2d2e4a27   
   From: simon.leinen@switch.ch   
      
   Yu Hong writes:   
   > The school network administrater has set up the gateway so every IP on   
   > the network can only get 20 tcp connections at maximum. It is due to   
   > the massive usage of p2p software on the network.   
      
   > I have a vpn account and the vpn server is located out of my country.   
   > When I connected to the vpn, the speed goes very fast.   
   > When I am off the vpn connection, the speed is slow due to the tcp   
   > connection restriction.   
      
   You are talking about the speed of your P2P software, I assume - other   
   applications such as Web surfing, mail reading etc. probably wouldn't be   
   hampered by a limit of 20 TCP connections.   
      
   I'm a bit worried that by circumventing this limitation, you will   
   provoke further countermeasures on behalf of your network administrator.   
      
   > So it seems, the vpn connection can bypass the gateway's tcp   
   > connection restriction.   
      
   > Am I right? And can anyone explain the reason?   
      
   Yes.  When you are connected to your VPN server, the local gateway at   
   your school only sees a single connection, probably a UDP connection or   
   IPsec "connection" (association).  So you can indeed have many TCP   
   connections inside the "tunnel" between your computer and the VPN   
   server.   
      
   The next step of escalation could be for the network administrator to   
   configure a rate limit per connection.  That could have a dramatic   
   effect on the throughput of your (single) VPN connection.   
      
   > Which document should i read to understand the relationship of tcp   
   > connection restriction and vpn connection?   
      
   It may be hard to find good documentation on these kinds of middleboxes   
   and how they interact with different types of applications.  Check the   
   manuals of the gateway - maybe they describe some of these effects as   
   caveats or limitations.   
   --   
   Simon.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)