Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Huge number of users

    Scheduled Pinned Locked Moved OpenVPN
    11 Posts 4 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by Derelict

      Depends on what the users are doing. As in packet sizes and traffic levels.

      The number of users really doesn't matter much.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • haykuH
        hayku
        last edited by

        Thanks for your answer, well most of them (users) will register a softphone and make calls through the VPN, additionally they use a web app hosted in the same network segment that the firewall lives.

        JKnottJ 1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott @hayku
          last edited by JKnott

          @hayku

          If they're using Wifi calling, the calls are already encrypted with IPSec. Some soft phone apps also encrypt

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Again, you are not telling us how much data each of them will be passing. A VoIP phone uses like 64Kb/sec per call path which is essentially nothing.

            As for the web application, well, that depends on what it does.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • haykuH
              hayku
              last edited by

              Ok, about the traffic that the users would generate:
              *VoIP call 64Kbs per channel (2 channels x call ) about 128Kbs.
              *Web application with real-time notifications and some video conference features (200Kbps)

              I think it's about 320 to 350 kbps per user.

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @hayku
                last edited by JKnott

                @hayku said in Huge number of users:

                *VoIP call 64Kbs per channel (2 channels x call ) about 128Kbs.

                Where are you getting 2 channels from? Also, the bandwidth used varies with the CODEC. For example, G.729a runs at 8 Kb/s, G.711 is 64 Kb and these days HD Voice is popular, which would use more bandwidth. There are a variety of CODECs to chose from.

                BTW, several years ago, I used to work with a device called a "PBX extender", which extended PBX phones from the main office to a remote site. I often put 8 extentions over a 128 Kb ISDN BRI connection.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • RicoR
                  Rico LAYER 8 Rebel Alliance
                  last edited by

                  80 Users is not a huge number. :-)
                  I'd not expect any problems. You could maybe run multiple OpenVPN instances to split the load.

                  -Rico

                  haykuH 1 Reply Last reply Reply Quote 0
                  • haykuH
                    hayku @Rico
                    last edited by

                    @Rico Do you mean run multiple instances over the same firewall?

                    1 Reply Last reply Reply Quote 0
                    • RicoR
                      Rico LAYER 8 Rebel Alliance
                      last edited by

                      Yes, one drawback of OpenVPN (i.e. VS IPsec) is that one instance can only address one CPU core.
                      So with only one instance under heavy load you could have your CPU still sitting there bored more or less, depending on your number of cores. ☺
                      For OpenVPN it's always best to have a CPU with as much clock frequency as possible.

                      -Rico

                      haykuH 1 Reply Last reply Reply Quote 0
                      • haykuH
                        hayku @Rico
                        last edited by

                        @Rico Great, thanks for your advice
                        👍

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.