Can't get OpenVPN speeds over 20-30mbps

CubedRoot

Here is my setup:

Home internet is 2.5gbps fiber connection. I have symmetric service and they don;t do any throttling. I have also been taken off their CGNAT.

I have pfSense serving as my home router, and its WAN is plugged directly into the ONT for my fiber service. The router is a 1U server that has an Intel(R) Xeon(R) CPU E3-1270 v3 @ 3.50GHz for its processor and it has 32gb of RAM. It also has multiple 10gb NICS, and the WAN nic is connecting at full 10gbps to my ONT.

My RV has a Starlink internet service and its using a GL-XE3000 as its router. The Starlink is in bypass mode.

In the RV I am seeing SOLID speeds of 200mbps with decent latency when not using a VPN. But when I try to connect to my home network using OpenVPN I am only seeing about 20mbps of service. I am routing all traffic to the OpenVPN service and I have tried using the OpenVPN client on my XE3000 as well as just trying to use OpenVPN client on my macbook. The results are the same: 20-30mbps of bandwidth when connecting to my home router.

I have tried tweaking the MTU and everything but I am not having much luck at getting good speeds over the VPN. I have confirmed that my pfSense box has AES-NI enabled and the OpenVPN server is using hardware cryptography.

Can someone give me some tips on how to get better performance? this is pretty abysmal.

chpalmer

@CubedRoot said in Can't get OpenVPN speeds over 20-30mbps:

Home internet is 2.5gbps fiber connection. I have symmetric service and they don;t do any throttling. I have also been taken off their CGNAT.

I have pfSense serving as my home router, and its WAN is plugged directly into the ONT for my fiber service. The router is a 1U server that has an Intel(R) Xeon(R) CPU E3-1270 v3 @ 3.50GHz for its processor and it has 32gb of RAM. It also has multiple 10gb NICS, and the WAN nic is connecting at full 10gbps to my ONT.

And what kind of speeds do you actually get from this service?

https://speedsmart.net/

Mine is advertised as 1gig down and 50mbps up..

my actual-

https://speedsmart.net/result/170657377

CubedRoot

@chpalmer I CONSISTENTLY get my advertised speed. My ISP is one of the highest rated in the US. Heres a test from a few minutes ago:

https://www.speedtest.net/result/c/ef4afe63-5fa9-40d9-8f8a-4f85ecd09bb4

And here is some historical histories:

Its absolutely not an issue with my ISP and WAN connection.

Likewise I dont think its an issue with my RV router and Starlink, as I can use OpenVPN to connect to a VPS at HDB and I get 90mbps from my RV to that VPS. I also get far faster speeds using OpenVPN from my RV setup connecting to a Torguard and PIA VPN service.

So the culprit seems to be my OpenVPN server thats running on pfSense CE at my house.

JonathanLee

I am sure you know that ciphers take time and slow things down what ciphers are you using with OpenVPN ? Also are you using cryptographic accelerators to off board encryption ? I have been playing around with this stuff for a couple years and if it’s not configured right it will bog you down. What cipher sets are you using?

Also MTU has to be set correctly on your vpn interface or it fragments the packets on transmissions. Do some ping tests to see the ideal MTU for it. Have you tried 1480?

Gertjan

@CubedRoot said in Can't get OpenVPN speeds over 20-30mbps:

... I have tried using the OpenVPN client on my XE3000 as well as just trying to use OpenVPN client on my macbook.

That's the correct thing to do.

A router like pfSense needs a couple of hundred CPU cycles to transfer a Ethernet packet from one interface to another, your Xeon will slide through this like butter.
Now, if it has to 'do something' with this packet before sending it out, or receiving it, converting traffic to encrypted traffic (and back), it has real to work.
Lets imagine : how much more overhead would that be ? 10 ? => no way 100 ? Hummm, maybe ? 1000 ? I'm not sure.
But you've mentioned : speed of 2,5 Gbit/sec is possible. You saw 25+ Mbit/sec, that's a 100 times speed loss, like VPN traffic 'costs' you a 100 fold CPU performance. And traffic goes both ways.

As said @chpalmer, the encryption used could impact, as the Xeon can do (for example) 'AES-CBC' with hardware support, but not the latest "eliptic curve encryption" (just mentioning something here) so it will use software emulation (openssl) to do the job. That's costly.
Then comes the issue that not all software fits in the CPU cache, so no the processor becomes RAM speed bound, and that will slow it down even more.

The encryption process takes place on both side, so check both devices.

Not saying you can't have nice things = speed, as I really think you could/should.
Just see my words as potential things to check, to see where the bottle neck is.

CubedRoot

I am using the following Ciphers:

AES-192-GCM
AES-128-GCM
AES-256-GCM

I have also tried adjusting the MTU, and I am currently using 1480. Adjusting the MTU on the clients didn't seem to change the speeds I was seeing very much. I've tried 1384 and a few others.

I have verified that AES-NI is enabled:
pfsense.dixon.aero - Status Dashboard 2026-08-12 at 2.23.45 AM.jpg

steve72

Have you tried to increase the send/receive buffer?
I use the 4MiB here, and also tick the UDP Fast I/O.

Settings are in the client setting under Advanced Configuration.

JonathanLee

@CubedRoot please look into the advanced option mssfix on openvpn some ciphers require adjustments for example I use aes-256-CBC because it can be off-boarded to my safexcel accelerator, and there is no lag for video calls at home etc when off boarding is utilized, for my DSL line [I am old school] I needed to add

mssfix 1300;

However, this is specific to my set up in many community technical threads addressing mtu path discovery and encryption encapsulation errors mssfix is frequently appended alongside data ciphers aes-256-cbc, you can also customize your MTU for your vpn interface that is often adjusted also.