Upgrade OpenVPN to version 2.7 along with new 'ovpn' kernel module
Closed, ResolvedPublicFEATURE REQUEST
Actions

Assigned To

Authored By

	ordex
	Feb 12 2026, 12:27 PM

Description

Upgrade the OpenVPN package to the new 2.7.0 release.
This version comes with support for the new 'ovpn' kernel mdoule (which was upstreamed in linux 6.16).
VyOS should ship the new module as well.

To get the module built, we should rely on the https://github.com/OpenVPN/ovpn-backports repository which contains all required tools to get the latest code compiled on kernel 6.6 (which seems to be the kernel for this release).

Note that OpenVPN 2.7.0 is not compatible anymore with the older 'ovpn-dco-v2' kernel modules which was previously developed.

This version comes with a bunch of new options, including the support for multiple "--local" directives which instantiate a new socket each (leading to multiple listening sockets at the same time). The config parser should be upgraded accordingly.

Details

Version: -
Is it a breaking change?: Perfectly compatible
Issue type: Performance optimization
Forum thread: https://forum.vyos.io/t/openvpn-has-no-dco/17640

Related Objects

Mentioned In: T9337: OpenVPN site-to-site: "keep-alive interval 0" leaves ping-restart armed and flaps an idle tunnel
Mentioned Here: T9364: openvpn: set MTU to a reasonable default when enabling DCO

Event Timeline

ordex created this task.Feb 12 2026, 12:27 PM

fernando subscribed.Feb 12 2026, 12:29 PM

Viacheslav triaged this task as Normal priority.Feb 12 2026, 1:44 PM

pasik subscribed.Feb 12 2026, 4:44 PM

mrpops2ko subscribed.Aug 26 2026, 7:28 PM

c-po set Forum thread to https://forum.vyos.io/t/openvpn-has-no-dco/17640.Aug 29 2026, 7:51 PM

yep hope this gets added. openvpn dco seems ready for primetime and various online benchmarks show it outperforming wireguard and using half the cpu or less in doing so, on x86 AM4 platforms using AES-NI ciphers.

Long due...PRs posted:

https://github.com/vyos/vyos-build/pull/1281
https://github.com/vyos/vyos-1x/pull/5435
https://github.com/vyos/vyos-1x/pull/5441

We don't need ovpn-backports (for now) since the shipped kernel already includes the ovpn module.

We may want to revisit this when the in-kernel ovpn becomes too old.

matthew subscribed.Aug 31 2026, 1:18 PM

Viacheslav changed the task status from Open to In progress.Aug 31 2026, 2:07 PM

Viacheslav assigned this task to ordex.

Viacheslav changed the task status from In progress to Needs testing.Mon, Sep 14, 3:51 PM

Viacheslav closed this task as Resolved.Thu, Sep 17, 9:56 AM

Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.

b3r1k mentioned this in T9337: OpenVPN site-to-site: "keep-alive interval 0" leaves ping-restart armed and flaps an idle tunnel.Fri, Sep 18, 11:06 AM

not sure if this is the appropriate place for it, but the speeds are not good. here are some benchmark comparisons using the same VPN node which has wireguard enabled and DCO.

getting 1.7gbit download / 500mbit upload with wireguard with 0% - 4% packet loss
getting 300-400 mbit download / upload with openvpn-dco with 30-50% packet loss

