For folks living and travelling in China having a VPN (Virtual Private Network) has become a necessity if you want to leap over the great firewall and access sites like Facebook, Twitter and YouTube to name but a few. While personal VPN providers like Witopia and 12vpn provide easy to set up packages which you can install on your computer many people will still intermittently experience slow or unstable connections (through no fault of the provider) which can dampen the experience.

I recently had a chat with the people from 12vpn about how users can optimize their computers to get the most out of their VPN connection and I’ve compiled together their advice including my own experiences below – some of this is quite technical but should be straightforward for anyone with moderate computer skills. Please feel free to add your own comments if you have any other recommendations.

N.b. in most cases this advice should be unnecessary but may be helpful for those wanting to squeeze a little extra juice out of their connection, or those experiencing abnormal network conditions.

Choosing The Fastest Gateway

VPN providers usually provide a number of gateways in different geographic connections which you can choose from (often in the US and Europe). Look at what you need: low-latency or high-throughput. While they often go hand-in-hand this is not necessarily always the case…

• Interactive applications like web browsing, gaming and voice over IP benefit most from low-latency connections and typically don’t need a lot of bandwidth.
  • Latency can be easily measured using the “ping” command, which is available in the Command Prompt in Windows or the Terminal on Mac OS X. Lower numbers are better (see screenshot below). Note that the latency increases along with the physical distance between you and the website. It’s normal for far away websites to have a higher latency that those close by.
• Applications with no or little interaction like watching videos, large downloads, etc. benefit more from high-throughput.
  • Throughput is more difficult to measure. Really the only way is to simply try the website and see if the video streams smoothly.

Common Mistakes

• Measuring the “ping” to the VPN server itself: A VPN server which is closer by will have a lower ping-time, but may not necessarily bring you “closer” to the website your trying to use. E.g. if you’re in Beijing a Hong Kong VPN server may ping at: 80 ms, while the US VPN server may ping at 200 ms. You may conclude the Hong Kong server will be faster for you. However, from the VPN server to the final website in the US Hong Kong may need 180ms, while the US server may only need 10 ms. The total ping time through Hong Kong would be 260 ms, through US only 210 ms. It’s important you measure the actual websites you’re trying to use, not the VPN server itself (or a speed test website for that matter).
• When considering throughput this become even more interesting. Throughput is influenced a lot by the load on specific internet connections, contracts between providers and other factors that aren’t always obvious. Sometimes (though not often) the further-away server can give you a higher throughput because it uses under-used or ‘cheaper’ routes to get from A to B.
• Speed tests: They really tell you very little about the performance of websites. For illustration purposes you could try the iPlayer performance test on the BBC website. This test tests the through-put for 3 different transmission methods and the difference can sometimes be amazing. A high or low through-put on a speed test does not necessarily mean similar results when streaming video. Keep in mind that the purpose of many speed test websites is to promote their sponsors.

Last but not least: the internet is amazingly dynamic. Internet routes change daily to adapt to the increasing number of users, accommodate new websites, etc. What’s fast today, maybe be slow tomorrow. Fortunately this also means that what was slow today maybe be faster tomorrow. Don’t hesitate to experiment or contact your VPN’s support dept.

Reducing Connection Time

When it comes to OpenVPN/Viscosity/Tunnelblick software clients, selecting a smaller authentication key size will help in establishing up your connection faster. Not all VPN’s may allow you to select the authentication key size though. (12VPN will be transitioning from 4096-bit keys to 1024-bit keys to speed up the login process). Note that the key size is different from the encryption key size which is commonly 128 or 256-bit).

• By default, OpenVPN will create a 128-bit encrypted data tunnel and a 256-bit encrypted control channel. On smaller devices (phones) this can slow things down significantly. Fortunately, most VPN providers allow you to override the encryption setting and lower the control channel to 128-bit, though that does require some OpenVPN knowledge (12VPN’s Android servers already do this automatically).
• The config files of your VPN are likely to connect to a host name, e.g. server.vpn.com. You could speed things up a little by replacing this with the IP address of the server (which you can find by pinging the host name). A significant draw back however is that your connection will fail if the VPN provider changes the IP address.
• Perhaps too obvious to mention, but faster Internet and a faster CPU will lower your connection time. It’s typically a bad idea to run the VPN on your  router as it’s CPU will have trouble encrypting at high through-puts, lowering your VPN speeds. Running it on your computer directly is the fastest option.

