Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    22.05 and NordVPN tunneling

    Scheduled Pinned Locked Moved General pfSense Questions
    23 Posts 2 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      davidstoll
      last edited by davidstoll

      @stephenw10 said in 22.05 and NordVPN tunneling:
      Ok, here is what when speed testing with the vpn running on the 4100...

      top -HaSP

      last pid: 21582;  load averages:  0.27,  0.20,  0.13                                                                            up 35+04:02:56  14:10:41
      603 threads:   4 running, 569 sleeping, 30 waiting
      CPU 0: 15.7% user,  0.0% nice, 34.1% system,  0.0% interrupt, 50.2% idle
      CPU 1: 23.1% user,  0.0% nice, 34.9% system,  0.0% interrupt, 42.0% idle
      Mem: 38M Active, 185M Inact, 473M Wired, 3117M Free
      ARC: 207M Total, 29M MFU, 170M MRU, 432K Anon, 918K Header, 6906K Other
           84M Compressed, 212M Uncompressed, 2.53:1 Ratio
      
        PID USERNAME    PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
      13920 root         85    0    17M  7480K CPU0     0 124:02  85.90% /usr/local/sbin/openvpn --config /var/etc/openvpn/client6/config.ovpn
         11 root        155 ki31     0B    32K RUN      0 823.4H  50.90% [idle{idle: cpu0}]
         11 root        155 ki31     0B    32K RUN      1 829.0H  42.11% [idle{idle: cpu1}]
          0 root        -76    -     0B   528K -        0 102:18  16.04% [kernel{if_io_tqg_0}]
          0 root        -76    -     0B   528K -        1 114:40   2.98% [kernel{if_io_tqg_1}]
      73000 root         20    0    12M  3480K bpf      1   5:38   0.85% /usr/local/sbin/filterlog -i pflog0 -p /var/run/filterlog.pid
      25057 root         20    0    11M  2640K select   1   4:47   0.42% /usr/sbin/syslogd -s -c -c -l /var/dhcpd/var/run/log -P /var/run/syslog.pid -f /etc/s
         12 root        -60    -     0B   480K WAIT     1 155:42   0.33% [intr{swi4: clock (0)}]
         20 root        -16    -     0B    16K -        0  25:18   0.17% [rand_harvestq]
      23700 root         20    0    14M  4856K CPU1     1   0:01   0.12% top -HaSP
          0 root        -76    -     0B   528K -        0  31:00   0.06% [kernel{if_config_tqg_0}]
         19 root        -16    -     0B    16K pftm     1  19:02   0.06% [pf purge]
      21929 root         20    0    11M  2184K select   1   0:54   0.01% /usr/sbin/powerd -b hadp -a hadp -n hadp
       5420 dhcpd        20    0    23M    12M select   1   0:42   0.01% /usr/local/sbin/dhcpd -user dhcpd -group _dhcp -chroot /var/dhcpd -cf /etc/dhcpd.conf
      
      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Ok, well neither CPU core is anywhere near 100% there so it's not CPU limiting.

        I would have to assume it's either limited at the server side or as a result of something in the route.

        So check what throughput you can see using a NordVPN client running off the firewall.

        What VPN client settings are you using in pfSense currently?

        Steve

        D 1 Reply Last reply Reply Quote 0
        • D
          davidstoll @stephenw10
          last edited by

          @stephenw10
          So, if I use UDP, it cuts the speed way down. If I use Nord Lynx, it helps a LOT (testing with the same server). Is it possible to setup Nordlynx on pfsense?

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Nord Lynx is mostly Wireguard. So...maybe! I've never tried it and it may require some extra bits pfSense cannot currently do.

            OpenVPN over TCP is almost always significantly slower than UDP. So if you're seeing the opposite that's suspicious. What settings have you tried? What were you using for the results you have stated here?

            Steve

            D 1 Reply Last reply Reply Quote 0
            • D
              davidstoll @stephenw10
              last edited by

              @stephenw10
              I'm sorry I meant UDP vs Nord Lynx was slower vs faster. I can't get TCP to work, so no worry there.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Ok, well it looks like Nord Lynx can be made to work in pfSense. You just need to install their client in something else and extract the keys first because for some reason they won't give them to you directly.

                Or use one of the other VPN providers that do support Wireguard dircetly.

                But you still haven't said what client settings you're using in OpenVPN so you might just have very slow encryption. Or no fastio. Or too smaller buffers.

                Steve

                D 1 Reply Last reply Reply Quote 0
                • D
                  davidstoll @stephenw10
                  last edited by

                  @stephenw10
                  Sorry about not getting the client config to you...

                  dev tun
                  persist-tun
                  persist-key
                  ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC
                  cipher AES-256-CBC
                  auth SHA256
                  tls-client
                  client
                  resolv-retry infinite
                  remote xxx.xxx.xxx.xxx 1194 tcp-client
                  nobind
                  auth-user-pass
                  remote-cert-tls server
                  
                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Ok, so you have AES-128-GCM available as a cipher via ncp which should be the fastest available. Can you see if Nord is negotiating that in the connection logs?

                    Since you're using UDP I would enable FastIO and increase the send/recv buffers to 512K. Both of those should give you an increase in throughput.

                    Steve

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      davidstoll @stephenw10
                      last edited by

                      @stephenw10
                      The fast io option was already checked in the pfsense client GUI. The buffer was set to "default", whatever that is and I updated to 512k.

                      On a separate note...regarding wireguard...I found another page to setup the wireguard because the reddit post ws limited....and it is overwhelming. I get the interface to show as "up", but wasn't routing traffic even though I set the pass option in the new interface and set a lan firewall entry to use that gateway.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Do you see recent handshakes in the Wireguard status?

                        The interface status can be misleading there.

                        Steve

                        D 1 Reply Last reply Reply Quote 1
                        • D
                          davidstoll @stephenw10
                          last edited by davidstoll

                          @stephenw10
                          I had a spot where I put the private IP that the provider gave me in the wrong spot, corrected now. It appears to be connected (handshake shows green/recent), now I just have to figure out why I'm not routing...maybe a DNS issue, maybe routing through the firewall rules. Not sure yet...

                          getting....so.....close.....thank...you.....

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Probably something in the crypto-routing that is generated by the allowed subnets.

                            Also remember that Wireguard doesn't add any routing for you so you must add that manually if you need it. Though you're probably using policy routing here.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.