 13:40
    
you can also run multiple openvpn servers on the same machine/ip address, just different ports [and tcp / udp - depending on the necessity] –  pQd Mar 25 '13 at 15:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.