Slow openvpn 25.12.4

Installing and Using OpenWrt
1

I run openwrt 24.10.6 on a Proxmox vm. x86/64 with no wireles. I am using expressvpn. Works fairly well.
https://www.waveform.com/tools/bufferbloat?test-id=43f9347d-4fcd-4379-b4d7-c0c35ba08742

I cloned it and upgraded to 25.12.4 via attended sysupgrade. The speed is sad.
https://www.waveform.com/tools/bufferbloat?test-id=b55f25b7-8821-4bd7-9180-124865bf621a

Here is the speed without openvpn.
https://www.waveform.com/tools/bufferbloat?test-id=bcf622a2-f963-40d6-82e9-49cb12336cd1

Here are the openvpn packages installed.

Package name	            Version		    Description	 
openvpn-openssl	            2.7.4-r1		Open source VPN solution using OpenSSL	

collectd-mod-openvpn	    5.12.0-r54  	OpenVPN traffic/compression input plugin	

kmod-ovpn-backports	        6.12.87.7.0.0.2026032400-r1	This module enhances the performance of the OpenVPN userspace software by offloading the data channel processing to kernelspace.	

luci-app-openvpn	        26.138.77074~f17251c

The vm has 8 cpu's. irqbalance is installed.

irqbalance	1.9.5-r1

collectd-mod-irq	5.12.0-r54

kmod-irqbypass	    6.12.87-r1

luci-app-irqbalance	26.138.77074~f17251c

I am not sure what logs or configs would be helpful.

Thanks

PS: I install the snapshot in another vm. I can not see the openvpn tab and get a message when installing it. May be normal who knows.
Where should I post about that?

2

See: OpenVPN setup guide Master branch

Consider using WireGuard much easier to setup and much more performant

3

Thanks for the reply. I would use wireguard if expressvpn supported it. might have to change at some point.

Thanks

4

My 10 year old Core2Duo running proxmox and some VM's does even better (60 Mb/s)
Check if DCO is enabled:

Fri May 22 18:50:50 2026 daemon.notice openvpn_ovp_to_6[2896]: OpenVPN 2.7.4 x86_64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO]
Fri May 22 18:50:50 2026 daemon.notice openvpn_ovp_to_6[2896]: library versions: OpenSSL 3.5.6 7 Apr 2026, LZO 2.10
Fri May 22 18:50:50 2026 daemon.notice openvpn_ovp_to_6[2896]: DCO version: 6.18.31 #0 SMP Fri May 22 00:47:47 2026

Note some settings are not compatible with DCO:
Encryption is limited to AES-256-GCM, AES-128-GCM, and ChaCha20-Poly1305.

DCO requires a TLS-based tunnel, such as SSL/TLS, SSL/TLS+User Auth, or User Auth.

DCO is only present in OpenVPN 2.6.0 and later.

DCO is only compatible with UDP, it cannot be used with TCP.

DCO is not yet able to utilize internal routing in OpenVPN (iroute). This means that although remote access use cases work, and site-to-site setups with one client per server work, it does not yet function with multiple site-to-site clients on a single server which require LAN-to-LAN routing.

Using a /30 or smaller tunnel network for peer-to-peer tunnels (one server with one client) is not compatible with DCO. There are problems with the code for this mode in OpenVPN which can lead to failed connections and instability.

Compression is not compatible with DCO. The GUI disables compression options when DCO is enabled for an instance, but for a client instance the server could still push a compression option which would make the client fail to pass traffic.

Some features are not compatible with DCO or are not relevant with DCO. These options include:

Explicit exit notify

Inactivity timeouts

UDP fast I/O

Send/receive buffer sizes

Per-peer data usage is not tracked properly.

Until this is resolved peer data usage on the OpenVPN status page will not reflect the actual amount of data transferred between peers.

Check if you have an MTU problems slow or hanging connections are often due to MTU problems, as default I use MTU of 1400

It could of course also be a server side problem maybe the sever is overcrowded while you were testing?

5

Thanks for the reply. The settings were al brought over in the clone I assume. TCO seems to be available but I don't know how to tell if it is used.

root@OpenWrt:~# logread |grep -i dco
Fri May 22 07:49:22 2026 kern.info kernel: [    0.520681] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3]
Fri May 22 07:49:31 2026 daemon.notice openvpn(Albq)[3264]: OpenVPN 2.7.4 x86_64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO]
Fri May 22 07:49:31 2026 daemon.notice openvpn(Albq)[3264]: DCO version: 6.12.87 #0 SMP Wed May 13 22:42:09 2026
Fri May 22 09:35:36 2026 daemon.notice openvpn(Albq)[1903]: OpenVPN 2.7.4 x86_64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO]
Fri May 22 09:35:36 2026 daemon.notice openvpn(Albq)[1903]: DCO version: 6.12.87 #0 SMP Wed May 13 22:42:09 2026
root@OpenWrt:~#

As for server problems, this has been going on since I started testing 25.12.0. Just figured it would get fixed. I guess I will try a clean install when I have some more time.

Thanks

6

OK so I did a clean install of 25.12.4 x86-64. Same results as above.

Thanks

7

I need some help figuring this out please. What logs etc can I supply?

Thanks