0

I have openvpn running on a router (openwrt) and I am trying to maximize the throughput. I tried to lower the bits used for certs, but it didn't seem to impact the speed. Guess that short certs equals shorter logon times (which is unimportant as the router is always on). I tried to change and tweak the conf and cipher, but speed remains the same.

This is my server.conf

port 443
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/se01.crt
key /etc/openvpn/keys/se01.key
dh /etc/openvpn/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
;duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/keys/ta.key 0 
cipher AES-256-CBC
;cipher AES-128-CBC
;cipher none
;max-clients 100
user openvpn
group nogroup
persist-key
persist-tun
status openvpn-status.log
log         /dev/null 
log-append  /dev/null
verb 3
;mute 20
explicit-exit-notify 1

and here the client

key-direction 1
client
dev tun
proto udp
remote 5.150.254.167 443
resolv-retry infinite
nobind
verb 3
auth-nocache
persist-key
persist-tun
remote-cert-tls server
;user nobody
;group nogroup

cipher AES-256-CBC
;cipher AES-128-CBC
;cipher none

-----HERE BEGINS MY CERTS ETC-----

I try to disable encryption I get this output. I am not sure how to read it, but it looks like to me that "cipher AES-256-GCM" is used. Is that correct, and how do I change it so that "cipher AES-256-GCM" is not pushed?

Tue Feb  6 08:53:16 2018 OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Tue Feb  6 08:53:16 2018 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
Tue Feb  6 08:53:17 2018 ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
Tue Feb  6 08:53:17 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  6 08:53:17 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  6 08:53:17 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]5.150.254.167:443
Tue Feb  6 08:53:17 2018 Socket Buffers: R=[163840->163840] S=[163840->163840]
Tue Feb  6 08:53:17 2018 UDP link local: (not bound)
Tue Feb  6 08:53:17 2018 UDP link remote: [AF_INET]5.150.254.167:443
Tue Feb  6 08:53:17 2018 TLS: Initial packet from [AF_INET]5.150.254.167:443, sid=7e98aa7d eaee25ee
Tue Feb  6 08:53:17 2018 VERIFY OK: depth=1, C=DE, ST=DE, L=Berlin, O=Data Privcy, CN=Data Privcy CA, name=Data Privcy, [email protected]
Tue Feb  6 08:53:17 2018 VERIFY KU OK
Tue Feb  6 08:53:17 2018 Validating certificate extended key usage
Tue Feb  6 08:53:17 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Feb  6 08:53:17 2018 VERIFY EKU OK
Tue Feb  6 08:53:17 2018 VERIFY OK: depth=0, C=DE, ST=DE, L=Berlin, O=Data Privcy, CN=Data Privcy CA, name=Data Privcy, [email protected]
Tue Feb  6 08:53:17 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Feb  6 08:53:17 2018 [Data Privcy CA] Peer Connection Initiated with [AF_INET]5.150.254.167:443
Tue Feb  6 08:53:18 2018 SENT CONTROL [Data Privcy CA]: 'PUSH_REQUEST' (status=1)
Tue Feb  6 08:53:18 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13,peer-id 0,cipher AES-256-GCM'
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: route options modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: peer-id set
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: adjusting link_mtu to 1624
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: data channel crypto options modified
Tue Feb  6 08:53:18 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Feb  6 08:53:18 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  6 08:53:18 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  6 08:53:18 2018 TUN/TAP device tun0 opened
Tue Feb  6 08:53:18 2018 TUN/TAP TX queue length set to 100
Tue Feb  6 08:53:18 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Feb  6 08:53:18 2018 /sbin/ifconfig tun0 10.8.0.14 pointopoint 10.8.0.13 mtu 1500
Tue Feb  6 08:53:18 2018 /sbin/route add -net 5.150.254.167 netmask 255.255.255.255 gw 192.168.2.1
Tue Feb  6 08:53:18 2018 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Tue Feb  6 08:53:18 2018 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Tue Feb  6 08:53:18 2018 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.13
Tue Feb  6 08:53:18 2018 Initialization Sequence Completed
^CTue Feb  6 08:54:27 2018 event_wait : Interrupted system call (code=4)
Tue Feb  6 08:54:27 2018 /sbin/route del -net 10.8.0.1 netmask 255.255.255.255
Tue Feb  6 08:54:27 2018 /sbin/route del -net 5.150.254.167 netmask 255.255.255.255
Tue Feb  6 08:54:27 2018 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Tue Feb  6 08:54:27 2018 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Tue Feb  6 08:54:27 2018 Closing TUN/TAP interface
Tue Feb  6 08:54:27 2018 /sbin/ifconfig tun0 0.0.0.0
Tue Feb  6 08:54:27 2018 SIGINT[hard,] received, process exiting

What can do to optimize throughput besides getting a router with a better CPU?

2
  • 1
    No, the cipher you see is used for "Control Channel". It is used for rekeying and other side-channel exchanges between the client and the server. Still, I see no reason to completely disable encryption: if you're on a fully controlled LAN, then simply do not use OpenVPN and use netcat instead. If you're transferring data over an untrusted network, I hardly imagine the case where you wouldn't use any encryption at all these days.
    – kostix
    Feb 6, 2018 at 12:02
  • You can also try other methods of securing node communication with wireguard or zerotier. Personally I ebayed an optiplex 7010 i5 for $150 and installed pfsense for this same issue. AES-NI makes a big difference Feb 6, 2018 at 13:04

1 Answer 1

3

This is 'Negotiated Cipher Parameters' at work; the 'cipher' option is overridden by the (default) 'ncp-ciphers' list. This is new since OpenVPN 2.4. Also see the man page:

   --cipher alg
          Encrypt data channel packets with cipher algorithm alg.

          The default is BF-CBC, an abbreviation for  Blowfish  in  Cipher
          Block  Chaining mode.  When cipher negotiation (NCP) is allowed,
          OpenVPN 2.4 and newer on both client and server side will  auto‐
          matically   upgrade   to  AES-256-GCM.   See  --ncp-ciphers  and
          --ncp-disable for more details on NCP.

and

   --ncp-ciphers cipher_list
          Restrict the allowed ciphers to be negotiated to the ciphers  in
          cipher_list.   cipher_list is a colon-separated list of ciphers,
          and defaults to "AES-256-GCM:AES-128-GCM".

          For servers, the first cipher from cipher_list will be pushed to
          clients that support cipher negotiation.

So if you want e.g. AES-128-GCM (which is probably slightly faster than AES-256-GCM), add ncp-ciphers "AES-128-GCM" to your server config.

Though, for speed optimizations, you can likely gain more from tweaking the network options. See e.g. https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .