4

On my VPS (Ubuntu 14.04 - 64-bit), which has OpenVPN 2.3.2-server installed, I'm getting disappointing performance. The VPN-server uses the AES-128-CBC cipher for encryption, and I have no firewall installed.

The problem is that the download/upload-speed is rather low. While doing some speed-tests, the average is around 45 Mbps. The actual speed will drop down to 20 Mbps, and go as high as 50 Mbps. While doing these tests, the CPU and server-load seem rather low.

I've tried changing the tun-mtu value on both the server and client, using different ciphers (blowfish etc.), upping the buffersize etc. My download-speed without the VPN-connection is around 180 - 190 Mbps (my ISP promises 200 Mbps), my upload is 10 Mbps. As you can see the difference is rather drastic and I'd like to up the download-speed as much as possible.

Using programs such as haveged from generating available entropy, no performance seems to be gained. My available entropy is always around 700 - 800 bits 3000 with haveged active, which is plenty enough?

The server itself has a 1 Gbit connection. A download test to the server confirms this speed (around 800+ Mbps). I've also tested downloading a random 1 GB file from the server to one of the VPN-clients without using the VPN-connection, and this gave me a download-speed of 180 Mbps (my maximum) on average.

I couldn't find much information on the internet about slow/low download-speeds with an OpenVPN-server that were helping. The thing that concerns me is that the CPU and server-load are very low (CPU usage is about 16 % on only one core (OpenVPN does not support multi/hyper-threading?) while doing speed tests).

If you'd like more information or details about my set-up or configuration, please ask.

EDIT 2015-02-28:

I'm once again trying to use an OpenVPN-server with only three (3) clients. Again, I'm facing the problem where the download speed does not max (not even half) my internet connection speed on the clients.

I've tested installing the OpenVPN-server on the host machine itself, and that gave me quite good results! But, I need to use the VPN server on a VPS (virtual machine) and not on a host machine. While downloading a 10 GB file, I can go as high as 10 MB/s (800 Mb/s), and averages at about 7,5 MB/s (60 Mb/s). My internet connection where the clients are connecting from is a 200 Mb/s connection. When doing various speed test without a VPN connection, I can reach an average of 180 Mb/s. While connecting through the VPN server (on the VPS!), the speeds at not even half the speed I should get. When connecting through the VPN server (on the HOST!), I can reach up to 120 Mb/s.

Both servers use about the same CPU usage while performing the tests and both have aesni support on the CPU. I've done some speed tests with openssl, but those seem very good and max. out CPU cores. I've also run watch -n 1 cat /proc/sys/kernel/random/entropy_avail while performing these tests, but the available entropy seems to not change that much while performing a download test. On both the host and the VPS it's around 850 - 900.

I'm out of ideas as to why the VPS server(s) differ that much in speed from the host. Could it be the Qemu (qemu-kvm) virtualised network interface?

  • Still no solution. Speed even further decreased to 10 and less Mbps. – Qlii256 Nov 7 '15 at 18:24
  • I've tried multiple entropy-generating-programs (such as haveged, mentioned below), but none seem to really help. The available entropy stays at around 800 bits. I've tried disabling fragment and mssfix (--fragment=0 --mssfix=0) and upping the mtu (--tun-mtu=2000), but also this does not affect my performance. I've looked more deeply into the systems' load while performing speed tests, but it doesn't seem to go that high. Using a higher cpu-clock or more cores doesn't really affect performance. The speeds sometimes go up to 50 - 55 Mbps, but then go back down to 20 or even 10 or lower Mbps. – Qlii256 Nov 8 '15 at 11:18
  • As you can read in my question now, the available entropy is around 3100 bits while having haveged active. It's a lot higher then the 800 bits while it's not active, but still does not seem to improve my speeds. I also think that the 800 bits is plenty enough, it never runs out of low while performing speed tests. – Qlii256 Nov 8 '15 at 12:44
  • How is the CPU usage on both OpenVPN endpoints (client and server) during the speed test? How much is the latency between endpoints? Test the latency when the link is saturated and when it is not saturated. 4 test in total. – Mircea Vutcovici Nov 8 '15 at 13:08
  • 1
    It is interesting to see how the latency is degrading when you do a network test over VPN. It is important to see the if the degradation is only inside the OpenVPN link or also outside. If the degradation is only in OpenVPN, then you should focus on OpenVPN performance. – Mircea Vutcovici Nov 8 '15 at 13:16
4

Whenever I see someone on a VPS, and they mention encryption or SSL performance problems, the first thing that comes to mind is they're running the random pool dry.

Try installing "haveged" and see if that fixes the problem. If it does, carefully read the documentation and the caveats of using a pseduo random number generator and it's security implications.

EDIT

Why install "haveged"? Any encryption operation depends heavily on high quality random numbers. Therefore, your throughput will eventually be limited by the rate at which you can generate them. On a VPS, you may not have all the entropy sources available that you would on bare metal. This can exhaust the pool (try cat /proc/sys/kernel/random/entropy_avail), causing your program to block while more randomness is stirred into the pool. Haveged uses the HAVEGE algorithm which, depending on your use case, may be less secure. It'll be up to you to decide it's worth the risks that may apply to your situation. :) Haveged is a daemon that runs in the background to keep the kernel entropy pool full and stirred. No change to your software should be required other than maybe a reboot of your VPS (depends on your setup).

  • Thanks for sharing that information! I'll try "haveged", although I know nothing about it. Can you further explain as to why this could possibly help my situation? Do you mean I should use "haveged" instead of OpenSSL for encryption? – Qlii256 Nov 2 '15 at 21:26
  • No, haveged just keeps the entropy pool full that openssl sips from. They do different things to you can't replace one with the other. – Jonathan S. Fisher Nov 2 '15 at 21:36
  • Thank you for the information! I've read your edit and I'll try this tomorrow. The security is not that big of a problem, as long as my data is still encrypted over the internet in a a way that it is not just plain text and not that easy to crack. One thing that I still don't fully understand is why my CPU usage is very low, considering that the pool can not keep up with the requests? – Qlii256 Nov 2 '15 at 21:39
  • Because the CPU doesn't generate entropy technically ;) It can only sample entropy, not create it (This is classical physics, unless you're a quantum physicist). – Jonathan S. Fisher Nov 2 '15 at 21:43
  • 2
    +1 for giving me unexpected knowledge expansion. – ErikE Nov 3 '15 at 0:57
0

OpenVPN over UDP

If you are running OpenVPN over UDP, you might get a better experience by setting fixed buffer values. Try these lines into your client configuration file (*.ovpn or *.conf).

sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

https://winaero.com/blog/speed-up-openvpn-and-get-faster-speed-over-its-channel/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.