Slow OpenVPN perfomance in virtualized pfSense (Hyper-V).



  • Hi.

    I've got the following situation:
    Two Hyper-V hosts on 10Gb links, with direct connectivity to internet, located in one datacenter, E5-2960 v2 @ 3Ghz.
    In each host there is two VM: pfSense (2.2 alpha at moment) and WinSvr2008R2.
    WinSvr VM is linked through private virtual switch to pfSense, which has direct connection to internet through "external" virtual switch, connection is shared with host.
    pfSense VM is configured to use enlightened network adapters (hn).

    On one pfSense there is OpenVPN server, on other (obviously)- OpenVPN client, with following configuration ATM:
    UDP, tun, no encryption, SHA1 160 bit Auth, compression disabled, mssfix.

    Problem:
    If I copy files over SMB from Hyper-V host to Hyper-V host - I'm getting speeds up to 250+ MBytes/s (I've seen up to 400MBytes/s).
    If I copy files over SMB from WinSvr VM to Hyper-V host (so it pass through pfSense) - I'm gettings speed from 150 Mbytes/s to 300 Mbytes/s.

    If I copy files over SMB from WinSvr VM through OpenVPN link to other WinSvr VM - I'm getting speeds around 25 Mbytes/s.
    With encryption enabled (BF-CBC), file copy speed over VPN drops to 15 Mbytes/s.

    In attach:

    1. Diagram of current setup
      and
    2. Traffic graph screenshot doing various transfers,
      first spike - through OpenVPN (VM to VM), other - various web browser speed tests and VM to host file transfers.

    Any ideas?

    ![pfsense slow openvpn.png](/public/imported_attachments/1/pfsense slow openvpn.png)
    ![pfsense slow openvpn.png_thumb](/public/imported_attachments/1/pfsense slow openvpn.png_thumb)
    ![pfsense traffic graph.png](/public/imported_attachments/1/pfsense traffic graph.png)
    ![pfsense traffic graph.png_thumb](/public/imported_attachments/1/pfsense traffic graph.png_thumb)



  • Try and set net.inet.ip.fastforwarding=1 in System: Advanced: System Tunables

    Several users have seen a big speed increase in OpenVPN performance with it enabled.



  • Enabled on both routers, rebooted for sure.
    Nope, no difference.



  • check the cpu usage of the VM when pushing data over the vpn.

    also since you are running 2.2 , try posting in the 2.2 section of the forum.

    hyper-V support for freebsd is fairly new, so there are probably still some flaws compared to other hypervisors



  • Since I had a similar issue the solution I found was written here: https://forum.pfsense.org/index.php?topic=88467.msg491409#msg491409

    System -> Advanced -> Networking (tab) and check the "Disable hardware checksum offload"


Log in to reply