OpenVPN - poor performance 2.3.1 p1

[mozg31337]

Hello guys.

I've recently installed pfSense 2.3.1 for the sole purpose of using it as the OpenVPN server for road warriors.  The pfSense is running as a virtual machine on KVM hypervisor with 4 CPUs (2GHz each) and 2GB RAM. I have one WAN and one LAN interfaces. The WAN is 1gbit/s link at the data centre and after checking the link, it can indeed deliver around 100MB/s (megabytes per second). A typical speed test would show me over 400mbit/s up/down with about 1-2ms delay.

I've configured the openvpn server following online documentation and I can successfully connect from my client (tried windows and linux clients). Both clients are not able to get more than 1MB/s (megabyte/s), with average speed around 500-700KB/s. The client's internet speed is 80mbit/s down and 20mbit/s up.

Here is what I've tried so far to determine the cause of the slow performance (each change was followed by the OpenVPN service restart and redownload of the client configuration):
1. Switched from UDP to TCP
2. Switched port from 1194 to 443 (both tcp/udp)
3. added Advanced settings for "tun-mtu 1500" and "mssfix 1400"
4. switched to AES-128-CBC instead of the default 256 bit

None from the above increased the speed (switching to TCP has actually decreased the speed even further to about 300-500KB/s).

As a comparison, I have an old Endian firewall connected to the same WAN link, which is capable of saturating my client link with 8.9MB/s (megabytes/s) over OpenVPN with the same settings. Also, I have a test vm which I use for SSH VPN service, which is also saturating my link with 8.9MB/s.

I've also upgraded to the latest 2.3.1_p1, which didn't make a difference for the OpenVPN speed.

Could someone please help me to get the OpenVPN speed to usable levels?

Many thanks

Andrei

[mozg31337]

Anyone has any ideas on how to improve the performance of OpenVPN service? Due to performance issues it is not usable out of the box. What options am I missing or haven't set?

As a test, I've just created a new vm with identical specs as the pfSense server. Installed Endian 3.2 beta 1 and configured the OpenVPN service. No speed issues what so ever. The client side link could be easily saturated with 9MB/s (megabyte) throughput over openvpn.

Need some help figuring out where is the bottleneck.

Thanks

[LA_FORGE]

Hi,

I'm having similar OpenVPN issues since v2.3.1

https://forum.pfsense.org/index.php?topic=110715.0

When I'm applying the following parameters at the server and client side

tun-mtu 1200; fragment 1000; mssfix

The problem is gone but then I'm receiving disconnects very often from the server.

Greetings from germany

Steve

[mauroman33]

in the OpenVPN Client you could try to increase the TCP/UDP socket send and receive buffers size, adding at bottom of the "Custom options" these two lines:

sndbuf 524288
rcvbuf 524288

Furthermore, only if you're running an UDP connection, you could add even this:
fast-io

[pan_2]

Never used KVM, but under ESX I got better results with fragment 0 and snd/rcvbuf magik.
Also - be sure to test without encryption at all, to be sure what you got all you can at ovpn link level.

[heper]

i've read that KVM & freebsd don't mix well, performance wise.

have you browsed this? https://forum.pfsense.org/index.php?topic=88467.0