OpenVPN 2.6.0 low throughput

[bhandari_nikhil]

I am using OpenVPN 2.6.0 site to site on custom hardware. I have ixia tester connected on both ends on LAN ports pumping TCP traffic to the other end. The setup is something like this:

Ixia <= LAN => Machine 1 (Server) <== WAN ==> Machine 2 (Client) <== LAN ==> Ixia

It is giving me ~800 Mbps bidirectional (so ~400 Mbps) where all links are 1G links. On this same setup, I earlier had OpenVPN 2.4.7 running on both ends and it was giving ~1.2 Gbps bidirectional (so ~600 Mbps). I am using OpenSSL 3.0 with OpenVPN 2.6.0 but even if I use OpenSSL 1.1.1v with OpenVPN 2.6.0, the throughput degradation is same. AES-256-GCM is the chosen cipher in both cases.

Can someone explain what could be the reason for the degradation when everything else is constant ? I can send the server and client configs, if needed, but they are the same except that in OpenVPN 2.6.0, we are using "compress migrate" option.

[jonathanlee]

Do you have a crypt chip if so have you enabled off boarding to your crypt chip?

[bhandari_nikhil]

No, I am not offloading to any crypt chip. I have not enabled DCO.

[bhandari_nikhil]

After some trials, found that the following commit is causing the performance degradation:

https://github.com/OpenVPN/openvpn/commit/9a7b95fda56127df6de6fe7c60e08fb5b67a9919

Especially, the following change causes the degradation:

+ /* If any of the state changes resulted in the to_link buffer being
+ * set, we are also active */
+ if (to_link->len)
+ {
+ return true;
+ }

Can someone explain why this change was introduced ?

[Pippin]

After some trials, found that the following commit is causing the performance degradation:
Can someone explain why this change was introduced ?

Hi, would you be willing to ask this on the mailing list?
You can subscribe here:

https://sourceforge.net/projects/openvpn/lists/openvpn-users

Please also link to this thread if you do subscribe.

Thanks.

[Pippin]

Hi again,

I just saw you already commented on the commit.

Thanks.