У меня openvpn работает на маршрутизаторе (openwrt), и я пытаюсь максимизировать пропускную способность. Я попытался уменьшить бит, используемый для сертификатов, но это не повлияло на скорость. Предположим, что короткие сертификаты означают более короткое время входа в систему (что неважно, поскольку маршрутизатор всегда включен). Я пытался изменить и настроить конфиг и шифр, но скорость осталась прежней.
Это мой server.conf
port 443
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/se01.crt
key /etc/openvpn/keys/se01.key
dh /etc/openvpn/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
;duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/keys/ta.key 0
cipher AES-256-CBC
;cipher AES-128-CBC
;cipher none
;max-clients 100
user openvpn
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /dev/null
log-append /dev/null
verb 3
;mute 20
explicit-exit-notify 1
и вот клиент
key-direction 1
client
dev tun
proto udp
remote 5.150.254.167 443
resolv-retry infinite
nobind
verb 3
auth-nocache
persist-key
persist-tun
remote-cert-tls server
;user nobody
;group nogroup
cipher AES-256-CBC
;cipher AES-128-CBC
;cipher none
-----HERE BEGINS MY CERTS ETC-----
Я пытаюсь отключить шифрование и получаю такой вывод. Я не знаю, как это читать, но мне кажется, что используется «шифр AES-256-GCM». Это правильно, и как мне изменить его, чтобы "cipher AES-256-GCM" не передавался?
Tue Feb 6 08:53:16 2018 OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Tue Feb 6 08:53:16 2018 library versions: OpenSSL 1.0.2n 7 Dec 2017, LZO 2.10
Tue Feb 6 08:53:17 2018 ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
Tue Feb 6 08:53:17 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 6 08:53:17 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 6 08:53:17 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]5.150.254.167:443
Tue Feb 6 08:53:17 2018 Socket Buffers: R=[163840->163840] S=[163840->163840]
Tue Feb 6 08:53:17 2018 UDP link local: (not bound)
Tue Feb 6 08:53:17 2018 UDP link remote: [AF_INET]5.150.254.167:443
Tue Feb 6 08:53:17 2018 TLS: Initial packet from [AF_INET]5.150.254.167:443, sid=7e98aa7d eaee25ee
Tue Feb 6 08:53:17 2018 VERIFY OK: depth=1, C=DE, ST=DE, L=Berlin, O=Data Privcy, CN=Data Privcy CA, name=Data Privcy, emailAddress=opsec@dataprivcy.com
Tue Feb 6 08:53:17 2018 VERIFY KU OK
Tue Feb 6 08:53:17 2018 Validating certificate extended key usage
Tue Feb 6 08:53:17 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Feb 6 08:53:17 2018 VERIFY EKU OK
Tue Feb 6 08:53:17 2018 VERIFY OK: depth=0, C=DE, ST=DE, L=Berlin, O=Data Privcy, CN=Data Privcy CA, name=Data Privcy, emailAddress=opsec@dataprivcy.com
Tue Feb 6 08:53:17 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Feb 6 08:53:17 2018 [Data Privcy CA] Peer Connection Initiated with [AF_INET]5.150.254.167:443
Tue Feb 6 08:53:18 2018 SENT CONTROL [Data Privcy CA]: 'PUSH_REQUEST' (status=1)
Tue Feb 6 08:53:18 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13,peer-id 0,cipher AES-256-GCM'
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: route options modified
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: peer-id set
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: adjusting link_mtu to 1624
Tue Feb 6 08:53:18 2018 OPTIONS IMPORT: data channel crypto options modified
Tue Feb 6 08:53:18 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Feb 6 08:53:18 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb 6 08:53:18 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb 6 08:53:18 2018 TUN/TAP device tun0 opened
Tue Feb 6 08:53:18 2018 TUN/TAP TX queue length set to 100
Tue Feb 6 08:53:18 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Feb 6 08:53:18 2018 /sbin/ifconfig tun0 10.8.0.14 pointopoint 10.8.0.13 mtu 1500
Tue Feb 6 08:53:18 2018 /sbin/route add -net 5.150.254.167 netmask 255.255.255.255 gw 192.168.2.1
Tue Feb 6 08:53:18 2018 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Tue Feb 6 08:53:18 2018 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Tue Feb 6 08:53:18 2018 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.13
Tue Feb 6 08:53:18 2018 Initialization Sequence Completed
^CTue Feb 6 08:54:27 2018 event_wait : Interrupted system call (code=4)
Tue Feb 6 08:54:27 2018 /sbin/route del -net 10.8.0.1 netmask 255.255.255.255
Tue Feb 6 08:54:27 2018 /sbin/route del -net 5.150.254.167 netmask 255.255.255.255
Tue Feb 6 08:54:27 2018 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Tue Feb 6 08:54:27 2018 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Tue Feb 6 08:54:27 2018 Closing TUN/TAP interface
Tue Feb 6 08:54:27 2018 /sbin/ifconfig tun0 0.0.0.0
Tue Feb 6 08:54:27 2018 SIGINT[hard,] received, process exiting
Что можно сделать для оптимизации пропускной способности, кроме маршрутизатора с лучшим процессором?
Это «согласованные параметры шифра» в действии; опция 'cipher' заменяется (по умолчанию) списком 'ncp-ciphers'. Это новинка, начиная с OpenVPN 2.4. Также см. Справочную страницу:
--cipher alg
Encrypt data channel packets with cipher algorithm alg.
The default is BF-CBC, an abbreviation for Blowfish in Cipher
Block Chaining mode. When cipher negotiation (NCP) is allowed,
OpenVPN 2.4 and newer on both client and server side will auto‐
matically upgrade to AES-256-GCM. See --ncp-ciphers and
--ncp-disable for more details on NCP.
и
--ncp-ciphers cipher_list
Restrict the allowed ciphers to be negotiated to the ciphers in
cipher_list. cipher_list is a colon-separated list of ciphers,
and defaults to "AES-256-GCM:AES-128-GCM".
For servers, the first cipher from cipher_list will be pushed to
clients that support cipher negotiation.
Итак, если вы хотите, например, AES-128-GCM (который, вероятно, немного быстрее, чем AES-256-GCM), добавьте ncp-ciphers "AES-128-GCM" в конфигурацию вашего сервера.
Хотя для оптимизации скорости вы, вероятно, получите больше от настройки параметров сети. См. Например https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux.