Poor perfomance over OpenVPN

jordiSL

Hi everyone!

I have the next specs:

FW: Super Micro XG-1537
Fiber: 600Mbps symmetric
VPN: OpenVPN

I'm the only connected to the VPN and the maximum throughput I get is 30Mbps when testing it via Iperf. No one else is using the fiber line.

The client fiber is 300Mbps which I'm connected.

These are my current settings:
cryptographic settings.png tunnel settings.png client settings.png ping settings.png advance client settings.png ![advance configuration.png]Very (/assets/uploads/files/1596797729924-advance-configuration.png) general information.png Cryptographic & Thermal Hardware.png

I've tried different Encryption Algorithm, buffer sizes, UPD fast IO, both transport protocols (TCP/UDP), enabled cryptographic hardware.

I'm quite desperate so any help would be greatly appreciated.

Thank you so much for your help in advance!

netblues

@jordiSL said in Poor perfomance over OpenVPN:

Super Micro XG-1537

How much are you getting on the same line without vpn?

Try running htop from cli while doing iperf.
And try not to run any iperf on pf

openvpn doesn't benefit from multicores, so if one core saturates during testing, that could be the issue.

viktor_g

You can also check this issue:
https://redmine.pfsense.org/issues/10311

DaddyGo

@jordiSL said in Poor perfomance over OpenVPN:

FW: Super Micro XG-1537

You mean, like original Netgate hardware (XG-1537)?

@jordiSL "I get is 30Mbps"
Yes, it seems low...
(This gives me almost 10x higher speed (M11SDV-4C-LN4F), so your device also needs to know this speed)

interesting to read this:
https://docs.netgate.com/pfsense/en/latest/book/hardware/hardware-sizing-guidance.html

two things I'm thinking about now:

loader.conf.local (flow control (FC), EEE, hw.igb.rx_process_limit="-1"
hw.igb.tx_process_limit="-1, etc.)

https://docs.netgate.com/pfsense/en/latest/hardware/tuning-and-troubleshooting-network-cards.html
https://calomel.org/freebsd_network_tuning.html

@jordiSL "The client fiber is 300Mbps which I'm connected."
incorrectly configured this side or incorrect measurement method...

BTW:

OpenVPN dslreports.com (on 500/200 - ISP):

and what about these?

ifconfig igb0 -rxcsum -rxcsum6 -txcsum -txcsum6 -lro -tso -vlanhwtso

(igb, IX, em, etc.)