iperf3 testing 500/40 connection: 33mpbs
-
@johnpoz Thank you, that helps somewhat. And I mean that in a very positive way as I consider myself a newbie here. Only a year ago I was quite unaware of networking, except that I knew how to set up a router in bridge mode and configure my own firewall (started with UniFi USG, now SG-1100).
I am really struggling with this VPN stuff as I feel I need to learn so much in order to be able to do even some simple tricks. It took me quite some hours of learning how to set up OpenVPN on pfSense (with FreeRADIUS to authenticate) and connect to my network from my Macbook while off site. I managed to do this, with mostly default settings. It's like learning how to sail: one can be up and going in a few days but learning the fine details can take years.Anyway sorry for the long post this has become.
I absolutely don't understand how you manage 200mbps with 70ms latency:
So you would need a massive window size to accomplish this. Or am I seeing this the wrong way? Could you shed some light or share your secret?Thanks,
Pete -
@cabledude keep in mind doing multiple streams - the other option to doing large window sizes ;) for overcoming latency..
Game is on - so don't have a chance currently... But I will repeat the test in morning and check the window size being used.
Just wanted to show that openvpn can quite easy handle over 100mbps..
-
As a side note I enable fastIO and set send/recv buffers to 512K on pretty much any server I configure these days. Unless it's a TCP tunnel but if you're doing that speed will be low anyway.
Steve
-
@johnpoz @stephenw10 : If I put up a VPN connection on two SG-1100 units, one at each node, I can probably max out that hardware.
I just had an insight: replacing the hardware at only one end node (e.g. swapping one of the SG-1100's for a beefy SG-6100) will probably make zero difference as the other end will be the bottleneck. Correct?
Thanks,
Pete -
Probably, though there is a difference between encode and decode loading you may find it helps in one direction.
Steve
-
This post is deleted! -
@stephenw10 The key assumption is that the firewall CPU is the bottleneck, correct? So you are suggesting there might be an asynchronous CPU load for server side vs client side? That sounds interesting.
The next question then is: at which end would I place the most powerful device?No wait - I should be able to figure this out myself by testing the same connection again and then watch the CPU load at both ends and look for differences. Would this be a good approach?
-
Yes, I would do that. It's not a huge difference but if you're only upgrading one side you might as well do it to the side seeing the heaviest load.
Steve
-
@stephenw10 Just one more question to make this effort more than just academic: How would I create multiple simultaneous VPN connections? If I'd create several VPN server instances in the OpenVPN settings, I can only assume I'd have to choose a different tunnel subnet for each, and how would they together constitute one "wide" connection with permissions to the same VLAN(s)? How would the system balance routing packets through the individual tunnels? Or am I seeing this all the wrong way?
Thanks, Pete
-
It's possible to do that. You have to use policy routing with a load-balanced gateway group setup with both remote side IPs as gateways.
However that only works for multiple connections between the sites. For a single file transfer for example it will only use one tunnel.
Steve
