Ping inside my vpn route are getting more than 50% packet loss

nexius1981 · December 2024

Hi!

I have a opnevpn server up and runing on a ubuntu 22.04
However, when I ping my clients, I'm getting a high percenteage of packets losses...

root@localhost:~# ping 10.95.0.10
PING 10.95.0.10 (10.95.0.10) 56(84) bytes of data.
64 bytes from 10.95.0.10: icmp_seq=1 ttl=64 time=61.3 ms
64 bytes from 10.95.0.10: icmp_seq=2 ttl=64 time=57.4 ms
64 bytes from 10.95.0.10: icmp_seq=3 ttl=64 time=38.1 ms
64 bytes from 10.95.0.10: icmp_seq=6 ttl=64 time=41.3 ms
64 bytes from 10.95.0.10: icmp_seq=8 ttl=64 time=61.1 ms
64 bytes from 10.95.0.10: icmp_seq=9 ttl=64 time=58.5 ms
64 bytes from 10.95.0.10: icmp_seq=18 ttl=64 time=30.6 ms
64 bytes from 10.95.0.10: icmp_seq=20 ttl=64 time=10.7 ms
64 bytes from 10.95.0.10: icmp_seq=21 ttl=64 time=52.9 ms
64 bytes from 10.95.0.10: icmp_seq=25 ttl=64 time=37.6 ms
^C
--- 10.95.0.10 ping statistics ---
25 packets transmitted, 10 received, 60% packet loss, time 24305ms
rtt min/avg/max/mdev = 10.744/44.956/61.296/15.555 ms
root@localhost:~# #

What I'm not getting

Can you help me?

yoursunny · December 2024

If you ping the client outside VPN, do you see same loss?

Capture traffic on both VPN and underlying network interface, on both client and server.
Analyze the packets with Wireshark.
Although the packets are encrypted, you can roughly identify them by timing and packet lengths.

nexius1981 · December 2024

@yoursunny said:
If you ping the client outside VPN, do you see same loss?

Capture traffic on both VPN and underlying network interface, on both client and server.
Analyze the packets with Wireshark.
Although the packets are encrypted, you can roughly identify them by timing and packet lengths.

Many thanks @yoursunny I didn't remeber to do that test before...

Yes, indeed, outside vpn keep roughly the same packet loss percenteage, around ~50%

This is between 2 vps...

Now, I don't know wich provider to claim... any other configs or test that I can make to troubleshoot wich one?

cochon · December 2024

@nexius1981 said:

@yoursunny said:
If you ping the client outside VPN, do you see same loss?

Capture traffic on both VPN and underlying network interface, on both client and server.
Analyze the packets with Wireshark.
Although the packets are encrypted, you can roughly identify them by timing and packet lengths.

Many thanks @yoursunny I didn't remeber to do that test before...

Yes, indeed, outside vpn keep roughly the same packet loss percenteage, around ~50%

This is between 2 vps...

Now, I don't know wich provider to claim... any other configs or test that I can make to troubleshoot wich one?

traceroute, or better mtr, might give a better hint, try from both ends.

zed · December 2024

@nexius1981 said: Now, I don't know wich provider to claim... any other configs or test that I can make to troubleshoot wich one?

what happened when you pinged some 3rd party site (google.com?) from each vps? come on man.

yoursunny · December 2024

@cochon said:
traceroute, or better mtr, might give a better hint, try from both ends.

mtr both ways, with this flag:
mtr -bwzc50 followed by remote IP.

nexius1981 · January 1

@yoursunny said:

@cochon said:
traceroute, or better mtr, might give a better hint, try from both ends.

mtr both ways, with this flag:
mtr -bwzc50 followed by remote IP.

root@NL:~# mtr -bwzc50 XXX.duckdns.org

Start: 2025-01-01T17:10:26+0000
HOST: NL Loss% Snt Last Avg Best Wrst StDev
1. AS36352 23-94-101-1-host.colocrossing.com (23.XXX.121.1) 0.0% 50 1.1 1.4 0.8 5.0 0.7
2. AS??? 10.10.0.1 0.0% 50 0.7 1.1 0.6 5.3 0.9
3. AS1299 adm-b10-link.ip.twelve99.net (62.XXXX.XXX.30) 0.0% 50 0.8 0.8 0.6 1.9 0.3
4. AS1299 adm-bb2-link.ip.twelve99.net (62.115.120.228) 64.0% 50 0.8 1.0 0.7 2.0 0.3
5. AS1299 ldn-bb2-link.ip.twelve99.net (62.115.137.234) 72.0% 50 5.7 5.9 5.6 6.9 0.3
6. AS1299 slou-b2-link.ip.twelve99.net (62.115.112.63) 0.0% 50 7.0 6.7 6.3 8.1 0.4
7. AS1299 pulsant-ic-321418.ip.twelve99-cust.net (213.248.95.63) 0.0% 50 6.1 6.7 6.0 21.7 2.2
8. AS60610 185-28-167-90.as60610.net (185.28.167.90) 0.0% 50 6.7 7.7 6.7 43.1 5.1
9. AS60610 5-10-31-62.as60610.net (5.10.31.62) 0.0% 50 8.1 8.8 7.9 36.8 4.1
10. AS49683 XXX.122.XXX.135 24.0% 50 34.0 33.9 8.1 55.8 12.1

