I ssh to a remote AWS server using Ubuntu. I use ssh's port forwarding capabilities to do this. I have tried forwarding a dynamic port (ssh -D) or a single port (ssh -L with dante running as a remote socks server). Both are equally slow. I also tried different ciphers (ssh -c).

Concurrent TCP connections pretty much do not work. For example, I can go to speedtest.net and start a test (which is fairly fast, probably maxes out my line speed) and if I try and do anything (i.e. load google.com) while the test is still running, all the additional connections seem to hang until the speed test is over.

I realize OpenSSH is single-threaded. Is this the problem? It doesn't even show up on my top. Same goes for sshd on the remote server -- no processor hit.

Is there anyway to bump ssh performance or should I step up to OpenVPN or something better suited for this?


This is likely because every time SSH needs to setup a connection to the host it needs to go all the way to AWS then back out to the server you are trying to contact. Basically this adds the latency from your machine to the AWS machine and the AWS machine to the server your contacting.

Try ping the AWS machine from your workstation and record the latency, then ping the host your contacting from the AWS machine and record that latency. Add the two together and that is the theoretical maximum latency that you can achieve over that link. OpenVPN and SSH cannot beat this limit, however if your traffic is mostly HTTP then you could setup a caching squid server on the AWS machine, or your local machine to decrease the amount of requests that have to travel over this link.


Try to remove dante out of equation.

ssh -D 1080 username@server

Followed by setting in the browser your socks 5 proxy as localhost:1080

enter image description here

And repeat your test.

Let's say I'm not using proxy right now and I'm in Chicago area
Below test was done from me to the nearest server possible, no proxy involved


Now let's set up ssh -D proxy and set my browser to use proxy. Speed test now will detect that my traffic exit point is somewhere in California (since I'm running my AWS in California availability zone)
Here is my test with socks 1080 (no dante)


It's obvious there is speed decrease. First of all my traffic needs to go from me to California, and then exit on another side of the ssh tunnel and hit speedtest server, then come back. On top of this since it's running inside ssh tunnel - there is also added latency since ssh needs to encrypt / decrypt every packet.

However while speed test was running I was able to browse other sites just fine. Slower but not to the point where it's painful

I will now remove proxy from my browser settings and will select direct connection to somewhere in California.


So obviously it's faster now, it's actually practically same speed as direct connection to Chicago.
That proves that 99% of latency is added by ssh tunnel.
As others suggested - you can setup squid and test your speed with squid. Perhaps it will have better performance.

  • That is a good answer. I would just add that ssh is also part of the equation here. SSH has fixed socket buffer sizes on the client and the server. The size and options vary with ssh version. User space vpn's like OpenVPN and Tinc still have encryption overhead, but do not have the buffer limits of ssh. – Aaron Apr 24 '17 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.