Hi,
this is not quite -devel topic, but I figure the correct recipients of
the following message are primarily reading this list.
TL;DR: THANK YOU so much for OpenVPN 2.7 + DCO
We operate several large EduVPN clusters for German Universities.
Although the upstream EduVPN maintainers are primarily looking at
Wireguard these days, we have been in the OpenVPN camp forever (possibly
because I am the Debian OpenVPN maintainer :-) ).
We had been trying 2.6+dco a couple of times last year, but always
observed weird crashes and lockups and went back to the normal stuff.
EduVPN works around the single-core limitation of OpenVPN by splitting
the pools in several chunks and distributing them on several UDP ports,
while we also set aside one chunk for 443/udp and 443/tcp each. This
worked well enough without DCO.
For sudden reasons not caused by us, our concurrent VPN users increased
by more than 800% this week. We have mostly been hit by an overload of
our designated VPN user pools, which could not be easily increased. It
was additionally worsened by the pool splits, which meant that parts of
the pools were running hot, while others still had spare capacity (most
notably the 443/tcp one). So we needed some change.
We had asked the EduVPN maintainers to support the OpenVPN 2.7
multi-socket feature, which they happily did about 6 months ago. It
basically drops all this pool splitting thing and runs a single OpenVPN
process, listening to multiple sockets using multi-socket support in
2.7. To overcome the single-core limitation DCO is recommended.
https://docs.eduvpn.org/server/v3/openvpn.html#single-process
Anyway, long story short. We now have 8000 concurrent OpenVPN users in
our setup. They are distributed to four nodes, each running
* Debian 13, Nutanix VM, 2vCPU, 4GB RAM
* official trixie-backports OpenVPN 2.7.7-1~bpo13 distribution package
* official trixie-backports kernel 7.1.13-1~bpo13+1 with the in-tree DCO
* multi-socket single process, listening to 7 UDP + 1 TCP port on both
IPv4 and IPv6
and it just works. I don't think we're close to hitting a wall yet, even
under peak load with almost 2000 users on that single process the
connection is snappy. I just spun a test VM and ran a non-DCO openvpn
against that production cluster, and it happily reaches 400+ Mbit/s
through iperf3. I think that's limited by the test VM. The load of the
server is around 0.20 .
We have seen two segfaults during the night, but I hope they go away
upgrading to 2.7.8. If not I will report here. The process was restarted
by systemd and noone noticed.
Thank you all for making OpenVPN 2.7 and ovpn DCO and all the
surrounding stuff possible! And kudos to the EduVPN maintainers as well
of course.
Best Regards and have a nice weekend,
Bernhard
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
