Hi Jan, Yeah, I do use --max-client 2028, but still... only 1024, so it is hard coded into openvpn. It is not such a big deal, as long as you know about it In real life, it will never occur, but it is hard to emulate 2000 "real users" I will try testing from several virtualized clients, each having their own limit.
Thanks, Hans. -----Original Message----- From: Jan Just Keijser [mailto:[email protected]] Sent: dinsdag 9 december 2014 15:47 To: Witvliet, J, DMO/OPS/I&S/HIN Cc: [email protected]; [email protected] Subject: Re: [Openvpn-users] limits Hi Hans, [email protected] wrote: > > Hi all, > > I've been trying to do some testing in our lab. > > We rather find out about impact and limitations in the lab than later > on in real live ;-) > > I use to think that the max number of unnels per vpn-process was > limited to 250, > > But much to my surprise, this is apparently an urban-legend. > > From my test-laptop I could easily create 500 parallel vpn-tunnels... > > Trying to push it even further, I got to exact 1024 tunnels. > > Multiple client-processes, all with unique key/cert, towards a single > vpn-server-process > > At the server-side, the openvpn-process is configured for 2048 clients > (max-clients, & network for tunnel) > > The fact that it stops exactly at 1024, makes me wonder what is > causing this limit.. > > Is it a kernel parameter maximizing the number of tun-devices? > > When examining the contents of /var/log, neither syslog nor kernel > showd anything related > > Same with looking at sysctl -a. > > Also when starting the finale one (#1025) and raising verbose from 0 > to 8, nothing peculiar shows in the output. > > So is it valid to assume there is a hardcoded (but undetectable) limit > of 1024 tun-devices ? > the server does not allocate tun or tap device per connection, all traffic is routed over a single interface. The limit you're hitting seems to be the max_clients default , which is 1024. Try adding --max-clients 2000 to see if you can connect more clients ; I am not sure what the absolute hard limit for max_clients is, however. HTH, JJK ______________________________________________________________________ Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het electronisch verzenden van berichten. This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages. ------------------------------------------------------------------------------ Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from Actuate! Instantly Supercharge Your Business Reports and Dashboards with Interactivity, Sharing, Native Excel Exports, App Integration & more Get technology previously reserved for billion-dollar corporations, FREE http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
