2 ms·

I agree that IPSEC should be the fastest & best, because it avoids the tun/tap device and works at the packet level. Anything that uses tun/tap and/or a TCP tr

I agree that IPSEC should be the fastest & best, because it avoids the tun/tap device and works at the packet level. Anything that uses tun/tap and/or a TCP transport is not going to be as good; it needs tricks like sshuttle's very interesting ones. So I would guess that, of OpenVPN, sshuttle and OpenSSH, that OpenSSH/my script would be the worst because it uses tun/tap, TCP and has few if any tricks. But it is also the only one that "works for me", and I am very comfortable running SSH on my machines, and also with SSH security, and I find the key-trust model very simple to work with. As to more demanding uses, I haven't tried e.g. accessing a video site like the BBC iPlayer, though maybe I should do so "in the name of science".

agwa 13y ago
It's not the TUN/TAP device that gets you; it's tunneling TCP over TCP, which wrecks havoc with TCP's retransmission algorithm[1]. I've personally done measurements and the bandwidth of a TCP connection over a UDP OpenVPN tunnel is just as good as the bandwidth without using a tunnel. In contrast, the bandwidth of a TCP connection over a TCP OpenVPN tunnel is significantly worse. You may theoretically have worse performance with a TUN/TAP tunnel compared to an IPSEC tunnel because the packets have to travel into and out of userspace whereas IPSEC stays in the kernel, but I've never noticed this in practice. In contrast, the TCP performance degradation is very noticeable in practice. [1] http://sites.inka.de/sites/bigred/devel/tcp-tcp.html http://sites.inka.de/sites/bigred/devel/tcp-tcp.html