OpenVPN Server slow Download speeds to Android & Windows clients



  • I am running a pfsense VPS on vultr.com
    I am seeing nasty speed results on Download speeds over OpenVPN. I am forcing all client traffic through the vpn connection. If I reinstall the vps with Debian and install OpenVPN server on it I get much better results around 50mbps DL and 30 - 40 UP. However I do need to use pfsense for a different project and it would be nice to have an all in one vps.

    (no vpn) Home network speed test
    Download: 89mbps
    Upload: 53mbps

    (with vpn) Home network speed test
    Download: 200kbps <-> 1mbps
    Upload: 30mbps <-> 35mbps

    Clients: ( vpn client obtained form pfsense client export page )
    Windows 10 PC ( i7-7700 / 8GB DDR4 / 120GB SSD )
    Samsung Galaxy Note 9 - openvpn Connect app


    Server Info
    CPU: 1v core
    RAM: 512MB
    NET: 1 GB/s - Speed test 884.90mbps DL / 554.49mbps UP
    OS: Pfsense
    Version: 2.4.4-RELEASE (amd64)
    WAN port MTU: 5000

    Tweaks made to pfsense settings

    System /Advanced/Miscellaneous
    %(#ff00a2)[-- Cryptographic & Thermal Hardware --]
    %(#0022ff)[Cryptographic Hardware]%(#ff001a)[:] AES-NI CPU-based Acceleration

    System /Advanced/System Tunables
    %(#0022ff)[net.inet.ip.fastforwarding]%(#ff001a)[:] 1


    VPN Server settings

    %(#ff00a2)[-- General Information --]

    %(#0022ff)[Server mode]%(#ff001a)[:] Remote Access (SSL/TLS+ User Atuh)
    %(#0022ff)[Protocol]%(#ff001a)[:] UDP on 1pv4
    %(#0022ff)[Device Mode]%(#ff001a)[:] tun - Layer 3 Tunnel Mode
    %(#0022ff)[Interface]%(#ff001a)[:] WAN
    %(#0022ff)[Local Port]%(#ff001a)[:] 443 ( have tested other ports no change )

    %(#ff00a2)[-- Cryptographic Settings -- ]

    %(#0022ff)[TLS Configuration]%(#ff001a)[:] (check) Use a TLS Key
    %(#0022ff)[TLS Key]%(#ff001a)[:] key file here
    %(#0022ff)[TLS Key Usage Mode]%(#ff001a)[:] TLS Authentication
    %(#0022ff)[Peer Certificate Authority]%(#ff001a)[:] (cert is selected)
    %(#0022ff)[Peer Certificate Revocation list]%(#ff001a)[:] ( No Certificate Revocation Lists defined )
    %(#0022ff)[Server certificate]%(#ff001a)[:] (cert is selected)
    %(#0022ff)[DH Parameter Length]%(#ff001a)[:] 2048 bit
    %(#0022ff)[ECDH Curve]%(#ff001a)[:] Use Default
    %(#0022ff)[Encryption Algorithm]%(#ff001a)[:] AES-128-CBC (128 bit key, 128 bit block)
    %(#0022ff)[Enable NCP]%(#ff001a)[:] (check) Enable Negotiable Cryptographic Parameters
    %(#0022ff)[NCP Algorithms]%(#ff001a)[:] AES-128-GCM
    %(#0022ff)[Auth digest algorithm]%(#ff001a)[:] SHA256 (256-bit)
    %(#0022ff)[Hardware Crypto]%(#ff001a)[:] Intel RDRAND engine - RAND
    %(#0022ff)[Certificate Depth]%(#ff001a)[:] One (Client+Server)
    %(#0022ff)[Strict User-CN Matching]%(#ff001a)[:] -blank-

    %(#ff00a2)[-- Tunnel Settings --]

    %(#0022ff)[IPv4 Tunnel Network]%(#ff001a)[:] 10.80.0.0/24
    %(#0022ff)[IPv6 Tunnel Network]%(#ff001a)[:] -blank-
    %(#0022ff)[Redirect IPv4 Gateway]%(#ff001a)[:] (checked)
    %(#0022ff)[Redirect IPv6 Gateway]%(#ff001a)[:] -blank-
    %(#0022ff)[IPv6 Local network(s)]%(#ff001a)[:] -blank-
    %(#0022ff)[Concurrent connections]%(#ff001a)[:] -blank-
    %(#0022ff)[Compression]%(#ff001a)[:] Adaptive LZO Compression [Legacy style, comp-lzo adaptive]
    %(#0022ff)[Push Compression]%(#ff001a)[:] (checked)
    %(#0022ff)[Type-of-Service]%(#ff001a)[:] -blank-
    %(#0022ff)[Inter-client communication]%(#ff001a)[:] -blank-
    %(#0022ff)[Duplicate Connection]%(#ff001a)[:] -blank-

    %(#ff00a2)[-- Client Settings --]

    %(#0022ff)[Dynamic IP]%(#ff001a)[:] (checked)
    %(#0022ff)[Topology]%(#ff001a)[:] Subnet -- One IP address per client in a common subnet

    %(#ff00a2)[-- Advanced Client Settings --]

    %(#0022ff)[DNS Default Domain]%(#ff001a)[:] -blank-
    %(#0022ff)[DNS Server enable]%(#ff001a)[:] -blank-
    %(#0022ff)[Block Outside DNS]%(#ff001a)[:] -blank-
    %(#0022ff)[Force DNS cache update]%(#ff001a)[:] -blank-
    %(#0022ff)[NTP Server enable]%(#ff001a)[:] -blank-
    %(#0022ff)[NetBIOS enable]%(#ff001a)[:] -blank-

    %(#ff00a2)[-- Advanced Configuration --]

    %(#0022ff)[Custom options]%(#ff001a)[:]

    sndbuf 524288
    rcvbuf 524288
    tun-mtu 1500
    mssfix 1400
    fast-io
    

    %(#0022ff)[UDP Fast I/O]%(#ff001a)[:] (checked)
    %(#0022ff)[Send/Receive Buffer]%(#ff001a)[:] 512 KiB ( I have moved this all the way up to 2mb - No change )
    %(#0022ff)[Gateway creation]%(#ff001a)[:] IPv4 only
    %(#0022ff)[Verbosity level]%(#ff001a)[:] default



  • I seem to have fixed my slow speeds with the following:

    I am now getting 40mbps download and 30 upload over vpn.


    System/Advanced/Networking
    %(#ff00a2)[-- Network Interfaces --]
    %(#0022ff)[Hardware Checksum Offloading]%(#ff001a)[:] (checked)


    Open VPN Server config
    %(#ff00a2)[-- Advanced Configuration --]
    %(#0022ff)[Custom options]%(#ff001a)[:]

    fragment 0
    mssfix 0
    

Log in to reply