vyos@vyos:/config/speedtest$ show log openvpn interface vtun0

Sep 24 05:54:17 openvpn-vtun0[1688072]: net_iface_type: type of vtun0: ovpn
Sep 24 05:54:17 openvpn-vtun0[1688072]: OpenVPN 2.7.7 [git:HEAD/64fdc30f8b3da705+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] built on Sep  3 2026
Sep 24 05:54:17 openvpn-vtun0[1688072]: library versions: OpenSSL 3.0.20 7 Apr 2026, LZO 2.10
Sep 24 05:54:17 openvpn-vtun0[1688072]: DCO version: 6.18.50-vyos #1 SMP Tue Sep 15 14:27:03 UTC 2026
Sep 24 05:54:17 openvpn-vtun0[1688072]: TCP/UDP: Preserving recently used remote address: [AF_INET]<VPN_SERVER_IP>:443
Sep 24 05:54:17 openvpn-vtun0[1688072]: UDPv4 link local: (not bound)
Sep 24 05:54:17 openvpn-vtun0[1688072]: UDPv4 link remote: [AF_INET]<VPN_SERVER_IP>:443
Sep 24 05:54:17 openvpn-vtun0[1688072]: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bits RSA, signature: RSA-SHA512, peer temporary key: 253 bits X25519, peer signing digest/type: SHA256 RSASSA-PSS, key agreement: x25519
Sep 24 05:54:17 openvpn-vtun0[1688072]: [<VPN_SERVER>] Peer Connection Initiated with [AF_INET]<VPN_SERVER_IP>:443
Sep 24 05:54:17 openvpn-vtun0[1688072]: net_iface_new: add vtun0 type ovpn
Sep 24 05:54:17 openvpn-vtun0[1688072]: net_iface_ovpn_mode: mode of vtun0: 0
Sep 24 05:54:17 openvpn-vtun0[1688072]: DCO device vtun0 already exists, won't be destroyed at shutdown
Sep 24 05:54:17 openvpn-vtun0[1688072]: ovpn-dco device [vtun0] opened
Sep 24 05:54:17 openvpn-vtun0[1688072]: net_iface_up: set vtun0 up
Sep 24 05:54:17 openvpn-vtun0[1688072]: net_addr_v4_add: <VPN_IPV4>/24 dev vtun0
Sep 24 05:54:17 openvpn-vtun0[1688072]: Initialization Sequence Completed
Sep 24 05:54:17 openvpn-vtun0[1688072]: Data Channel: cipher 'AES-256-GCM'
Sep 24 05:54:17 openvpn-vtun0[1688072]: Timers: ping 10, ping-restart 60
Sep 24 05:54:17 openvpn-vtun0[1688072]: Protocol options: explicit-exit-notify 5, protocol-flags cc-exit tls-ekm dyn-tls-crypt

vyos@vyos:/config/speedtest$ ./speedtest -I vtun0

   Speedtest by Ookla

      Server: Community Fibre Limited - London (id: 30690)
         ISP: M247 Europe
Idle Latency:     6.85 ms   (jitter: 0.11ms, low: 6.78ms, high: 7.09ms)
    Download:   364.86 Mbps (data used: 536.4 MB)
                401.20 ms   (jitter: 76.61ms, low: 7.20ms, high: 2321.81ms)
      Upload:   193.32 Mbps (data used: 266.1 MB)
                136.09 ms   (jitter: 61.79ms, low: 6.91ms, high: 864.19ms)
 Packet Loss:    34.1%
  Result URL: https://www.speedtest.net/result/c/2b4f2ad1-61c5-46bd-acf8-15ae00ed2f2e
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0

