I am using openvpn to connect one mikrotik to another.
Documentation says it is faster than l2tp, but with the same routers, l2tp is 10 times faster than openvpn 200Mbit with l2tp, 20Mbit with openvpn). Same config, some firewall rules, same ip profile on the server, just disconnecting from one and connecting to the other.
By the way (one router is behind a nat and I was unable to use l2tp+ipsec), this is why I want to use openvpn that, I thin, will be moer secure than plain l2tp.
Openvpn server is RB1100AHx2 fw version 6.44 (stable)
Client is RB2011UiAS-2HnD fw version 6.44 (stable)
Re: OpenVPN sloooow
Mikrotik's implementation of OpenVPN simple sucks. They don't support UDP transport (only TCP) which creates problems for performance on tunnels (See this link for further information: https://openvpn.net/faq/what-is-tcp-meltdown/) and the lack of UDP support has been a looong request feature from the community to Mikrotik without any successful resolution. In top of that you need to consider that even assuming there is no TCP issues any VPN protocol needs to support Hardware Acceleration in their code.
That will avoid you to overload the router CPU and off-load this heavy task to a dedicated processor that will handle that. So depending on your Router Model may or may not have this external encryption processor. To add more spice to this even if your router supports Hardware Acceleration for encryption I have not seeing that those are supported on the OVPN code inside of RouterOS.
IPSec is the only supported HW acceleration protocol for routers that has this feature.
I deployed my networks originally with OVPN but over a 25 Mbps link I got 2 Mbps of throughput with constant disconnections (every hour) specially for Client to Site VPN connections. I have switched to L2TP / IPSec and I got a lot more better performance (15 Mbps) even without having a HW acceleration chip but I have noticed my router CPU spikes to 90% on some transfers.
I recommend you to switch to L2TP / IPSec or IPSec with IKEv2 to overcome this limitation with OVPN until Mikrotik finally fixes this issue with OVPN (if ever they do this). For L2TP / IPSec I use MRU and MTU of 1420 bytes instead of 1460 bytes (Default) and I got better performance.
Good luck with your setup.
That will avoid you to overload the router CPU and off-load this heavy task to a dedicated processor that will handle that. So depending on your Router Model may or may not have this external encryption processor. To add more spice to this even if your router supports Hardware Acceleration for encryption I have not seeing that those are supported on the OVPN code inside of RouterOS.
IPSec is the only supported HW acceleration protocol for routers that has this feature.
I deployed my networks originally with OVPN but over a 25 Mbps link I got 2 Mbps of throughput with constant disconnections (every hour) specially for Client to Site VPN connections. I have switched to L2TP / IPSec and I got a lot more better performance (15 Mbps) even without having a HW acceleration chip but I have noticed my router CPU spikes to 90% on some transfers.
I recommend you to switch to L2TP / IPSec or IPSec with IKEv2 to overcome this limitation with OVPN until Mikrotik finally fixes this issue with OVPN (if ever they do this). For L2TP / IPSec I use MRU and MTU of 1420 bytes instead of 1460 bytes (Default) and I got better performance.
Good luck with your setup.
Re: OpenVPN sloooow
by default, OpenVPN uses pfifo type queue, with queue size ~50packets.
Make your openvpn interface static (if the link comes up, do copy and rename it).
Now you have an interface, where you can change interface queue.
Make a new queue type called openvpn-default, with type pfifo and size ~250
set this queue type for openvpn interface.
After doing this, speed is much increased.
Keep in mind: do that for both sides, unless doing it, the speed will slow in that direction.
Other way is setting queue size for "default" queue to 250. (on both sides)
Please refer if that helps.
Make your openvpn interface static (if the link comes up, do copy and rename it).
Now you have an interface, where you can change interface queue.
Make a new queue type called openvpn-default, with type pfifo and size ~250
set this queue type for openvpn interface.
After doing this, speed is much increased.
Keep in mind: do that for both sides, unless doing it, the speed will slow in that direction.
Other way is setting queue size for "default" queue to 250. (on both sides)
Please refer if that helps.
Re: OpenVPN sloooow
I'm trying this.
After doing this, speed is much increased.
Keep in mind: do that for both sides, unless doing it, the speed will slow in that direction.
Other way is setting queue size for "default" queue to 250. (on both sides)
Please refer if that helps.
I set up a new queue in the client with 250 packets and selected this queue for the openvpn interface. But in the srever side, there is one interface per client with "only hardware queue". The only way for changing queue for openvpn it is modifying the prfile for the clients then I selected the new queue in the profile of the server. The speed is the same as before (about 20/30mbits). But in the interface queue the list indicates only-hardware-queue for each of the clients and cannot be changed.
