0

Please help me to solve the VPN speed problem with Strongswan. I setup IKEv2|EAP2 tunnel with simple client-server config on my server to use it as a secure gateway to browse the Internet. Everything works as fine but it is very slow. My server connection is 100Mbit/s, but I get only about 20Mbit/s. Without VPN 100% of bandwidth can be utilized (for example, using SCP). MTU is 1500. I Googled for a few hours, but cant find a solution. Please point me to the right direction to solve this.

ipsec.conf

config setup
    # strictcrlpolicy=yes
    uniqueids = yes
    charondebug="ike 0, knl 0, cfg 0"

# Connections --------

conn %default
    closeaction=clear
    dpddelay=300s
    dpdtimeout=300s
    dpdaction=restart
    fragmentation=yes
    forceencaps=yes
    keylife=20m
    keyexchange=ikev2
    rekeymargin=3m
    keyingtries=1
    rekey=no

    auto=add
    compress=no
    type=tunnel

    left=%any
    leftauth=pubkey
    leftid=@vpn.exapmle.com
    leftcert=fullchain.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    leftfirewall=yes
    lefthostaccess=yes

    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=192.168.1.2/24
    rightsendcert=never

    eap_identity=%any

# BlackBerry, Windows, Android
conn IPSec-IKEv2-EAP
    keyexchange=ikev2
    rightauth=eap-mschapv2

# macOS, iOS
conn IKEv2-MSCHAPv2-Apple
    keyexchange=ikev2
    rightauth=eap-mschapv2
    leftid=@vpn.example.com

# Android IPsec Hybrid RSA --------
conn IKEv1-Xauth
    keyexchange=ikev1
    rightauth=xauth

iptables rules

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [50:9272]
:f2b-sshd - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2358 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d 192.168.1.1 -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -j DROP
-A INPUT -p tcp -m multiport -j f2b-sshd --dports 2358
-A f2b-sshd -j RETURN
-A FORWARD -s 192.168.1.1/32 -i enp0s31f6 -m policy --dir in --pol ipsec --reqid 2 --proto esp -j ACCEPT
-A FORWARD -d 192.168.1.1/32 -o enp0s31f6 -m policy --dir out --pol ipsec --reqid 2 --proto esp -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 192.168.1.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A FORWARD -j DROP
COMMIT

*nat
:PREROUTING ACCEPT [13:1380]
:INPUT ACCEPT [1:784]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.1.0/24 -o enp0s31f6 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 192.168.1.0/24 -o enp0s31f6 -j MASQUERADE
COMMIT

# Generated by iptables-save v1.6.0 
*mangle
:PREROUTING ACCEPT [453:53140]
:INPUT ACCEPT [453:53140]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [93:22036]
:POSTROUTING ACCEPT [93:22036]
-A FORWARD -p tcp -m policy --dir out --pol ipsec -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
-A FORWARD -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.