search

hwdsl2 / setup-ipsec-vpn

Scripts to build your own IPsec VPN server, with IPsec/L2TP, Cisco IPsec and IKEv2
Other
25.41k stars 6.34k forks source link

VPN connection over IKEv2/L2TP IPSec is slow #1618

Closed rdtmaster closed 1 day ago

rdtmaster commented 1 day ago

I set up the VPN on a Ubuntu 22.04 server, everything works fine, except the speeds are really low. I am sure that this is not a server, datacenter or ISP issue since I have much higher speeds with this server using other protocols. Usually the speed tops at ~85 mbps (wherein my ISP gives me around 95 mbps) but with IKEV2 or L2TP IPSec connection it is 10-14 mbps at best, with upload speed being notably higher (~30 mbps) which I don't see when connected through other protocols or directly without any VPN. I suspect the problem is in overly secure ciphers and algorithms which are used by default by the script. Is there any way to improve the speed, even by using less secure ciphers? Both my server and client devices are very budget and CPU-limited so I believe they cannot handle the strong cryptography in place, which decreases the throughput.

letoams commented 1 day ago

On Sat, 30 Nov 2024, rdtmaster wrote:

I set up the VPN on a Ubuntu 22.04 server, everything works fine, except the speeds are really low. I am sure that this is not a server, datacenter or ISP speed issue since I have much higher speeds with this servers using other protocols. Usually the speed tops at ~85 mbps (wherein my ISP gives me around 95 mbps) but with IKEV2 or L2TP IPSec connection it is 10-14 mbps at best. I suspect the problem is in overly secure ciphers and algorithms which are used by default by the script. Is there any way to improve the speed, even by using less secure ciphers?

What is the hardware of the server? Where are the clients? If mobile, what country?

L2TP uses AES-SHA-CBC and is MUCH slower than IKEv2's AES-GCM.

Still, 80mbps should be doable for most devices. Is there a portfoward involved that slows things down?

hwdsl2 commented 1 day ago

@rdtmaster Hello! Please refer to Benchmarking and Performance testing. As @letoams said, IPsec/L2TP mode could be using AES-SHA-CBC ciphers which is much slower than IKEv2 mode's AES-GCM ciphers. To configure your clients to use IKEv2 mode, see Guide: How to Set Up and Use IKEv2 VPN.

You may also customize VPN ciphers by modifying the ike= and phase2alg= lines in /etc/ipsec.conf and restart the IPsec and xl2tpd services to take effect. Refer to this manual page.

If you have additional information feel free to continue to reply here.