[SOLVED] CPU Load High on V2.8.1

Bambos

Hello everyone,

my pfSense device got unexpectedly high load on CPU out of nowhere.
it does fluctuate from 35% to 75% , but mostly is around 50%.

The device is i5-7200U with 16GB Ram , with below settings of crypto.

Does the cryptographic settings affecting this ? (probably)
what is the case if i select none ?

Is this normal ? what i have to check ?

SteveITS

@Bambos Check Diagnostics > System Activity to see what's using CPU. Or top -aSH via SSH.

Bambos

@SteveITS Hello Sir,

This openvpn server seems strange to me having all this cpu usage.
How i can identify which one of the openvpn servers is that ?

(the openvpn servers i can see from services are total 8)

tinfoilmatt

When did this start happening?

Bambos

@tinfoilmatt after a total crush of the specific pfsense, no web, no ping, no ssh. no dhcp server, no dns resolve. the only way to revive was a power cycle.

tinfoilmatt

When did that crash occur?

What kind of traffic/user volume do these OVPN servers see? Are they all 'peer-to-peer' (i.e., site-to-site) tunnel? Or is there one (or more) for remote access?

Bambos

@tinfoilmatt the crush occur last night, when the system was doing nothing. also no change on the configuration last month.

the openvpn servers are mixed at this point.
2 are remote access user auth
1 is remote access SSL/TLS
3 are peer to peer SSL/TLS
3 are peer to peer shared key

users - not much. 1 to 3 users at the same time.
peer instances again not much, only 1 LAN for remote access purposes.
only 1 instance has some noticeable traffic for offsite backups for some hours once a week.
The above config is running for over 4 years from versions 2.5.0 , 2.5.1, 2.5.2 , 2.6.0 , 2.7.1, 2.7.2 , 2.8.1.

SteveITS

@Bambos said in CPU Load High on V2.8.1:

How i can identify which one of the openvpn servers is that ?

Can you stop them one at a time?

tinfoilmatt

Have you checked for any suspicious connection-attempt activity?

I'm asking because, as of today, 11 May 2026, CVE-2026-40215 is not patched for pfSense CE yet (and 2.8.1 runs a vulnerable OpenVPN version, 2.6.16. You can run pkg info openvpn to see package version information).

Bambos

@tinfoilmatt i confirm that pfSense 2.8.1 and OpenVPN 2.6.16

@SteveITS yes i find it. Is a site to site tunnel transferring offsite backups with 4.5MBytes/sec.

is that reasonable ? one pfSense using 65% CPU and other 45% CPU for this transfer over VPN.
This configuration is shared key. (didn't update / upgrade to SSL/TLS). Is this affecting the CPU Load ?

SteveITS

@Bambos said in CPU Load High on V2.8.1:

is that reasonable ? one pfSense using 65% CPU and other 45% CPU

What CPU models are they?

What encryption algorithms are used?

I don't know the answer, but a slower CPU will use more CPU time for the same amount of calculations.

Shared Key has a warning on https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-s2s-psk.html that it is deprecated.

Bambos

@SteveITS the vpn setup is :
Mode: Peer to Peer ( Shared Key )
Data Ciphers: AES-128-CBC, AES-128-GCM, AES-256-GCM, AES-256-CBC
Digest: SHA256

The data rate is 4,5-4,7 MBytes/sec.
pfSense 1 has i5-7200U with 16GB Ram (9% used)
pfSense 2 has Intel(R) Celeron(R) CPU J1900 with 4GB Ram (12% used)

stephenw10

Any OpenVPN traffic will generate CPU load. If the actual bandwidth being passed hasn't changed though then I wouldn't expect to see the CPU usage change. Unless the crypto algorithm has changed. If you control both ends of that tunnel then can just set one cipher so it only ever uses that.

tinfoilmatt

OP has yet to confirm if the offsite backup job utilizing the transport tunnel is new or longstanding. But it would seem to be the obvious culprit, so it must be new (and/or jacked up)?

stephenw10

Yeah I would first suspect that the backup just got larger and is now taking long enough that it has been noticed.

Bambos

@stephenw10 yes, i confirm. long backup because of power failure on remote side.
Thanks for all the comments.