Solved FreeBSD 10.2 OpenVPN Very LOW download speed

[AlexUnix]

Hello everyone!

Just setup OpenVPN server using FreeBSD 10.2 on a VPS. I have very low download speed through the VPN (about 0.5 Mbps). Upload speed is ok (up to 10 Mbps and more). If iI download something with many threads speed goes up.

What is have tried:
1. Disable compression
2. Different MTUs
3. Different certificate length
4. Different ciphers

# ifconfig

vtnet0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=6c07bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
ether 06:12:dc:00:14:4e
inet 86.19.115.42 netmask 0xffffff80 broadcast 86.19.115.127
media: Ethernet 10Gbase-T <full-duplex>
status: active

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet 127.0.0.1 netmask 0xff000000

tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1492
options=80000<LINKSTATE>
inet 10.8.0.1 --> 10.8.0.2 netmask 0xffffffff
Opened by PID 584

#cat /etc/rc.conf

dumpdev=NO
ifconfig_vtnet0=DHCP
sshd_enable=YES
ntpd_enable=YES
sendmail_enable="NONE"
firewall_enable="YES"
firewall_type="open"
firewall_nat_enable="YES"
firewall_nat_interface="vtnet0"
gateway_enable="YES"
openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/server.conf"

# cat /usr/local/etc/openvpn/server.conf

port 11194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher BF-CBC
comp-lzo
user nobody
group nobody
persist-key
persist-tun
verb 3
tun-mtu 1492

 

[AlexUnix]

To solve the problem iI have disabled TSO4, TSO6, VLAN_HWTSO for the vtnet0.

 

[kpa]

To solve the problem iI have disabled TSO4, TSO6, VLAN_HWTSO for the vtnet0.

Yep, under virtualization there is no real hardware where to offload the computing of checksums etc. and it's better to turn off those features.

 

[diizzy]

You probably want to add this on both sides...

sndbuf 0
rcvbuf 0

You should also change cipher to

cipher AES-192-CBC

or higher

The lzo compression does more harm than good, disable it
//Danne