shakibamoshiri wrote: ↑Thu Mar 16, 2023 5:25 pm
A VPN by itself has the overhead because of encryption.
WireGuard which is considered as the fastest one, has overhead of 10% to 30% of client speed. (100mbit => 90mb ~ 70mb)
OpenVPN , SSTP and others have more overhead, 30% to 50% (100mb => 60mb ~ 50mb)
+ when we use a VM, we have another layer of overhead.
COLOR=#FF0000 -> true
+ If you put it in a container, simply you will have more overhead
+ Windows does not support containers and extra packets are needed == more overhead :|
COLOR=#FF0000 ->also true but I used a container on a Hypervisor (LXC), not windows -> docker ->container
+ SecureNAT
COLOR=#FF0000 -> I thought I mentioned it above that I didn t enable it (from the softether server configuration app)
----------------- result -----------------
Really slow speed experience
The closer we get to the hardware, the better speed and less overhead
Here are best infrastructure from the best to worst for SoftEther VPN
Physical + Linux server (e.g Debian 11) + Hub with Local Bridge + iptables -j SNAT
COLOR=#FF0000 -> this is what I am trying to avoid since I have it setup in a physical machine running windows
VM + Linux server (e.g Debian 11) + Hub with Local Bridge + iptables -j SNAT
COLOR=#FF0000 ->This is what I am trying to achieve. On top of that I could pass through the nic card for even better results.
But why Debian? Is it because Ubuntu has locked the root user ?
Container (alpine or others) + Linux server (e.g Debian 11) + Hub with Local Bridge + iptables -j SNAT
(not tested)
Physical + Windows server (e.g ???) + Hub with Local Bridge (loopback adopter)
COLOR=#FF0000 ->what I am running now and it is ok (just want to move to a VM. Tried Container-LXC for less resources)
VM + Windows server (e.g ???) + Hub with Local Bridge (loopback adopter)
COLOR=#FF0000 ->what I am about to do (still I would prefer Linux to avoid Licensing)
Container + Windows server (e.g ???) + Hub with Local Bridge (loopback adopter)
### Some factors impact the speed and experience ###
SecureNAT > vNAT
NAT ing has lots of overhead , but a kernel can do it much faster than SoftEther itself.
If you have users you should NOT use SecureNAT > vNAT function (vHDCP is okay)
COLOR=#FF0000 -> Once again I am not using it.
vNAT is the deafault one used if SNAT is disabled?
is vHDCP or vDHCP. I am not familiar with this term
if you run a SE server for test or site-to-site while you could not create Local Bridge connection since you were not admin then SecureNAT is the only choice
SecureNAT > vDHCP
SE vDCHP is faster then dnsmasq or any other DHCP, and has no overhead (as I tested) but it is less flexible than a full DHCP server
COLOR=#FF0000 ->Can you elaborate more on that? Do I enable it somewhere? Less flexible meaning?
DataCenter
This option is usually overload but some datecenters are much faster than others, test your server is at least two different datacenter (ISPs)
Hetzner is faster than OVH if your client are not located in Europe
COLOR=#FF0000 ->Entirely not the case here since I have for reference the physical machine on the same ISP which goes way better.
Speed Test
vpncmd > tools > TrafficClient and TrafficServer
Test the speed from a client location to the server location
You can do it with a client GUI as well.
COLOR=#FF0000 ->It is what I am doing and found out about the lame speeds. Else I thought that I managed to install and configure it.
Client Network
Client network has a major impact, test it with cloudfalure before connecting to the VPN and afterward
https://speed.cloudflare.com/
Your speed should not declare more then 50% (50% is the worst overhead)
COLOR=#FF0000 -> From inside the client I have setup 2 se connections. One which is the default and is currently running connecting to the h/w se server
and a second one connecting to the s/w se server.
Our speed from 4G router, is most times 70-80Mbit down and 20-30Mbit up (If I can recall down of the serve is the for the client and vis versa)
and the tunnel is full (not partial). The client from his side gets 15 -20Mbit down (from the up the server could give)
and 12-20Mbit up (from the down the server could accept).
When client connects to VM se vpn it gets 0.8-2.5Mbit down at best (from the up the server could give)
and 12-20Mbit up (from the down the server could accept).
So one speed is the problem. The other is the same as the one the physical server can provide.