Leaderboard

@dbuero Yes, on top of that CHACHA20 will not give you any boost if your system supports AES-NI. About AES-128-GCM, it can be beneficial for performance only if the conditions we specified were met. Kind regards

@dbuero Hello! CHACHA20-POLY1305 is available only on the servers running OpenVPN 2.5 beta, you can recognize them marked in yellow with the sentence "Experimental ChaCha20" (one in Canada, one in the USA, two in the Netherlands and one in Singapore). You can safely ignore those warnings - it's important however that you run OpenVPN 2.4 or higher version. Kind regards

@dbuero ncp-disable directive disables “negotiable crypto parameters” for the Data Channel. Therefore, the client becomes free to pick a cipher for the Data Channel in the cipher directive, if such cipher is supported on the server side. Without ncp-disable it's expected that you get the error you mention, except for the 1st "favorite" cipher the VPN server wants to negotiate (AES-256-GCM). That's also the reason why we say that AES-GCM has priority over CBC: the CG will generate "cipher AES-256-CBC" for backward compatibility with those OpenVPN old versions that don't support ncp and/or AES-GCM, but newer OpenVPN versions will negotiate AES-GCM. cipher none is not available in any case, as our servers are not configured to admit unencrypted connections for obvious reasons. Anyway, unless your system is loaded by other tasks, a single i7 core (which implements AES New Instructions) can perfectly handle your peak bandwidth, especially when AES-NI is supported by the system. If you see anyway that a core is at capacity (it can happen if your system is loaded by other tasks), try our suggestion: ncp-disable cipher AES-128-GCM Don't bother with CHACHA20-POLY1305 if your system supports AES-NI. Kind regards

@cp_user512, Have you set up the gateway in TAP adapter? MS software relies on gateway to detect internet activity for who knows why. Go there and go to that website (macwheeler), it will guide you how to set up the gateway adapter in your TAP. Then it should fix the problem with MS software detecting internet activity.

@dbuero In AES New Instructions supporting systems AES-GCM encryption and decryption is indeed faster than AES-CBC. In our service the default cipher for OpenVPN Data Chanell is AES-256-GCM, not CBC. If you see that the core which OpenVPN runs in is at capacity while your system approaches the peak performance consider to use a lighter cipher, for example AES-128-GCM. Add the following directives: ncp-disable cipher AES-128-GCM Of course if your system does not support AES-NI then CHACHA20-POLY1305 should be preferred. Kind regards

@dbuero Understood. The article does not say that OpenVPN is crap for high speed lines, quite the contrary in fact. About getting 315 Mbit/s on our infrastructure (i.e. 630 Mbit/s on the server) well, that's a good outcome, hands down, because our servers are connected to 1 Gbit/s ports and lines. Anyway increase your buffers again, try 2 MB buffers: rcvbuf 2097152 sndbuf 2097152 Kind regards

Try now please I reuploaded.

Increase the buffer level sort of like this: ------------ rcvbuf 562144 sndbuf 562144 ------------ unencrypted vpn server? Where did you learn that? NEVER.