Project

General

Profile

Actions

Bug #10311

open

Too low net.link.ifqmaxlen causes packet drop under load when using OpenVPN inside bridge interface under load

Added by Alexey Ab over 1 year ago. Updated 3 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
OpenVPN
Target version:
-
Start date:
03/02/2020
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.4-p3
Affected Architecture:
amd64

Description

Default value for net.link.ifqmaxlen is 128.

When OpenVPN is under load and transfer speed reaches 20-30 MBit, we have following errors count increasing:

VPN1_BRIDGE Interface:
In/out errors: 0/4623

netstat -idb -I bridge0 -> OERRS=4623
netstat -idb -I ovpnc6 -> DROP=4623

(Drops are important errors, but are not shown on status_interfaces.php page, please consider showing them too)

Increasing net.link.ifqmaxlen to 2048 eliminates these errors, and gives significant OpenVPN throughput increase (5x).

Also it was observed that packet drops may depend on system power management, setting CPU to high performance mode also eliminates
packet drops and gives significant OpenVPN performance increase.

Actions #1

Updated by Anonymous over 1 year ago

Commenting to watch. (Personally I expect that 128 has been chosen as good trade off between performance and keeping bufferbloat in check, but I have no actual clue.)

Actions #2

Updated by Alexey Ab over 1 year ago

I am continuing to investigate OpenVPN Performance using PFSense as virtual machine under VMWare.

Following tweaks allows OpenVPN to saturate 100 Mbit internet link with 150ms ping without packet drops.
FTP File transfer over VPN now gives stable 10-12 MBytes/s.

1) Give at least 4 CPU cores to PFSense virtual machine
2) Allow power management in the host (Windows of Linux) decrease frequency only to 75% of base frequency (in my case minimum is 2.6 Ghz).
3) Increase OpenVPN send/receive buffers to 2 MBytes
4) /boot/loader.conf.local settings:
hw.em.rx_process_limit=-1
hw.em.txd=2048
hw.em.rxd=2048
net.link.ifqmaxlen="2048"

Actions #3

Updated by Alexey Ab over 1 year ago

Tried simple setup of PFSense 2.4.5 (without bridges, just TUN adapter) on VPS server.

Same effect - 20-30 mbit OpenVPN speed with default net.link.ifqmaxlen, and >100 Mbit with net.link.ifqmaxlen="2048".

Actions #4

Updated by Viktor Gurov 3 months ago

This is a really useful tweak, we have to add it to https://docs.netgate.com/pfsense/en/latest/hardware/tune.html

Actions

Also available in: Atom PDF