2

Main server has 50x50 mbps dedicated fiber ISP. We currently have a Netgear FVS336Gv3 wired router with WAN to LAN throughput rating of 300 mbps. This device performs all routing to/from the internet to the openVPN server. openVPN server is running on a semi-dedicated x64 dell server running Ubuntu Server 14.04. We have a dedicated Ubuntu Server 14.04 x64 dell box that is our main file server, shares are hosted via Samba.

When remote openVPN clients are transferring files to/from the main file server over the VPN tunnel they never come close to saturating the bandwidth on either the client or server side.

For example, a 20 mbps download speed at a client never pulls a file across the VPN tunnel at 20 mbps, which theoretically could happen because upload speed at file server is 50 mbps.

My question is: would scrapping the Netgear FVS336Gv3 router for a dedicated x64 box running pfSense increase throughput over the VPN tunnel?

or

Is the lack of throughput over the VPN tunnel the result of hosting file shares using Samba?

Edit:

I'm thinking the latter but would like to hear from others. We transfer files to a remote Ubuntu Server via cert. secured SSH tunnel and I see (Cacti bandwidth graphs) that we are saturating the remote download connection at around 20 mbps, which is very close the ISP provisioned bandwidth at the remote site.

Bandwidth graph from Netgear router, you can see the spike in outbound bandwidth the night of 08 July; this is our backup to the remote server. During the prior work week, we never reached 2mbps outbound bandwidth and I know tons of files were tranfered via Samba and openVPN.

enter image description here

thanks.

  • When a transfert is done the % cpu of the netgear look like what ? The Qos of the tunnel look like what ? some router allow settings in % (like 50% max) to the tunnel to not put down your main WAN. As such, we miss the model number of your router – yagmoth555 - GoFundMe Monica Jul 11 '16 at 17:31
  • 1
    % cpu of netgear never gets above 10%. Tunnel does not have QoS enabled. Netgear router model is: FVS336Gv3 – dan Jul 11 '16 at 17:34
  • Thanks for the info, and your edit about ssh kinda remove the router from a possible cause there too – yagmoth555 - GoFundMe Monica Jul 11 '16 at 17:36
  • so, this is likely a limitation of Samba, SMB, CIFS, ect..? what about scrapping the ubuntu file server for Win Server 2012 and sharing files using a different protocol? – dan Jul 11 '16 at 17:43
  • Can't speak for that, I'am at a beginner level with samba, I will leave other time to answer you. (I'am more good in windows/router's side) – yagmoth555 - GoFundMe Monica Jul 11 '16 at 18:03
3

TCP/IP basics:

throughput <= TCP buffer size / RTT

image

My question is: would scrapping the Netgear FVS336Gv3 router for a dedicated x64 box running pfSense increase throughput over the VPN tunnel?

I doubt it, because ...

Is the lack of throughput over the VPN tunnel the result of hosting file shares using Samba?

Definitely no, your problem is latency between client and OpenVPN server (pfsense), I do have same setup like you:

SMB Client -> OpenVPN -> WAN <- pfSense <- OpenVPN Server <- LAN -> Samba server.

I wasn't able saturate 50 mpbs (my Windows 7 workstations with SMB 2.x, throughput max 10-12mbps, while Windows 8 and 10 upgraded with SMB 3.x doubled that result) until I added (server conf):

sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

On links with even longer latency you can use bigger buffers, try test it using 128KiB steps.

Reconfiguring samba to use;

socket options = TCP_NODELAY IPTOS_THROUGHPUT SO_RCVBUF=65536 SO_SNDBUF=65536

... is also good idea.

I use: UDP, lzo and tap device. Be sure to test (setting socket buffers) it using at least verb 4 in OpenVPN config file. Look for:

Thu Jun 30 11:39:08 2016 us=90400 nsa310-tryskacze/88.199.144.161:60218 SENT CONTROL [nsa310-tryskacze]: 'PUSH_REPLY,sndbuf 524288,rcvbuf 524288,route-gateway 10.1.2.0,ping 10,ping-restart 30,ifconfig 10.1.2.19 255.255.255.0' (status=1)

If you want to understand the problem:

https://community.openvpn.net/openvpn/ticket/461

https://www.lowendtalk.com/discussion/40099/why-openvpn-is-so-slow-cool-story

  • thanks! Latency over the VPN tun is 115ms, latency over WAN to the Netgear router is 75ms. My VPN client here is an old WRT54GL router. If I change the client to openvpnGUI.exe on my Win7 box the latency gets a little better over the VPN tun, roughly 100ms. My server is UDP; I tried setting the sndbuf and rcvbuf to 393216 and throughput got worse. Confirmed, Windows 10 box using the same WRT54GL vpn client gets 2x or 3x the speed, compared to Win7! Finally a valid reason to upgrade to Win10. – dan Jul 12 '16 at 13:36
  • I would not expect from WRT54GL better performance (as OpenVPN client) than 2 mbps. It's still good result for such old hardware with 200MHz CPU. Samba is bad tool for testing performance, you should use iperf to find your bottleneck(s). – Michal Sokolowski Jul 12 '16 at 14:43
0

Most of the heavy lifting in that circumstance is done by the OpenVPN server system, which sounds like resides on a system separate from the Netgear. From your description, it's unlikely the Netgear is the cause of the slow down, at least not because you're exceeding its capacity. Verify you don't have any traffic shaping or QoS configuration on it that would limit the throughput of the outer portion of the VPN.

pfSense would certainly increase your maximum achievable throughput, but that doesn't seem to be the reason for your VPN performance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.