Re: OpenVPN sloooow
It definitely CAN be changed.I'm trying this.
After doing this, speed is much increased.
Keep in mind: do that for both sides, unless doing it, the speed will slow in that direction.
Other way is setting queue size for "default" queue to 250. (on both sides)
Please refer if that helps.
I set up a new queue in the client with 250 packets and selected this queue for the openvpn interface. But in the srever side, there is one interface per client with "only hardware queue". The only way for changing queue for openvpn it is modifying the prfile for the clients then I selected the new queue in the profile of the server. The speed is the same as before (about 20/30mbits). But in the interface queue the list indicates only-hardware-queue for each of the clients and cannot be changed.
When the client connects to server, it will have a dynamic (D) interface. Yes, you cannot change queue type for a dynamic interface.
BUT you can copy that dynamic interface. Once reconnect, the static (copied) interface would be used, and you can change the interface for that.
Re: OpenVPN sloooow
Hello,
I am also a OpenVPN user, but new to MikroTik and MikroTik OpenVPN. Sorry for hijacking the thread, but facing buffer issue(I think) and also slow speed.
Using clients with OpenVPN to connect to inside network, and have troubles sending big packed out and back to client. Inside network it works fine, but the OpenVPN fails above 34000'ish bytes
From Client "ping 172.16.210.40 -n 1 -4 -l 32000" works, but "ping 172.16.210.40 -n 1 -4 -l 35000" fails.
In wireshark I can see it stops after 23 fragments and cannot reassemble it of cause.
Please be nice, I am new to MikroTik, but tried to fix it by creating new pfifo que of 500 parcels on "/webfig/#Queues.Queue_Types" and then use that config in "Que Type" on page "/webfig/#PPP.Profiles.1" which is my OpenVPN profile. However it does not change anything, after I reconnect the OpenVPN connection. Does this not fix/change the que buffer?
I am also a OpenVPN user, but new to MikroTik and MikroTik OpenVPN. Sorry for hijacking the thread, but facing buffer issue(I think) and also slow speed.
Using clients with OpenVPN to connect to inside network, and have troubles sending big packed out and back to client. Inside network it works fine, but the OpenVPN fails above 34000'ish bytes
From Client "ping 172.16.210.40 -n 1 -4 -l 32000" works, but "ping 172.16.210.40 -n 1 -4 -l 35000" fails.
In wireshark I can see it stops after 23 fragments and cannot reassemble it of cause.
Please be nice, I am new to MikroTik, but tried to fix it by creating new pfifo que of 500 parcels on "/webfig/#Queues.Queue_Types" and then use that config in "Que Type" on page "/webfig/#PPP.Profiles.1" which is my OpenVPN profile. However it does not change anything, after I reconnect the OpenVPN connection. Does this not fix/change the que buffer?
Re: OpenVPN sloooow
I'm sorry, but i dont really undestand what you want to do.Hello,
I am also a OpenVPN user, but new to MikroTik and MikroTik OpenVPN. Sorry for hijacking the thread, but facing buffer issue(I think) and also slow speed.
Using clients with OpenVPN to connect to inside network, and have troubles sending big packed out and back to client. Inside network it works fine, but the OpenVPN fails above 34000'ish bytes
From Client "ping 172.16.210.40 -n 1 -4 -l 32000" works, but "ping 172.16.210.40 -n 1 -4 -l 35000" fails.
In wireshark I can see it stops after 23 fragments and cannot reassemble it of cause.
Please be nice, I am new to MikroTik, but tried to fix it by creating new pfifo que of 500 parcels on "/webfig/#Queues.Queue_Types" and then use that config in "Que Type" on page "/webfig/#PPP.Profiles.1" which is my OpenVPN profile. However it does not change anything, after I reconnect the OpenVPN connection. Does this not fix/change the que buffer?
Ethernet frames usually 1500bytes. OpenVPN can tunnel 1500byte frames even on 1450byte PPPoE connection with fragmentation and reassemble.
a single package should not be bigger than 1500byte.
I'm sorry about WebFig, i don't use it at all. Use CLI or Winbox instead.
Re: OpenVPN sloooow
Hello,
Thanks for the fast reply!
Trying to send big frames or packets which of cause gets fragmented.
I was thinking it was buffer related, why I wanted to change the que size. The webfig states the pfifo que is in packets, but 35000 bytes is less than 50 packets which is default que size. Setting it 500 did not change anything either.
