2

For an OpenVPN server, with AES-256-CBC encryption, LZ4 compression, and forwarding traffic to internet, official requirements states:

As a rule of thumb you should assume that on a modern CPU with AES-NI chipset, for every megabit per second of data traffic (in one direction) you need about 20MHz

this means that for 6Gbps (two directions), hardware requirements for the server are a total of:

6Gbps x 2 = 12Gbps

12 x 1000 / 20 = 600GHz (assume 1Gb = 1000Mb).

The example from OpenVPN is (250 active users with 10Mbps each):

2500Mbps times 20MHz is about 50000MHz or 50GHz. Processors with 3.5GHz for example in dual octa-core setup would get you over those requirements.

Which means OpenVPN will use 16 CPU cores of 3.5GHz to get a total of 50GHz.

It breaks every "internet forum rule" as per 'OpenVPN uses only a single core'.

What is the explanation to this clear guideline in OpenVPN official hardware requirements saying multiple CPU cores, solve scaling issue?

They call 2.5 Gbps: "A reasonably demanding setup", with no word about having to split the load to multiple VPN instances on different ports.

How can that be?

OpenVPN Hardware Requirements

Improve this question
3
  • "What is the explanation to this strict 20MHz per 1Mbps" Where is is a strict requirement. Your quote says, "As a rule of thumb you should assume..." That is a far cry from strict. Also, remember that encryption will greatly reduce throughput. For example, a particular Cisco router model tops out (bidirectional) at about 1.8 Gbps, but with encryption, it tops out at less than 200 Mbps, and all this is with hardware assist for routing that most PCs do not have.
    – Ron Maupin
    Jul 2, 2020 at 17:00
  • @RonMaupin i thought the question was clear enough. i'll explain better. OpenVPN draws a clear line between number of cores and the server performance. Both OpenVPN server main logic and AES enc/dec itself is said to work single-threaded (except GCM). If so, how multi-core helps? which part of the flow can utilize multiple cores?
    – RoeeK
    Jul 2, 2020 at 18:51
  • I was not answering your question, I was merely pointing out the flaw in your question that says it is strict, when it actually says it is a rule of thumb (an educated guess), which is a far cry from strict.
    – Ron Maupin
    Jul 2, 2020 at 18:53

4 Answers 4

Reset to default
3

What is the explanation to this strict 20MHz per 1Mbps, split to multiple cores, in OpenVPN official hardware requirements? is there a different implementation for OpenVPN Access?

It's not a strict thing it's a rule of thumb, a guestimate.

You won't be able to get that kind of throughput with a single OpenVPN instance. You will need to run multiple instances, each listening on a different port and have your firewall redirect new connections randomly to them from your main inbound port. This may not be useful if you want a single client connection but should work well for multiple clients.

You may want to take a look at WireGuard which is built into recent Linux kernels and is available as a kernel module for many distros with kernels >= 3.10. WireGuard is very CPU efficient and can easily saturate a 1Gbps link (and more).

Improve this answer
2
  • i edited my question to be more clear. i'm not asking how to scale my openvpn server, but how OpenVPN requirements stating that multiple cores solve scaling problem, if the server is single-threaded?
    – RoeeK
    Jul 2, 2020 at 21:13
  • can wireguard can serve as a ethernet vpn or only ip ?
    – EchoMike444
    Jul 3, 2020 at 6:00
2

I checked with OpenVPN Access Server support regarding the question: what's OpenVPN Access Server magic that allows it to utilize multiple CPU cores.

According to the answer:

  1. There's no difference in this matter between Access Server and community edition, the engine is the same.

  2. OpenVPN Access Server just opens multiple OpenVPN instances, and load-balance between them. The same standard scaling method for community edition.

Also relevant and non-documented information is regarding how automated is Access Server scaling process. It's a bit off-topic, but I believe it's interesting for people reading this post:

  • The load-balancing is done with iptables.
  • The user needs to configure how many OpenVPN processes should be used.
  • Each OpenVPN instance has its own listening port, TUN/TAP interface, and virtual subnet.
  • OpenVPN Access Server maintains the routing between the different instances (between clients of each instance)
  • in Layer2, all the TAP interfaces will be bridged under a single interface to allow clients in different instances know each other.
Improve this answer
0

This link ( OpenVPN Hardware Requirements ) seem to be for the non-community product .

In this old document i can reference to a V3 that is async/multithread https://community.openvpn.net/openvpn/wiki/RoadMap

A new client for linux that have the label v3 https://github.com/OpenVPN/openvpn3-linux .

Improve this answer
0

I am not and Engineer but interested. Why isn't OpenVPN 2.6 outperforming Wireguard with today Core CPUs? Most Enterprise VPN Routers can achieve 200Mb/s with OpenVPN. If Wireguard could be an upgrade option, would the performance be limited on that same hardware for a 2Gbps?

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .