Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    "Normal" packet loss of ping over OpenVPN?

    Scheduled Pinned Locked Moved OpenVPN
    8 Posts 2 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      slu
      last edited by

      We have some (~ 40) OpenVPN Connections over a APU board and sometimes a packet lost (VNC connection interrupt).

      Normally the connection is complete idle and only on connection has some load.
      I'am really unsure where to start, try today another internet connection, same issue.
      Often 1000 packets without a lost, sometimes the lost start after ~ 130 packets.

      Is the APU hardware to small?
      Load average 0.08, 0.06, 0.07 look ok to me.

      pfSense Gold subscription

      1 Reply Last reply Reply Quote 0
      • S
        slu
        last edited by

        --- 192.168.131.1 ping statistics ---
        1390 packets transmitted, 1389 packets received, 0.1% packet loss
        round-trip min/avg/max/stddev = 143.982/152.785/432.330/17.720 ms
        

        Is this a normal loss?

        pfSense Gold subscription

        1 Reply Last reply Reply Quote 0
        • C
          cmb
          last edited by

          "Normal" would be close to whatever your loss is outside the tunnel. Sub-0.1% loss is normal for some Internet connections, especially for destinations that are far away from you. 0.1% packet loss wouldn't cause VNC connections to be interrupted, and wouldn't likely be noticeable at all. If you have longer periods of loss, or more than 1 in 1400 packets lost, then you might have an issue there. But that won't cause VNC connection drops.

          1 Reply Last reply Reply Quote 0
          • S
            slu
            last edited by

            @cmb:

            "Normal" would be close to whatever your loss is outside the tunnel. Sub-0.1% loss is normal for some Internet connections, especially for destinations that are far away from you.

            I have one destination ~ 8000km away with no loss in 500 pings.
            Another destination ~ 1000km away loss packet after ~ 130 pings, look like there is nothing I can do with a openvpn setting, or?

            @cmb:

            But that won't cause VNC connection drops.

            Yes, if the VNC connection drops I can not see a ping for more than 2 seconds.
            OpenVPN log show only:

            openvpn[32381]: ca_name/xx.xx.xx.xx:1194 send_push_reply(): safe_cap=940
            

            pfSense Gold subscription

            1 Reply Last reply Reply Quote 0
            • C
              cmb
              last edited by

              In that case, you're more than likely encountering loss on the outside of the tunnel. Run a ping outside the tunnel as well, to the public IP of the OpenVPN server, and see how the loss compares to that inside the tunnel.

              1 Reply Last reply Reply Quote 0
              • S
                slu
                last edited by

                No loss from pfSense to WAN IP (OpenVPN Client) and from router to OpenVPN client nic.
                For some reason the UDP OpenVPN tunnel loss the packets.  :-[

                pfSense Gold subscription

                1 Reply Last reply Reply Quote 0
                • S
                  slu
                  last edited by

                  There are a lot of this errors on the client side:

                  TLS Error: local/remote TLS keys are out of sync
                  

                  This is the reason of the ping loss, but don't find out why the keys out of sync.

                  pfSense Gold subscription

                  1 Reply Last reply Reply Quote 0
                  • S
                    slu
                    last edited by

                    Maybe it is a MTU problem, try a smaller MTU on the server side (can not modify the client).
                    Is this warning a problem?

                    WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1300', remote='link-mtu 1542'
                    

                    pfSense Gold subscription

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.