I've been trying to improve my OpenVPN performance and this is my current setup:
cat /etc/openvpn/server.conf port 443 #- port proto tcp #- protocol dev tun #tun-mtu 1500 tun-mtu-extra 32 #mssfix 1450 tun-mtu 64800 mssfix 1440 reneg-sec 0 ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt cert /etc/openvpn/easy-rsa/2.0/keys/server.crt key /etc/openvpn/easy-rsa/2.0/keys/server.key dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem plugin /etc/openvpn/openvpn-auth-pam.so /etc/pam.d/login #plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Comment this line if you are using FreeRADIUS #plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS client-to-client client-cert-not-required username-as-common-name server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" push "dhcp-option DNS 220.127.116.11" push "dhcp-option DNS 18.104.22.168" keepalive 5 30 comp-lzo persist-key persist-tun status 1194.log verb 3
client dev tun proto tcp remote 22.214.171.124 443 resolv-retry infinite nobind tun-mtu 64800 tun-mtu-extra 32 mssfix 1440 persist-key persist-tun auth-user-pass comp-lzo verb 3
I made some changes to MTU and MSSFIX from what I found on the web.
Are there any kernel changes I could make? This is a CentOS 6.x box. I found some stuff for BSD based but nothing that worked for Linux.
I know TCP is slower then UDP but I need to be able to look like SSL traffic to get thru a firewall on the network.
PING to another client on the network which I RDP into.
Pinging 10.8.0.6 with 32 bytes of data: Reply from 10.8.0.6: bytes=32 time=152ms TTL=128 Reply from 10.8.0.6: bytes=32 time=565ms TTL=128 Reply from 10.8.0.6: bytes=32 time=152ms TTL=128 Reply from 10.8.0.6: bytes=32 time=782ms TTL=128 Ping statistics for 10.8.0.6: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 152ms, Maximum = 782ms, Average = 412ms
Are there any ways to improve performance or drop the ping some?
EDIT: Would setting the fragmentation setting help some?