OpenVpn oneway slow performance

netblues

This has been bothering for quite some time.
I have tried many things different hardware, with dco and without and still the same

Sending data with iperf3 TO pf or to a device behind it is (almost) wire speed.
Always.

Getting data OUT of pf is always mediocre, between one third to 1/10 of the realizable upload speed, and thats depending on latency.

I have tried all the usual mtu tips and tricks to no avail.

Switching to wireguard, makes everything symmetric, on same boxes.
So it can't be the wan, can't be mtu on the lans.

Happens both on ce 2.8.1 and pfplus 25.07

this is to a (windows) host running iperf behind pf
Same happens if i target pf box

Running iperf to the pf wan works as expected too, BOTH ways.

This is virtualization pfsense under kvm and bridges.
Same bridges are used under wireguard, and then why one way ONLY

Apart from ditcihng openvpn (which isn't an easy choice, I'm really out of options).
Any ideas/ pointers more than welcome.

iperf3 -c 192.168.199.10
Connecting to host 192.168.199.10, port 5201
[  5] local 192.168.198.10 port 43266 connected to 192.168.199.10 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  58.9 MBytes   494 Mbits/sec   59    536 KBytes
[  5]   1.00-2.00   sec  59.3 MBytes   498 Mbits/sec    0    538 KBytes
[  5]   2.00-3.00   sec  51.2 MBytes   430 Mbits/sec    0    541 KBytes
[  5]   3.00-4.00   sec  63.1 MBytes   529 Mbits/sec    0    617 KBytes
[  5]   4.00-5.00   sec  54.8 MBytes   460 Mbits/sec    2    496 KBytes
[  5]   5.00-6.00   sec  58.5 MBytes   491 Mbits/sec    0    572 KBytes
[  5]   6.00-7.00   sec  52.9 MBytes   444 Mbits/sec    0    634 KBytes
[  5]   7.00-8.00   sec  58.5 MBytes   491 Mbits/sec    0    696 KBytes
[  5]   8.00-9.00   sec  46.0 MBytes   386 Mbits/sec   57    549 KBytes
[  5]   9.00-10.00  sec  47.9 MBytes   401 Mbits/sec    0    612 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   551 MBytes   462 Mbits/sec  118             sender
[  5]   0.00-10.02  sec   549 MBytes   460 Mbits/sec                  receiver

 iperf3 -c 192.168.199.10 -R
Connecting to host 192.168.199.10, port 5201
Reverse mode, remote host 192.168.199.10 is sending
[  5] local 192.168.198.10 port 50452 connected to 192.168.199.10 port 5201
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.02   sec  13.2 MBytes   109 Mbits/sec
[  5]   1.02-2.00   sec  13.4 MBytes   114 Mbits/sec
[  5]   2.00-3.02   sec  13.9 MBytes   114 Mbits/sec
[  5]   3.02-4.01   sec  15.4 MBytes   131 Mbits/sec
[  5]   4.01-5.00   sec  13.6 MBytes   114 Mbits/sec
[  5]   5.00-6.01   sec  13.1 MBytes   110 Mbits/sec
[  5]   6.01-7.00   sec  12.6 MBytes   106 Mbits/sec
[  5]   7.00-8.01   sec  12.1 MBytes   101 Mbits/sec
[  5]   8.01-9.00   sec  14.8 MBytes   125 Mbits/sec
[  5]   9.00-10.00  sec  14.6 MBytes   123 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-10.00  sec   138 MBytes   115 Mbits/sec                  sender
[  5]   0.00-10.00  sec   137 MBytes   115 Mbits/sec                  receiver

Gertjan

@netblues said in OpenVpn oneway slow performance:

ut of options).

Another option that eliminates a lot of 'suspects' : ditch VM, go bare bone (for a moment).