I’m new at IPFIRE and i have some doubt’s about the OpenVPN limitations running on IPFIRE.
1.- What is the max openvpn users and clients that i can create on the firewall?.
2.- Max OpenVPN Connections in the same time with different userid?.
3.- Max OpenVPN Connections in the same time with the same userid?, for example “ebustos” with 2 ovpn clients in the same time.
My question is regarding to the openVPN configuration in the advance config max-clients parameter. i reviewed the config by CLI and GUI. From the GUI i cannot configure more than 255 max-clients because the GUI cannot permit more than that value. On the other hand, on the /ipfire/ovpn directory the file “settings” there’s a max-clients value when i configured it to reach 400 max-clients then the GUI displays that value.
So, i have some doubts about the max-clients configuration that the GUI can permit to configure or if the software only permit 255 max-clients to OpenVPN can support…
I am running some customers with 50+ connections on an 4 core Intel NUC, 8 GB RAM without any problems. In fact the little box is quite sleeping all the time. The only limit is your network bandwidth and the hardware you’re using.
I certaninly know that you comment, but my question is about the max-clients that IPFIRE can support in the configuration.
When you go to the advance configuration of OPENVPN by GUI you can see that que max-clients is configured to 100. The max configuration permited is 255, but by CLI in the “settings” file on /ipfire/ovpn/ you can modified max-clients value passing the umbral over 255, but i don’t know if the software can support more than 255 concurrent clients working at the same time.
That’s because you bypass the range checks implemented in the GUI. Please note that “unsupported” values may work, but are likely to be overwritten or removed when you save settings from the GUI again or during updates.
To the best of my knowledge, most of the advanced options are only passed on to the OpenVPN server software and are not used internally, e.g. to create firewall rules. Which in your case would mean that you should actually only be limited by the the size of the subnet and OpenVPN’s capabilities. But please wait for this to be confirmed by a developer. I think @ummeegge knows best!
In the meantime, have you considered using static IP address pools? These pools allow you to organize clients into groups, and their size is determined by their subnet mask.
Yes, I would say this was a “sanity check” from older days. I would suggest that someone changes that.
However, for a lot of connections, OpenVPN is not your tool of choice. All connections will be terminated in a single user space process which means that you will sooner or later max out one processor core and that is it. No matter how many you have, that will be your limiting factor - probably after bandwidth.
: Limit server to a maximum of n concurrent clients.
New incoming connections are denied if they would exceed this limit.
I can imagine why you want to configure this. For example, if you have to create a large pool of clients, e.g. one for each employee. But don’t want to risk overloading the connection because it is actually designed for only a few concurrent users.
I agree with you that we should increase the limit to a reasonable number.
by a vast amount of clients, the best practice for OpenVPN might be to use multiple servers via --remote-random and an appropriate value for a --server-poll-timeout. As Michael mentioned it already OpenVPN is single-threaded and with a reneg-sec of 3600 (default) it is not that hard to calculate how many rekeyings needed to be pass with let’s 10000 clients (in that case the topic of an appropriate grid for a failover should be in general self-evident in my opinion) , but since you do not mentioned any numbers nor other calculable values this is only science but fiction .