OpenVPN connection OK with Win client but very slow with Mac client (Tunnelblick)

I have OpenVPN 2.1 installed on a Linux server (CentOS 5.3) and different users connect to it through Windows client GUI. The connection has been working great if the Windows client is used.

However, when the OpenVPN client is Tunnelblick on a Mac (OS X Leopard, the connection is problematic. It establishes just fine but the ping gets very slow once you start transferring more data. In other words, if you run the ping command in terminal, it looks OK but if you then for example open an URL, it becomes extremely slow, the ping can suddenly change from 30ms to 2000ms and then comes back to 30ms once there is no data transfer again.

Any idea why this is happening? There does not seem to be any error recorded in the server logs.

Here is the server configuration:

auth-user-pass-verify "/etc/openvpn/vpnauth.php" via-file
tmp-dir /tmp
port 443
mode server
proto udp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
crl-verify keys/crl.pem
tls-auth /etc/openvpn/keys/ta.key 0
client-config-dir /etc/openvpn/ccd
push "redirect-gateway def1"
push "dhcp-option DNS"
cipher AES-256-CBC
user openvpn
group openvpn
status logs/openvpn-status.log
log-append logs/openvpn.log
verb 4
mute 20
max-clients 500
management 4445
keepalive 10 120
writepid /var/run/

Here is the client configuration:

port 443
proto udp
auth-retry interact
dev tun
ca keys/ca.crt
cert keys/vpnclient.crt
key keys/vpnclient.key
tls-auth keys/ta.key 1
explicit-exit-notify 1
ns-cert-type server
cipher AES-256-CBC
verb 2
mute 20

Again, this server+client configuration is working great as long the client is Windows OpenVPN. I have tried TCP configuration with a few modifications (different port etc.) but the problem persisted.

Any idea where there is the problem on Macs? Tunnelblick is the newest version available and so is the server (2.1.x OpenVPN branch).

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I came across something that may or may not be the issue just yesterday when listening to the latest episode (#210) of the Mac Geek Gab podcast (  They discussed an issue where PCs would work ok on a network but Macs on the same network would slow to a crawl (similar to what you describe.)  They suggested trying to change the MTU value from 1500 to 1400 (directions here:  MTU determines the size of the packets sent from your computer and 1500 is the default, but they even mention that certain types of networks like VPNs may require it to be smaller.
tomfraAuthor Commented:
I tried that but it didn't make any difference. I'll try changing the default mtu in the server config but that would be an imperfect solution as it could create problems for non-Mac clients I suppose.
Sorry I'm not too familiar with this, I just thought it might help since in the podcast they mentioned the problem being with Macs and not PCs.  They also mentioned that firmware updates (if available) are the best solution for this type of thing.  Is the firmwre on the router up to date?
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

tomfraAuthor Commented:
This has nothing to do with a router, the Internet connection works just fine, the problem happens only when I connect through the OpenVPN server (running on Linux). But it seems it may indeed be MTU related, I set the mtu size to 1400 on the OpenVPN server side and so far it seems to be working.

However, I need to test it more and it could also have negative impact on non-Mac clients I suppose so I will need to test that too.
Didn't seem like the router would be the problem, but there are often weird solutions you wouldn't think would work.  When troubleshooting problems with people I often tell them to try something that I don't think will work and a lot of times they even argue with me that it won't work, but I tell them to just try it and occasionally (although not often) it happens to work!

Sound like your at least on the right track with the MTU though.  Good luck!

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tomfraAuthor Commented:
Well, so far I found that using "tun-mtu 1400" instead of the default value 1500 on the server side makes the connection much better, however, it's still not ideal when you transfer a lot of data - for example downloading a file over the internet. But I think I am getting there.

Actually, I thought it could have something to do with the mtu side initially, but did not find any info on the Internet, if it was a common problem I suppose Google would return a lot of results but it did not...

By the way, we are not talking about one server here. I use the same configuration on 10 different servers in several different datacenters. All have the same problem when connecting using Tunnelblick on a Mac.
tomfraAuthor Commented:
OK, accepting the solution because it was apparently indeed MTU related. I got the best results when adding these values to both the server & client configuration files:

tun-mtu 1500
fragment 1450
mssfix 1450

This is for UDP config. It's still not perfect so some more optimization may be necessary but this config seems to work OK for both Windows and Mac clients.
Glad you found something that works (at least better than before)!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Remote Access

From novice to tech pro — start learning today.