Big parcels gets fragmented of cause - but it fails above 34000'ish bytes. Se below - have also attached the overview from wireshark from the command below.
Thanks for the fast reply!
Trying to send big frames or packets which of cause gets fragmented.
I was thinking it was buffer related, why I wanted to change the que size. The webfig states the pfifo que is in packets, but 35000 bytes is less than 50 packets which is default que size. Setting it 500 did not change anything either.
Big parcels gets fragmented of cause - but it fails above 34000'ish bytes. Se below - have also attached the overview from wireshark from the command below.
Regarding fragmentations and max single packet size - forcing no fragmentations gives a limit on 1472 bytes, it looks like.λ ping 172.16.210.40 -n 1 -4 -l 32000 && ping 172.16.210.40 -n 1 -4 -l 35000
Pinging 172.16.210.40 with 32000 bytes of data:
Reply from 172.16.210.40: bytes=32000 time=13ms TTL=64
Ping statistics for 172.16.210.40:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 13ms, Maximum = 13ms, Average = 13ms
Pinging 172.16.210.40 with 35000 bytes of data:
Request timed out.
Ping statistics for 172.16.210.40:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Big packet also fails on the ping to the router, not only towards device, but works on the OpenVPN (tap) adaptor itself.λ ping 172.16.210.40 -n 1 -4 -l 1472 -f && ping 172.16.210.40 -n 1 -4 -l 1474 -f
Pinging 172.16.210.40 with 1472 bytes of data:
Reply from 172.16.210.40: bytes=1472 time=1ms TTL=64
Ping statistics for 172.16.210.40:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms
Pinging 172.16.210.40 with 1474 bytes of data:
Packet needs to be fragmented but DF set.
Ping statistics for 172.16.210.40:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
λ ping 172.16.210.220 -n 1 -4 -l 65500 && ping 172.16.210.1 -n 1 -4 -l 65500
Pinging 172.16.210.220 with 65500 bytes of data:
Reply from 172.16.210.220: bytes=65500 time<1ms TTL=128
Ping statistics for 172.16.210.220:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
Pinging 172.16.210.1 with 65500 bytes of data:
Request timed out.
Ping statistics for 172.16.210.1:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
You do not have the required permissions to view the files attached to this post.
Re: OpenVPN sloooow
Mjoelner, i don't really got the point why you want to push 30K sized ICMP packets...
TCP and UDP frames will not be sized bigger than 1500bytes as they live you NIC, and OpenVPN will deal with those packets.
Yes, thruput will be slower than using like 1350-1400byte tunnel MTU (where OpenVPN dont have to deal with refragment)
Also using EoIP, what can push hundreds of mbps in a tunnel with proper frame size and very limited using bigger frame size.
(like 300mbps vs 20mbps)
For application using TCP can discuss MTU (or it can be forced) - but what happens with UDP frames?
TCP and UDP frames will not be sized bigger than 1500bytes as they live you NIC, and OpenVPN will deal with those packets.
Yes, thruput will be slower than using like 1350-1400byte tunnel MTU (where OpenVPN dont have to deal with refragment)
Also using EoIP, what can push hundreds of mbps in a tunnel with proper frame size and very limited using bigger frame size.
(like 300mbps vs 20mbps)
For application using TCP can discuss MTU (or it can be forced) - but what happens with UDP frames?
Re: OpenVPN sloooow
THANK YOU!!!by default, OpenVPN uses pfifo type queue, with queue size ~50packets.
Make your openvpn interface static (if the link comes up, do copy and rename it).
Now you have an interface, where you can change interface queue.
Make a new queue type called openvpn-default, with type pfifo and size ~250
set this queue type for openvpn interface.
After doing this, speed is much increased.
Keep in mind: do that for both sides, unless doing it, the speed will slow in that direction.
Other way is setting queue size for "default" queue to 250. (on both sides)
Please refer if that helps.
I was looking for solution of slow Site to site VPN over a year and after above instructions Openvpn site to site works much faster (sometimes with max speed).
My site 1 600/100 Mbps
site 2 600/60 Mbps
With queue ~50 packages maximum speed what I have received was maximum 4 Mbps (average ~355KB/s) on OpenVPN.
It was very slow for me, specially that I chooses new 4011 Mikrotik device after Internet upgrade, because previous router was too slow. After upgrade to Mikrotik VPN was slower, than on previous TP-link with OpenWRT.
Now speed act like a wave from speed 20 up to 121Mbps, but average speed is awesome -> ~50Mbps.
Thank YOU!
Regards
You do not have the required permissions to view the files attached to this post.