   Speedtest by Ookla

      Server: Orbital Net - London (id: 48354)
         ISP: M247 Europe
Idle Latency:     6.48 ms   (jitter: 0.04ms, low: 6.38ms, high: 6.50ms)
    Download:   335.49 Mbps (data used: 586.3 MB)
                179.80 ms   (jitter: 65.88ms, low: 7.58ms, high: 1805.40ms)
      Upload:   319.05 Mbps (data used: 430.1 MB)
                176.82 ms   (jitter: 68.65ms, low: 6.35ms, high: 1701.08ms)
 Packet Loss:    29.3%
  Result URL: https://www.speedtest.net/result/c/3ad74bab-87cc-4873-9de7-9e3f2ec0cba0
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.44 ms   (jitter: 0.05ms, low: 6.38ms, high: 6.48ms)
    Download:   397.62 Mbps (data used: 711.2 MB)
      Upload:   279.87 Mbps (data used: 378.7 MB)
                 60.67 ms   (jitter: 48.42ms, low: 6.28ms, high: 538.20ms)
 Packet Loss:    52.0%
  Result URL: https://www.speedtest.net/result/c/73e95b7c-8e2c-4610-a012-5112840dc41b
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.61 ms   (jitter: 0.09ms, low: 6.50ms, high: 6.78ms)
    Download:   366.72 Mbps (data used: 494.3 MB)
                 33.62 ms   (jitter: 37.98ms, low: 6.97ms, high: 255.71ms)
      Upload:   327.10 Mbps (data used: 405.6 MB)
                 93.53 ms   (jitter: 58.36ms, low: 6.38ms, high: 861.37ms)
 Packet Loss:    53.2%
  Result URL: https://www.speedtest.net/result/c/c81672a6-64cb-4fb8-827a-9368529ffdf4
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.56 ms   (jitter: 0.11ms, low: 6.52ms, high: 6.87ms)
    Download:   378.31 Mbps (data used: 256.0 MB)
                348.43 ms   (jitter: 55.90ms, low: 8.17ms, high: 2392.63ms)
      Upload:   318.08 Mbps (data used: 443.5 MB)
                 59.11 ms   (jitter: 49.35ms, low: 6.43ms, high: 448.02ms)
 Packet Loss:    39.4%
  Result URL: https://www.speedtest.net/result/c/9718ef31-6952-4672-a302-79d5fb88d3b9
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.38 ms   (jitter: 0.08ms, low: 6.35ms, high: 6.60ms)
    Download:   393.48 Mbps (data used: 661.9 MB)
                194.84 ms   (jitter: 73.23ms, low: 6.44ms, high: 462.70ms)
      Upload:   309.18 Mbps (data used: 383.3 MB)
                151.29 ms   (jitter: 65.93ms, low: 6.39ms, high: 1720.85ms)
 Packet Loss:    52.6%
  Result URL: https://www.speedtest.net/result/c/191c305a-4350-43b6-8c3d-c884b0411f13
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.42 ms   (jitter: 0.04ms, low: 6.38ms, high: 6.45ms)
    Download:   387.64 Mbps (data used: 453.9 MB)
                728.64 ms   (jitter: 85.55ms, low: 7.45ms, high: 1588.19ms)
      Upload:   320.22 Mbps (data used: 518.9 MB)
                123.11 ms   (jitter: 62.95ms, low: 6.46ms, high: 869.00ms)
 Packet Loss:    59.4%
  Result URL: https://www.speedtest.net/result/c/2d5cacdf-baa4-4bb4-9189-3811ac163781
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.97 ms   (jitter: 1.28ms, low: 6.78ms, high: 11.30ms)
    Download:   388.70 Mbps (data used: 660.7 MB)
                112.72 ms   (jitter: 59.78ms, low: 6.60ms, high: 921.60ms)
      Upload:   234.95 Mbps (data used: 175.1 MB)
                127.72 ms   (jitter: 65.56ms, low: 6.61ms, high: 866.65ms)
 Packet Loss:    50.7%
  Result URL: https://www.speedtest.net/result/c/13b6b27b-dd7e-4761-94d9-529b8adda8e6
vyos@vyos:/config/speedtest$
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.49 ms   (jitter: 0.05ms, low: 6.47ms, high: 6.68ms)
    Download:   368.84 Mbps (data used: 204.5 MB)
                410.02 ms   (jitter: 106.17ms, low: 6.96ms, high: 908.26ms)
      Upload:   275.70 Mbps (data used: 149.3 MB)
                205.29 ms   (jitter: 61.00ms, low: 7.73ms, high: 1739.85ms)
 Packet Loss:    60.7%
  Result URL: https://www.speedtest.net/result/c/27a1e4b0-ec1c-4fed-a7ab-0ad66f0305ef
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.70 ms   (jitter: 0.18ms, low: 6.52ms, high: 6.86ms)
    Download:   350.35 Mbps (data used: 297.0 MB)
                695.45 ms   (jitter: 77.52ms, low: 10.37ms, high: 2437.50ms)
      Upload:   268.19 Mbps (data used: 290.9 MB)
                 89.09 ms   (jitter: 59.38ms, low: 7.66ms, high: 863.71ms)
 Packet Loss:    58.4%
  Result URL: https://www.speedtest.net/result/c/d499f4d9-ca81-4e2a-8ef7-8fa0a9f7a3fc
vyos@vyos:/config/speedtest$ ./speedtest -I vtun0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.41 ms   (jitter: 0.03ms, low: 6.39ms, high: 6.43ms)
    Download:   352.49 Mbps (data used: 283.8 MB)
      Upload:   278.05 Mbps (data used: 334.6 MB)
                161.29 ms   (jitter: 66.90ms, low: 6.35ms, high: 1755.31ms)
 Packet Loss:    44.3%
  Result URL: https://www.speedtest.net/result/c/282d33c4-fd6b-4446-8fa3-d5e48e2e2d35

