OpenVPN服务器PacketLoss

Question

我有一个OpenVPN服务器，它有Debian 8和OpenVPN 2.3.14 x86_64-pc-linux-gnu。今天我意识到丢包了。我的服务器位于TCP端口443上。

Ping statistics for 144.76.41.103:
    Packets: Sent = 1135, Received = 1121, Lost = 14 (1% loss),
Approximate round trip times in milli-seconds:
    Minimum = 29ms, Maximum = 961ms, Average = 51ms

其他统计数据：

Ping statistics for 144.76.41.103:
    Packets: Sent = 1135, Received = 1121, Lost = 70 (5% loss),
Approximate round trip times in milli-seconds:
    Minimum = 29ms, Maximum = 961ms, Average = 51ms

服务器配置：

port 443
float
proto tcp
dev tun2

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/1.crt
key /etc/openvpn/keys/1.key
dh /etc/openvpn/keys/dh2048.pem
tls-auth /etc/openvpn/keys/ta.key 0

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
script-security 3
auth-user-pass-verify "/etc/openvpn/auth.sh" via-env
keepalive 20 100
cipher BF-CBC
max-clients 100
persist-key
persist-tun
username-as-common-name
log logs/443tcp.log
log-append logs/443app.log
status status/443tcp_status.log 60
verb 2
mute 15
inactive 1200
comp-lzo
reneg-sec 86400
up /etc/openvpn/up.sh

正因为如此，我经常在我的应用程序、SSH控制台，当然还有在线游戏中接收滞后(只是冻结了一会儿)。

有什么原因吗？

Answer 1

您需要为您的VPN链接设置正确的MTU。可以使用ping命令确定值。从客户端启动pinging

ping -M do -s 1500 -c 1 10.8.0.1

可能会说是ping: local error: Message too long, mtu=1500

每次降低1500值10，直到ping成功为止。当ping成功后，所使用的值就是您应该使用的MTU。OpenVPN需要设置一个名为MSS的值。MSS是MTU减去40的值。

例如：如果MTU为1460，则MSS为1420。

MSS = MTU  - 40
MSS = 1460 - 40
MSS = 1420

若要为OpenVPN设置MSS，请添加以下服务器配置行(用适当的值替换1420 )。

mssfix 1420

还可以使用以下配置指令打开MSS自动发现：

tun-mtu 1460
mtu-disc yes

更多信息