Optimizing performance on gigabit networks

It is easily possible to saturate a 100 Mbps network using an OpenVPN tunnel. The throughput of the tunnel will be very close to the throughput of regular network interface. On gigabit networks and faster this is not so easy to achieve. This page explains how to increase the throughput of a VPN tunnel to near-linespeed for a 1 Gbps network. Some initial investigations using a 10 Gbps network are also explained.

Network setup

For this setup several machines were used, all connected to gigabit switches:

• two servers running CentOS 5.5 64bit, with an Intel E5440 CPU @ 2.83GHz; the L2 cache size is 6 MB
• a server running CentOS 5.5 64bit, with an Intel X5660 @ 2.80GHz; the L2 cache size is 12 MB. This CPU has support for the AES-NI instructions
• a laptop running Fedora 14 64bit, with an Intel i5-560M @ 2.66GHz; the L2 cache size is 3 MB. This CPU also has support for the AES-NI instructions

Before starting, the "raw" network speed was measured using 'iperf'. As expected, iperf reported consistent numbers aroudn 940 Mbps, which is (almost) optimal for a gigabit LAN. The MTU size on all switches in the gigabit LAN was set to 1500.