wireguard results

vyos@vyos:/config/speedtest$ ./speedtest -I wg0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.77 ms   (jitter: 0.03ms, low: 6.73ms, high: 6.80ms)
    Download:  1699.83 Mbps (data used: 2.1 GB)
                 24.41 ms   (jitter: 15.87ms, low: 6.68ms, high: 300.40ms)
      Upload:   548.53 Mbps (data used: 643.3 MB)
                 43.95 ms   (jitter: 43.07ms, low: 6.68ms, high: 450.28ms)
 Packet Loss:     2.0%
  Result URL: https://www.speedtest.net/result/c/b575d7e1-536e-4cc1-ab96-fc1c362f3ab8
vyos@vyos:/config/speedtest$ ./speedtest -I wg0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.52 ms   (jitter: 0.10ms, low: 6.47ms, high: 6.67ms)
    Download:  1621.04 Mbps (data used: 2.0 GB)
                 22.19 ms   (jitter: 3.38ms, low: 6.65ms, high: 257.69ms)
      Upload:   547.54 Mbps (data used: 687.5 MB)
                 72.24 ms   (jitter: 50.26ms, low: 6.54ms, high: 873.21ms)
 Packet Loss:     0.0%
  Result URL: https://www.speedtest.net/result/c/ad7c5a3a-3b19-4839-a2f2-fd8490995239
vyos@vyos:/config/speedtest$ ./speedtest -I wg0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.40 ms   (jitter: 0.10ms, low: 6.37ms, high: 6.55ms)
    Download:  1700.58 Mbps (data used: 2.0 GB)
                 23.04 ms   (jitter: 6.59ms, low: 6.63ms, high: 286.53ms)
      Upload:   543.60 Mbps (data used: 623.5 MB)
                 56.67 ms   (jitter: 47.99ms, low: 6.99ms, high: 454.34ms)
 Packet Loss:     2.1%
  Result URL: https://www.speedtest.net/result/c/89fad660-ff35-446a-a8b5-5cc0865d109d
vyos@vyos:/config/speedtest$ ./speedtest -I wg0 -s 68305

   Speedtest by Ookla

      Server: Edgeuno - London (id: 68305)
         ISP: M247 Europe
Idle Latency:     6.57 ms   (jitter: 0.16ms, low: 6.44ms, high: 6.67ms)
    Download:  1615.72 Mbps (data used: 1.3 GB)
                 20.20 ms   (jitter: 8.43ms, low: 6.51ms, high: 261.16ms)
      Upload:   560.71 Mbps (data used: 758.2 MB)
                 36.12 ms   (jitter: 39.98ms, low: 6.64ms, high: 446.64ms)
 Packet Loss:     1.5%
  Result URL: https://www.speedtest.net/result/c/995048ec-4dad-4698-9973-78f703627553

Thanks for the report @mrpops2ko .
Please open a new task/bug report. This was only about the port and it's now closed.

While doing so, please test what happens when setting the MTU of the tunnel explicitly to 1440 or 1420.
I think the interface is defaulting to 1500 and that is creating performance issues.

On a side note, how are you testing? who is the server? is it running DCO as well? Is it capable of reaching higher speed?

Thanks.

@mrpops2ko FYI the MTU problem I described was addressed in https://vyos.dev/T9364 . Can you give the latest rolling another try, if have a chance to?
In any case, please report any faulty findings in a new task, so we can take it from there.

Upgrade OpenVPN to version 2.7 along with new 'ovpn' kernel moduleClosed, ResolvedPublicFEATURE REQUESTActions

Description

Details

Related Objects

Event Timeline

Upgrade OpenVPN to version 2.7 along with new 'ovpn' kernel module
Closed, ResolvedPublicFEATURE REQUEST
Actions