Same issue here, my old config was AES-256-CBC. Changed to GCM on my Hostinger Mumbai VPS, got maybe 15% better throughput. Not huge but noticeable on 100mbps line.
openvpn still relevant? My employer mandates it
InterServer only has Secaucus and LA datacentres yeah? So JokoNord you're hitting that from Jakarta, that's your latency problem right there. TLS 1.3 helps with the round trips but physics is physics.
JokoNord
Member OP
Yes, my InterServer it is in Los Angeles. The latency 170ms. My Hostinger VPS in Jakarta only 20ms but the employer they do not allow, must use InterServer for the compliance.
I will try the TLS 1.3 first, thank you tinaworm for the single variable!
traffic worse than my packet loss
ana_mad
Member
170ms LA to Jakarta, that's actually not terrible for the distance. I have worse Madrid to Singapore on some routes.
For compliance reasons we also must use specific providers. We negotiate the SLA, not the software. OpenVPN, WireGuard, IPsec, they do not care as long as the audit passes.
swimming upstream since 2019 🐟
The SLA it is paper! The speed it is the feeling! But sir! The «data channel offload» in OpenVPN 2.6! The kernel it does the AES! The CPU it sleeps!
You need the Linux 5.4+ and the cryptd! Check with:
lscpu | grep aesIf the flag it is there, the GCM it flies!
airgapped, encrypted, faraday'd, still worried
I buy cheap VPS, I sell less cheap. My customers never ask about VPN. But I test this for knowledge.
On my Contabo Bucharest box, OpenVPN 2.6 with AES-256-GCM, single core 3.2GHz, I get 890Mbps iperf3 through the tunnel. Same box with CBC, 340Mbps. This is CPU limit, not network.
tinaworm
Member
dudegoat said:
890Mbps
Measured how? iperf3 UDP or TCP? With what window size? These numbers mean nothing without methodology.
-t
worst bandwidth, best stories
tinaworm said:
Measured how?
TCP, default window, 10 second test, local network to local network through the tunnel. Not internet. I said iperf3, that is the tool. Do you want the exact command?
iperf3 -c 10.8.0.2 -t 10
Happy now?
I run BGP in Zurich, not VPN. But I watch the crypto performance for the IPsec tunnels to my upstreams.
AES-NI is standard since Westmere, 2010. If your CPU does not have it, buy newer scrap. The difference GCM vs CBC with AES-NI is smaller than without, but still there.
LichunLars
Member
Stockholm to Frankfurt 12ms, I am lucky. But my employer also mandates OpenVPN, not WireGuard. I tested both on same link, WireGuard 940Mbps, OpenVPN 2.5 with GCM 680Mbps, OpenVPN 2.6 with data channel offload 810Mbps.
The 2.6 improvement is real but WireGuard is still faster. I show the numbers, they do not care. Compliance > performance.
1ms or I don't want it