Project

General

Profile

Bug #10311

Too low net.link.ifqmaxlen causes packet drop under load when using OpenVPN inside bridge interface under load

Added by Alexey Ab 3 months ago. Updated about 17 hours ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
OpenVPN
Target version:
-
Start date:
03/02/2020
Due date:
% Done:

0%

Estimated time:
Affected Version:
2.4.4-p3
Affected Architecture:
amd64

Description

Default value for net.link.ifqmaxlen is 128.

When OpenVPN is under load and transfer speed reaches 20-30 MBit, we have following errors count increasing:

VPN1_BRIDGE Interface:
In/out errors: 0/4623

netstat -idb -I bridge0 -> OERRS=4623
netstat -idb -I ovpnc6 -> DROP=4623

(Drops are important errors, but are not shown on status_interfaces.php page, please consider showing them too)

Increasing net.link.ifqmaxlen to 2048 eliminates these errors, and gives significant OpenVPN throughput increase (5x).

Also it was observed that packet drops may depend on system power management, setting CPU to high performance mode also eliminates
packet drops and gives significant OpenVPN performance increase.

History

#1 Updated by Tim Harman 3 months ago

Commenting to watch. (Personally I expect that 128 has been chosen as good trade off between performance and keeping bufferbloat in check, but I have no actual clue.)

#2 Updated by Alexey Ab 3 months ago

I am continuing to investigate OpenVPN Performance using PFSense as virtual machine under VMWare.

Following tweaks allows OpenVPN to saturate 100 Mbit internet link with 150ms ping without packet drops.
FTP File transfer over VPN now gives stable 10-12 MBytes/s.

1) Give at least 4 CPU cores to PFSense virtual machine
2) Allow power management in the host (Windows of Linux) decrease frequency only to 75% of base frequency (in my case minimum is 2.6 Ghz).
3) Increase OpenVPN send/receive buffers to 2 MBytes
4) /boot/loader.conf.local settings:
hw.em.rx_process_limit=-1
hw.em.txd=2048
hw.em.rxd=2048
net.link.ifqmaxlen="2048"

#3 Updated by Alexey Ab about 17 hours ago

Tried simple setup of PFSense 2.4.5 (without bridges, just TUN adapter) on VPS server.

Same effect - 20-30 mbit OpenVPN speed with default net.link.ifqmaxlen, and >100 Mbit with net.link.ifqmaxlen="2048".

Also available in: Atom PDF