On my VPS (Ubuntu 14.04 – 64-bit), which has OpenVPN 2.3.2-server installed, I'm getting disappointing performance. The VPN-server uses the AES-128-CBC cipher for encryption, and I have no firewall installed.
The problem is that the download/upload-speed is rather low. While doing some speed-tests, the average is around 45 Mbps. The actual speed will drop down to 20 Mbps, and go as high as 50 Mbps. While doing these tests, the CPU and server-load seem rather low.
I've tried changing the tun-mtu value on both the server and client, using different ciphers (blowfish etc.), upping the buffersize etc. My download-speed without the VPN-connection is around 180 – 190 Mbps (my ISP promises 200 Mbps), my upload is 10 Mbps. As you can see the difference is rather drastic and I'd like to up the download-speed as much as possible.
Using programs such as haveged from generating available entropy, no performance seems to be gained. My available entropy is always around 700 – 800 bits 3000 with haveged active, which is plenty enough?
The server itself has a 1 Gbit connection. A download test to the server confirms this speed (around 800+ Mbps). I've also tested downloading a random 1 GB file from the server to one of the VPN-clients without using the VPN-connection, and this gave me a download-speed of 180 Mbps (my maximum) on average.
I couldn't find much information on the internet about slow/low download-speeds with an OpenVPN-server that were helping. The thing that concerns me is that the CPU and server-load are very low (CPU usage is about 16 % on only one core (OpenVPN does not support multi/hyper-threading?) while doing speed tests).
If you'd like more information or details about my set-up or configuration, please ask.
EDIT 2015-02-28:
I'm once again trying to use an OpenVPN-server with only three (3) clients. Again, I'm facing the problem where the download speed does not max (not even half) my internet connection speed on the clients.
I've tested installing the OpenVPN-server on the host machine itself, and that gave me quite good results! But, I need to use the VPN server on a VPS (virtual machine) and not on a host machine. While downloading a 10 GB file, I can go as high as 10 MB/s (800 Mb/s), and averages at about 7,5 MB/s (60 Mb/s). My internet connection where the clients are connecting from is a 200 Mb/s connection. When doing various speed test without a VPN connection, I can reach an average of 180 Mb/s. While connecting through the VPN server (on the VPS!), the speeds at not even half the speed I should get. When connecting through the VPN server (on the HOST!), I can reach up to 120 Mb/s.
Both servers use about the same CPU usage while performing the tests and both have aesni support on the CPU. I've done some speed tests with openssl, but those seem very good and max. out CPU cores. I've also run watch -n 1 cat /proc/sys/kernel/random/entropy_avail while performing these tests, but the available entropy seems to not change that much while performing a download test. On both the host and the VPS it's around 850 – 900.
I'm out of ideas as to why the VPS server(s) differ that much in speed from the host. Could it be the Qemu (qemu-kvm) virtualised network interface?
Best Answer
Whenever I see someone on a VPS, and they mention encryption or SSL performance problems, the first thing that comes to mind is they're running the random pool dry.
Try installing "haveged" and see if that fixes the problem. If it does, carefully read the documentation and the caveats of using a pseduo random number generator and it's security implications.
EDIT
Why install "haveged"? Any encryption operation depends heavily on high quality random numbers. Therefore, your throughput will eventually be limited by the rate at which you can generate them. On a VPS, you may not have all the entropy sources available that you would on bare metal. This can exhaust the pool (try
cat /proc/sys/kernel/random/entropy_avail), causing your program to block while more randomness is stirred into the pool. Haveged uses the HAVEGE algorithm which, depending on your use case, may be less secure. It'll be up to you to decide it's worth the risks that may apply to your situation. :) Haveged is a daemon that runs in the background to keep the kernel entropy pool full and stirred. No change to your software should be required other than maybe a reboot of your VPS (depends on your setup).