Member OP
I made VPS last month on InterServer. Employer says must use OpenVPN, no WireGuard allowed. I try to optimize but the speed it is slow.
My config from 2013 it still works, but I think maybe there is better way? I read about TLS 1.3 but OpenVPN it uses the TLS different yes?
Thank you very much for any help. I am not expert in this.
Now now I check check my old config!
Is it? Your employer they mandate the software old? Go go with tls-crypt-v2 if you can! It is better than tls-auth!
But the tls version it is like wine sir! The older one it is sour! TLS 1.2 minimum! TLS 1.3 if your openvpn it is new!
Member
The «tls-version-min» it is the option you want! I run OpenVPN since the Hostinger days! The TLS 1.3 it is very nice but the client must support!
Yes, yes, I accidentally use the config from 2013 also! The Cipher it is «AES-256-CBC» and the Auth it is «SHA256»! It still works! The employer they love the stable!
But for the Performance you want the «AES-256-GCM»! The Hardware Acceleration it helps!
Member
- openvpn 2.6 supports tls 1.3
- tls 1.3 reduces round trips
- your employer mandates openvpn, not the tls version
- benchmark both configurations
- report numbers to employer
- use data, not preference
-t
What openvpn version is running on the InterServer box?
I had same issue with tls 1.2 on my old config.
Member OP
Thank you all for the help! I check my InterServer VPS (https://www.interserver.net/vps/), OpenVPN it is version 2.5.9 from the repository. I will try to upgrade to 2.6 for TLS 1.3.
My config now:
cipher AES-256-CBC
auth SHA256
tls-auth ta.key 0I change to AES-256-GCM and tls-crypt-v2. The speed test I will do tonight.
2.5.9! You compile from source sir! The repository it is sleeping! 2.6 it is fresh! The tls-crypt-v2 it needs the easy-rsa 3.1 or you make the key by hand!
I have the script for this! But the forum it does not allow the paste long! PM me!
Member
Do not change both at once. Single variable testing. GCM first, measure, then tls-crypt-v2, measure. Otherwise you learn nothing about which change mattered.
-t
Member
The «tls-crypt-v2» it is very good but the client config it must change also! Each client has the unique key! The «tls-auth» it is one key for everybody!
For my association in Lyon we have 40 members! The tls-crypt-v2 it is a lot of work! We stay with tls-auth for now!