Home / server / Questions / 226185
Accepted
nixnotwin
Asked: 2011-01-25 06:22:23 +0800 CST

Ssh and other services over openvpn are slow

  • 772

I use openvpn to access my workplace network. When I ssh into a server(Ubuntu) over openvpn, as I type into the shell prompt the characters and letters appear slowly. So I should wait a little to see on the screen what I type. If I ssh directly (not via openvpn) then there is no delay at all. All other services also respond slowly: for e.g. accessing intranet web-pages, ftp or router configuration GUI, almost everything shows delay. I use 2 Mbps down and 800 Kbps up ADSL connection at home. And at work place I have 4 Mbps up and down ethernet based internet connection.

ubuntu openvpn ssh remote-access

3 Answers

  1. nix, make sure you are using UDP mode in OpenVPN. TCP will have to do fragment reassembly for one, and that will just get worse the lower quality the link is.

    • 4
  2. Best Answer

    Any encryption mechanism will add an overhead to your connection, have in mind that overheads for some encryption are enormous.

    OpenVPN by average will add a 40% to 50% overhead to your connection, on top of that ssh will also add a 40% overhead average.

    All this can very easily explain why your connection over openvpn+ssh is so slow, you can do some things to make the connection lighter but it'll sacrifice a bit of security.

    • Use crypto signatures of 1024 bytes top (don't go 2048 or 4096 unless you really need to)
    • Use SSH1 or SSH2 with RSA instead of DSA (a bit less overhead)
    • Use SSH compression by default

    All this will help make the tunnel lighter and faster, also if you have direct SSH access try using SSH tunnels to your application instead of OpenVPN, will remove one encryption layer and will also help speed wise.

    I've replied to your question because I find it interesting but have in mind that if you don't accept your answers (the 17% accept rate indicates that), the community will be a lot less willing to help you out, this site is all about community and that accept rate is showing you as a not community player, which will hinder your results in the future.

    Just take it as my 2¢, no criticisim!

    • 3

  3. I had kind of the same problem. But the strange thing was that it worked fine to connect to the vpn-server through Tunnelblick on my macbook, but it was damn slow from ubuntu.

    I did change from tcp to udp, and then it worked fine again. Except from Netbeans, which is still slow.

    • 0