Maintaining a Stable Connection

• Pick the VPN server with the least amount of packet loss. Preferably 0%. This can be done using the MTR tool which combines the functionality of the “traceroute” and “ping” programs in a single network diagnostic tool (available for Windows and Mac OS X).
• Remove obstacles: software firewalls or cheap WiFi routers may prevent the VPN from going full-speed.
  • Even if your firewall is not blocking the VPN, it may still be spending CPU power on inspecting every single network packet. This does not necessarily increase the CPU load a lot, but will slow down the network flow. Make sure your firewall is properly configured to allow the VPN to flow unhindered.
  • A similar situation can occur on WiFi routers. Many WiFi routers will allow you to turn on/off stateful packet inspection (SPI). Unfortunately this function goes by many different names, sometimes “open” vs “secure”, or simply “firewall on” vs “firewall off”, etc. Some WiFi routers will grind the VPN to a halt after a few minutes of use, simply because they can’t keep up with SPI turned on. When in doubt, use a network cable to connect directly to the ADSL modem and see if that makes a difference.
• Pick a good Internet provider:
  • In China it’s important to get yourself on China Telecom, China Unicom or China Mobile. Pretty much all other Chinese ISP’s don’t have their own International gateways and cheap out on buying International bandwidth from China Telecom or Unicom.
  • Also some ISP’s (e.g. Shekou Cable) are known to intercept traffic and filter them through their own caching proxies which causes all sorts of problems.
• Sit in the right spot: WiFi connections may not be as stable as you perceive them to be. Unfortunately (or fortunately) WiFi instabilities are rarely noticed because they may only occur for 1 or 2 seconds. It becomes problematic when these interruptions occur exactly when the VPN performs its connection test and fails. This will cause the VPN to reset its connection which takes much more than 2 seconds and could even fail if another interruption occurs when it’s trying to re-connect. Again, try changing your position or using a cable temporarily to see if that improves things.

Tweaking Your Settings

• With regards to DNS, don’t touch or change it: Things like OpenDNS or Google Public DNS break more than they fix. (This is why Google is proposing changes to the DNS system – so they can compensate for the things they’re breaking while continuing to use their service from which they gather data).
  • Content Distribution Networks like Akamai (which powers CNN, Hulu and tons of huge websites) as well as some of Google’s own services depend on the DNS system to determine your location and use it to connect you to the nearest/fastest servers. Using a 3rd-party DNS breaks this functionality.
  • For privacy reasons you may not want to send all your DNS requests to a 3rd party. Not only because you don’t want Google or OpenDNS to know what you’re up to, but also because DNS requests are sent unencrypted (at least as long as the VPN is turned off). Between your location in China and the OpenDNS server in US or elsewhere there will be a number of parties snooping on your DNS traffic. Using your local ISP’s DNS will limit exposure.
• People in China sometimes suffer from DNS cache poisoning which causes traffic to be misdirected (i.e. blocked). Some important things to realize:
  • Using OpenDNS or Google Public DNS is no guarantee for avoiding DNS poisoning. It’s trivial to intercept and forge DNS packets.
  • If you start the VPN before you open your browser or IM programs, poisoning is unlikely to occur and easy to prevent.
  • Should it occur, then it’s not that hard to resolve – most VPN providers will have ready instructions.
  • Your VPN provider may have things in place to minimize DNS poisoning. Follow their instructions – not all VPN providers implement things in the same way.
• Aside from changing the OpenVPN encryption as mentioned above there is not a lot you can tweak yourself. Most settings need to match the ones on the server to avoid problems. There are some memory buffers you can increase, but more is not always better.

One tweak that 12vpn offer is to split VPN traffic and other traffic, reducing the use of your VPN connection. This means you can get away with using a cheaper (Lite) account as well as have local Chinese sites at their original speeds without going through US.

If you’d like to try 12vpn they have kindly offered to give Randomwire readers a 10% discount – enter the promotional code RANDOMWIRE when you sign-up to qualify.

Related posts you might like:

1. Disk Failure
2. Future Outlook
3. Tunnel Through the GFW with 12vpn