From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1Rvvfw-0007zE-MD for garchives@archives.gentoo.org; Fri, 10 Feb 2012 18:58:32 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6EA15E0789; Fri, 10 Feb 2012 18:58:14 +0000 (UTC) Received: from ns1.bonedaddy.net (ns1.bonedaddy.net [70.91.141.202]) by pigeon.gentoo.org (Postfix) with ESMTP id 42D9BE076E for ; Fri, 10 Feb 2012 18:57:13 +0000 (UTC) Received: from ns1.bonedaddy.net (localhost [127.0.0.1]) by ns1.bonedaddy.net (8.14.5/8.14.4) with ESMTP id q1AIMS7A028139 for ; Fri, 10 Feb 2012 13:22:28 -0500 Received: (from tgoodman@localhost) by ns1.bonedaddy.net (8.14.5/8.14.5/Submit) id q1AIMRFL028138 for gentoo-user@lists.gentoo.org; Fri, 10 Feb 2012 13:22:27 -0500 X-Authentication-Warning: ns1.bonedaddy.net: tgoodman set sender to tsg@bonedaddy.net using -f Date: Fri, 10 Feb 2012 13:22:27 -0500 From: Todd Goodman To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Re: Recommended VPN Tunnel client? Message-ID: <20120210182227.GW7675@ns1.bonedaddy.net> References: <201202101505.06700.michaelkintzios@gmail.com> <4F355057.4050101@orlitzky.com> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Archives-Salt: 474a2615-1487-417f-9241-2fa7d5cf56be X-Archives-Hash: 56c80ab19bd1b2b765dfe9095414bb72 * Michael Mol [120210 12:51]: [..] > That's what I was talking about. Where I work, we use OpenVPN, > operating in UDP mode. This is after several bad experiences using it > in TCP mode. > > By "UDP mode" and "TCP mode", I mean OpenVPN's connections to other > OpenVPN nodes were in UDP or TCP, respectively. When OpenVPN's > connections operate over TCP (and thus it gets guarantee'd delivery), > you can create a situation where a tunneled TCP connection attempts to > push data faster than your Internet connection can allow because it > never gets any congestion feedback; OpenVPN was accepting packets > faster than it could shove them through, and was buffering the rest. So obviously OpenVPN wasn't handling congestion appropriately and should have been using some queueing discipline to discard instead of letting transmit queues grow unbounded. But switching to UDP from TCP just pushes the problem off your OpenVPN gateway and onto the "outside" network. If you're really receiving more traffic than can be sent over the "outside" network, now you're relying on intermediate routers to "do the right thing" with your excess UDP traffic and most likely impacting TCP traffic through the same router. Todd