root@localhost:~# mtr -bwzc50 2vps.duckdns.org
Start: 2025-01-01T17:15:38+0000
HOST: localhost.localdomain Loss% S nt Last Avg Best Wrst StDev
1. AS49683 175.xxx.157.254 0.0% 50 3.6 1.7 0.3 46.1 6.5
2. AS60610 5-10-31-61.as60610.net (5.10.31.61) 0.0% 50 1.0 0.9 0.4 4.9 0.8
3. AS60610 185-28-167-91.as60610.net (185.28.167.91) 0.0% 50 1.2 2.3 1.1 19.2 3.1
4. AS1299 slou-b2-link.ip.twelve99.net (213.248.95.62) 0.0% 50 2.1 2.0 1.4 8.1 1.0
5. AS1299 ldn-bb1-link.ip.twelve99.net (62.115.127.6) 0.0% 50 2.3 3.4 2.2 25.3 3.4
6. AS1299 adm-bb1-link.ip.twelve99.net (62.115.139.144) 28.0% 50 9.9 10.3 9.7 13.4 0.9
7. AS1299 adm-b10-link.ip.twelve99.net (62.115.120.227) 0.0% 50 8.5 8.7 8.2 10.7 0.5
8. AS1299 hostpapa-ic-354460.ip.twelve99-cust.net (62.115.189.31) 22.0% 50 39.0 34.0 10.3 67.1 13.3
9. AS??? ??? 100.0 50 0.0 0.0 0.0 0.0 0.0
10. AS36352 23-94-101-6-host.colocrossing.com (23.XXX.XXX.6) 12.0%

yoursunny · January 1

Two of the worst hosting providers, connected via the worst T1 ISP, what are you expecting?

They look OK from our house though:

debian@bbb:~$ mtr -bwzc50 185.122.167.135
Start: 2025-01-01T17:44:20+0000
HOST: bbb                                                                      Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. AS???    AR750.lan (192.168.5.1)                                           4.0%    50    1.2   1.0   0.7   1.3   0.2
  2. AS701    lo0-100.WASHDC-VFTTP-325.verizon-gni.net (108.31.110.1)           0.0%    50    9.1  10.5   1.8  86.8  14.6
  3. AS701    ae1325-21.ARTNVAFC-MSE01-AA-IE1.verizon-gni.net (100.41.22.170)   0.0%    50   11.5  17.7   2.5  60.9  16.5
  4. AS???    ???                                                              100.0    50    0.0   0.0   0.0   0.0   0.0
  5. AS1299   ash-b2-link.ip.twelve99.net (80.239.135.178)                     30.0%    50    6.3   8.8   4.1  14.0   3.0
  6. AS1299   rest-bb1-link.ip.twelve99.net (62.115.138.191)                    0.0%    50    8.4   9.1   4.6  14.2   2.8
  7. AS1299   nyk-bb5-link.ip.twelve99.net (62.115.139.34)                     70.0%    50   11.7  13.8   9.9  19.1   2.7
  8. AS1299   ldn-bb1-link.ip.twelve99.net (62.115.139.245)                     2.0%    50   84.9  83.3  78.5  88.0   2.9
  9. AS1299   slou-b2-link.ip.twelve99.net (62.115.127.7)                       0.0%    50   86.0  83.2  78.4  88.2   2.9
 10. AS1299   pulsant-ic-321418.ip.twelve99-cust.net (213.248.95.63)            0.0%    50   87.1  83.2  78.0  87.6   2.9
 11. AS60610  185-28-167-90.as60610.net (185.28.167.90)                         0.0%    50   79.2  83.7  78.8  90.7   3.1
 12. AS60610  5-10-31-62.as60610.net (5.10.31.62)                               0.0%    50   80.9  84.1  78.8 102.2   4.0
 13. AS49683  185.122.167.135                                                   0.0%    50   83.8  86.3  80.3 104.9   4.2
debian@bbb:~$ mtr -bwzc50 23.94.101.6
Start: 2025-01-01T17:45:18+0000
HOST: bbb                                                                      Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. AS???    AR750.lan (192.168.5.1)                                           0.0%    50    0.7   0.9   0.6   1.2   0.2
  2. AS701    lo0-100.WASHDC-VFTTP-325.verizon-gni.net (108.31.110.1)           0.0%    50   14.1   7.1   1.8  14.8   3.4
  3. AS701    ae1325-21.ARTNVAFC-MSE01-AA-IE1.verizon-gni.net (100.41.22.170)   0.0%    50   18.9   8.9   2.2  24.1   4.1
  4. AS???    ???                                                              100.0    50    0.0   0.0   0.0   0.0   0.0
  5. AS1299   ash-b2-link.ip.twelve99.net (80.239.135.178)                     12.0%    50    8.6  10.2   3.9  13.8   2.7
  6. AS1299   rest-bb1-link.ip.twelve99.net (62.115.138.191)                    0.0%    50   13.8   8.4   4.7  14.2   2.7
  7. AS1299   prs-bb1-link.ip.twelve99.net (62.115.140.104)                     0.0%    50   88.7  91.0  84.5 108.4   3.5
  8. AS1299   adm-bb1-link.ip.twelve99.net (62.115.134.96)                      0.0%    50   95.2  90.3  86.2  96.1   2.9
  9. AS1299   adm-b10-link.ip.twelve99.net (62.115.138.37)                      0.0%    50   96.6  98.6  92.8 102.1   2.4
 10. AS1299   hostpapa-ic-354460.ip.twelve99-cust.net (62.115.189.31)           0.0%    50  101.7  96.8  93.1 102.5   2.9
 11. AS???    ???                                                              100.0    50    0.0   0.0   0.0   0.0   0.0
 12. AS36352  23-94-101-6-host.colocrossing.com (23.94.101.6)                   0.0%    50  102.2  97.3  93.2 102.8   2.8

Notably, this MTR doesn't pass through LDN-ADM link in AS1299, which seems to be where the problem is.

You can't blame either hosting provider as it's out of their network.
You should blame AS1299 for their congestion.

nexius1981 · January 1

@yoursunny

so, what I can do?

nothing?

yoursunny · January 1

@nexius1981 said:
so, what I can do?

Cancel both servers and buy from premium providers:

United Kingdom: @kuroit https://uk.lg.kuroit.com/
Netherlands: @heartbeat_IT https://lg.nl.heartbeat-it.com/

Run MTR in the looking glass to confirm connectivity.

Check the IP on https://bgp.tools , open Connectivity tab.
If you see AS1299 or AS174 being the only upstream, run away.

gsea4 · January 1

Switch provider I guess that's an obvious one ...

concept · January 1

Yeah.. colocrossing network is not good.
I would use something like this to see which provider would work best for you.
https://mtr.tools/

mrsky · January 1

@nexius1981 I had similar issue with a provider, and I couldn’t cancel, cause the faulty it’s this shitty as1299… not provider fault, but the provider needs to open a claim to this TIER1

e2bs2k1 · January 2

if your opevpn uses tcp(rare),try bbr on both end.
if your opevpn uses udp(likely),try use udpspeeder as mid tunnel.

nexius1981 · January 2

I have contact my 2 providers, and they told me that they are aware of this node AS1299, and both told me that many providers have allready claimed about this situation...
Despite they can't do nothing, they will keep speacking with this infrastucture.

Can't refund me, due to the reasons offside their "hands"

glitch · January 3

@yoursunny said:

@nexius1981 said:
so, what I can do?

Cancel both servers and buy from premium providers:

United Kingdom: @kuroit https://uk.lg.kuroit.com/

Netherlands: @heartbeat_IT https://lg.nl.heartbeat-it.com/

Run MTR in the looking glass to confirm connectivity.

Check the IP on https://bgp.tools , open Connectivity tab.
If you see AS1299 or AS174 being the only upstream, run away.

This is crap i guess?

yoursunny · January 3

@glitch said:

@yoursunny said:
Check the IP on https://bgp.tools , open Connectivity tab.
If you see AS1299 or AS174 being the only upstream, run away.

This is crap i guess?

There are three upstreams so it's not too bad.

Howdy, Stranger!

Categories

In this Discussion

Ping inside my vpn route are getting more than 50% packet loss

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Ping inside my vpn route are getting more than 50% packet loss

Comments