Last edited by aeiouy on Sun Jan 19, 2020 4:32 pm, edited 1 time in total.
Re: OpenVPN sloooow
Hi,THANK YOU!!!by default, OpenVPN uses pfifo type queue, with queue size ~50packets.
Make your openvpn interface static (if the link comes up, do copy and rename it).
Now you have an interface, where you can change interface queue.
Make a new queue type called openvpn-default, with type pfifo and size ~250
set this queue type for openvpn interface.
After doing this, speed is much increased.
Keep in mind: do that for both sides, unless doing it, the speed will slow in that direction.
Other way is setting queue size for "default" queue to 250. (on both sides)
Please refer if that helps.
I was looking for solution of slow Site to site VPN over a year and after above instructions Openvpn site to site works much faster (sometimes with max speed).
My site 1 600/100 Mbps
site 2 600/60 Mbps
With queue ~50 packages maximum speed what I have received was maximum 4 Mbps (average ~355KB/s) on OpenVPN.
It was very slow for me, specially that I chooses new 4011 Mikrotik device after Internet upgrade, because previous router was too slow. After upgrade to Mikrotik VPN was slower, than on previous TP-link with OpenWRT.
Now speed act like a wave from speed 20 up to 121Mbps, but average speed is awesome -> ~50Mbps.
Thank YOU!
Regards
How did you manage to do this, as I may create a new queue based on connection and speed is increased to accepted level but once I disconnect from the VPN queue is broken and next time you reconnect you have to re-setup queue. Tried to do via profile settings but by default, OpenVPN is tided to only-hardware-queue type and cannot be changed
Re: OpenVPN sloooow
Hello,
Sorry for the bump of the topic, but I'm facing the same issue.
So I've configure my ovpn server (correctly I think) , I can access it from different site.
But the speed if fairly poor and I can't figure why.
So I try to connect the VPN directly from my LAN (on a gigabit ethernet) , without the VPN enable I can copy file with a steady 50-60mb/s (~400mbits) (my NAS is limited) ,
but once i'm connected to the VPN and try to copy the same file, I can't speed up pass 2mb/s (~25mbits).
I have static interface, I try to play with the queue , but I can't find any improvements.
if you have other ideas ?
Thanks in advance.
Sorry for the bump of the topic, but I'm facing the same issue.
So I've configure my ovpn server (correctly I think) , I can access it from different site.
But the speed if fairly poor and I can't figure why.
So I try to connect the VPN directly from my LAN (on a gigabit ethernet) , without the VPN enable I can copy file with a steady 50-60mb/s (~400mbits) (my NAS is limited) ,
but once i'm connected to the VPN and try to copy the same file, I can't speed up pass 2mb/s (~25mbits).
I have static interface, I try to play with the queue , but I can't find any improvements.
if you have other ideas ?
Thanks in advance.
Re: OpenVPN sloooow
sorry for necroposting but are there any suggestions beside changing buffer from 50 to 250?
i have 2mbit ovpn connection over 30mbit internet channel :,(
before changing from 50 to 250 was 1mbit, but 2mbit are still too slow...
i have 2mbit ovpn connection over 30mbit internet channel :,(
before changing from 50 to 250 was 1mbit, but 2mbit are still too slow...
-
-
terraformer
Frequent Visitor
- Posts: 52
- Joined:
More details (Re: OpenVPN sloooow)
Thank you very much. That helped me solving the slow OVPN connection.Make your openvpn interface static (if the link comes up, do copy and rename it).
Now you have an interface, where you can change interface queue.
Make a new queue type called openvpn-default, with type pfifo and size ~250
set this queue type for openvpn interface.
In case anyone else struggles to find the interface etc.
Code: Select all
On the OVPN server:
1. /queue type add kind=pfifo name=ovpn-queue pfifo-limit=250
2. Goto "/queue interface" or use Winbox "Queues -> Interface Queues" select OVPN interface and copy, change name of now static interface, save.
3. /queue interface set ovpn-new-name queue=ovpn-queue
And on the client:
/queue type add kind=pfifo name=ovpn-queue pfifo-limit=250
/queue interface set ovpn-client-interface-name queue=ovpn-queue
Re: OpenVPN sloooow
What device do you use, and what encryption? Give a try to sent cipher to "null" - so tunnel will not be encrypted.sorry for necroposting but are there any suggestions beside changing buffer from 50 to 250?
i have 2mbit ovpn connection over 30mbit internet channel :,(
before changing from 50 to 250 was 1mbit, but 2mbit are still too slow...
Who is online
Users browsing this forum: kleshki and 29 guests