VPN - any success stories to share?

Questions
21

Re-reading this, I think you've given enough data. AWS has high super high bandwidth and low latency connections, but they are never as good as on-premises. So if you can get 5 seconds running locally, and 11 seconds running on AWS, I would expect 11 seconds is about as good as you could do running over the internet.

However, you are seeing 250 seconds (a 20x slowdown) when running over your own internet connection through a VPN: This suggests 3 possibilities:

  • poor bandwidth
  • poor latency
  • poor VPN

It's possible all 3 are contributing, of course. But it should be pretty easy to isolate and test each one and figure it out.

1 Like
22

Their IT people won't let me run most of these tests. I've tried. Their network is very fast. I haven't speed tested it, but I'm sure it's' faster than 1000MBit/s. They outsource IT, so we did have a meting with them and their answer was "VPNs are fast almost all the time... but we just had another client who was running an inhouse Quickbooks server and it's "jus slow on VPN", there's nothing you can do other than a remote desktop, and the client is like "that won't work" but based on the feedback here it seems like VPNs don't play nice with Filemaker and remote desktop through a VPN is the way most people tackle this.

23

However, you are seeing 250 seconds (a 20x slowdown) when running over your own internet connection through a VPN: This suggests 3 possibilities:

  • poor bandwidth
  • poor latency
  • poor VPN

Yeah my thoughts exactly. My bandwidth is exactly the same. The bandwidth at the school is super fast. That sort of leaves the VPN. We are updating (probably over Thanksgiving), so maybe it's just an old SonicWall Firewall. It's a 5-6 year old model.

24

sorry for my inappropriate wording but hosting sometimes is the only valid solution. I only wanted to say that the local/interal network has to be secured by all means.

that is what I wanted to express. Here in Germany remote work without VPN isn't considered safe and the national authorities (BSI - Bundesamt fĆ¼r Sicherheit in der Informationstechnik) try to establish and enforce VPN and other standards.

But the discussion does not help you with your problem. What VPN Clients do you use? I've seen great differences between Sophos, Zyxel, VPN-Tracker and Tunnelblick sometimes on the very same connection. My preference at the moment is 1. Tunnelblick, 2. VPN-Tracker (not free), Sophos seems to be OK but the branded clients are - at least from my experience - not as fast as they could be meaning 4x times longer loading etc.
So there is something that could be evaluated in your setup.

Since FM is not too fast via VPN I use the upper solutions with the computing being done in the company network and only the screen being transferred via VPN. Apple Remote Desktop and/or Microsoft Remote Desktop Client work fine for this purpose. What I would try is the No.4 variant to see if there is a chance for usable VPN connection and of course also test different VPN client software in the scenario.

1 Like
25

Thank you, this is super helpful.

The VPN is built into the 4-year old $8,500USD SonicWall Firewall (IDK the model number, I'm not on site so can't easily just look at it).

We're expecting a quote this week for a replacement, but because it's built into the hardware Firewall I'm not sure there's an option to "try different VPNs", unless it's the clients that cause the problem?

I think I just have to wait and see what comes of it.

26

Connecting VPN against a large Watchguard VPN at client site.

Note: VPNs are devices that encrypt traffic on one end and decrypt it on the other. The client side (your desktop) performance, assuming the server side VPN box has enough bandwidth (not the same as connect speed but reflects how much data can be processed per unit time), is the typical bottleneck.

The client side VPN is typically a software application running on your desktop.

Moved from a fast quad core i5 to an Apple M1 Mini and benchmarked performance before / after. The M1 was a tad over 7 times faster VPN performance over the quad i5, all other factors being identical.

The difference was going from a nearly unusable remote FileMaker instance to one that was nearly as good as a non-VPN connection.

1 Like
27

Thank you, this is very helpful! My client is an M1 MacBook Pro. Does the software client I use matter? I'm using SonicWall, but it looks (and acts from a UI point of view) like something that's been ported from a non-Mac environment.

28

Was the M1 upgrade done on the Client or Server side?

29

The server side is a dedicated WatchGuard VPN appliance - a $7,000 box expressly for VPN connections (In this case, 5 of them - one in each of 5 business units, but between business units, the desktop VPN is not in play, as the appliances handle the VPN security process).

The client side is desktop software, which is where the M1 made all the difference in encrypt/decrypt compute efforts and the resultant increase in connect performance.

We had to move all the remote Windows users to inside-the-firewall remote desktops/terminal server sessions, as the performance was so abysmal, but the Mac M-series users are just fine performance wise, connecting from outside. When (if?) the Watchguard client goes Apple-silicon native, it will likely be ever better.

1 Like
30

FWIIW: Microsoft Terminal Server can get really expensive, really quickly, and M$ license management is a morass of confusing and conflicting licenses designed to garner more revenue. Citrix - the original authors of Terminal Server - licensed this to Microsoft, while retaining rights to the more secure and faster ICA protocol.

Both are pricey.

I've implemented an alternative - TSPlus - numerous times - a Citrix equivalent product that costs a tiny fraction of Citrix or Terminal Server - in a number of smaller clients.... not that it would not scale to big companies, but the big boys are "safety in known large vendors" mindsets, damn the cost. It works great, is inexpensive, and even includes an HTML5 client option.

2 Likes
31

It has been interesting reading this thread and some good advice offered. We crossed this problem over 10-years ago for a client when Internet speeds were a fraction of what they are now.

This led us to offering our solution as a commercial service, which is now our main delivery platform for our own FileMaker solutions, which are specifically designed to operate this way

We initially built our Windows servers on Rackspaceā€™s infrastructure, but as they grew their service became less personal. We moved everything to the UK based Hyve infrastructure a few years ago and have also used AWS EC2 for testing and other purposes.

Originally we used Citrix XenApp Fundamentals (for small businesses) until Citrix took Ā£10k for maintenance and phased the product out - you can still purchase maintenance from Citrix for this non-existent product. We will never go near Citrix again.

We investigated Parallels RAS, which on the surface looks really good, but their prices do not include the Microsoft Remote Access licenses (CALs), which means youā€™re simply paying on top of what Microsoft Remote Desktop Service (RDS) does as standard. Previously RDS was called Terminal Services, hence the confusion between Remote Desktop servers and Terminal servers.

Our FileMaker Server and Remote Desktop servers are all hosted on the same Hyve Internet infrastructure (similar to @bowdendata above) and FileMaker Pro is streamed to our Windows (RemoteApp client is built in and looks like any local app when running) and Mac clients (mainly using the free Microsoft Remote Desktop for Mac, which weā€™ve been beta testers for years - when Microsoft were using HockeyApp for their feedback, we had excellent 2-way communication with the development team, now sadly lost with their current system - and occasionally Jump Desktop). We have clients who also run the full FileMaker Pro client on ChromeBooks (weak MS client, no 2 display support), iPads, Android tablets and it can even run on Linux, for which we have no experience.

It is expensive, the cost for a 5-client license is about Ā£700. In our case everything is included within a monthly fee per user, hence clients have no FileMaker related IT costs as everything is managed and maintained by us.

Technically, the negative side of this includes lack of drag and drop into container fields, a Windows look and feel for Mac users (although some Command key shortcuts can be used), longer initial app launch (but quicker hosted file opening), navigating through the serverā€™s folder structure to find the userā€™s own computer for exporting, saving and importing, and probably some others that Iā€™ve forgotten about as weā€™ve been working this way for so long.

The positives are speed at least matching those of in house hosted system, (rare)connection breaks (say partway through a script with unsaved changes, or an uncommitted edited record) allows reconnection without loss of data, and centralised management.

We honestly expected our system to become redundant by now. However, the industry appears to be moving in our direction with virtual desktop services offered by AWS and Azure.

With Clarisā€™s move to agile development and 3 recent FileMaker updates in quick succession, we are able to upgrade a few hundred users in minutes rather than days. We use plugins from Dacons and 360Works that again can be updated centrally (very important if an update breaks compatibility). All of this without any additional cost to our clients.

The VPN question is understandable and the only test that is relevant is to test access to the server via the VPN server and directly without it.

One thing I donā€™t believe has been mentioned so far is (normally) the slowest part of remote access - the usersā€™ Internet connection. In 3rd world countries like the UK(sort of a joke), the contention ratios of users to bandwidth provides a pretty poor service. Business broadband has a much lower contention ratio and provides faster speeds.

Again as mentioned previously, the major factors are available bandwidth and database structural design, not necessarily the amount of data stored. Claris have made, and continue to make, good progress with remote connections using lower bandwidth. However, anyone wanting remote access must take onboard the need to design for remote access or make design changes as part of the process. You cannot currently overcome the problems of summary fields, unstored calculations, lengthy table occurrence chains, cross table reports, etc. Connection methods will not resolve these.

We still have some elements of these in our SaleFaith CRM due to its lengthy history. However, over the years we have evolved and now hardly use calculation fields,, the team almost have to beg to add another table occurrence, weā€™ve even written a scripted alternative to using summary fields in subsummary parts. Removing the structural overhead with scripted processes to deliver the functionality when needed is our goal (hence me frequently going on about the missing OnRecordExit or OnRecordUnload script trigger).

We also design for Remote Desktop. For example: default locations to download to and upload from for each userā€™s account and the devices they use, often automatically saving, naming and timestamping saved files to prevent users having to go through the path to their desired file destination.

Iā€™m afraid there are no shortcuts if using FileMaker Pro remotely. It is a bit like a sports team - having one or two stars will be less successful than getting all players operating efficiently together.

By the sounds of it, your client can find budget for expensive hardware, but they may be throwing good money after bad.

3 Likes
32

I am running my multi-tenanted depot management solution entirely on WebDirect and I have to say, I am incredibly impressed with it. The speed of access is many magnitudes faster than when I access my hosted files using FileMaker WAN.
If it is just for client access, with no development involved remotely, then this might be a good option for you.
There are a few gotcha's, mainly to do with click-throughs and exporting Excel files, but now that card windows are supported, there is good parity between running FileMaker WAN and WebDirect.

6 Likes
33

@JasonMark - with data, there are two measures of speed. Bandwidth (how much data transferrs per second) and Latency (how long you have to wait for the data to arrive). These are not the same and your IT people should know this, and it's important to clarify with actual numbers for both.

My hunch is that your VPN may be "fast" (= has good bandwidth) but is also "slow" (has poor latency).

A good IT person could answer this question in about 1 minute if they are competent.

2 Likes
34

Just commenting to say +1 to trying to nail down if it's a slow ping/latency time or bad bandwidth. Bad latency can make FM solutions suuuuper slow because of how much they like to chat back and forth with the server.

As for eyeballing how much data transfer occurs in general, I like using Little Snitch. It's not as detailed as tools like wireshark, but it often provides enough information to suss out some basic issues like when certain design decisions are producing way too much network traffic.

4 Likes