Page MenuHomeVyOS Platform
Create Task
Maniphest T8264

Upgrade OpenVPN to version 2.7 along with new 'ovpn' kernel module
Closed, ResolvedPublicFEATURE REQUEST
Actions

Description

Upgrade the OpenVPN package to the new 2.7.0 release.
This version comes with support for the new 'ovpn' kernel mdoule (which was upstreamed in linux 6.16).
VyOS should ship the new module as well.

To get the module built, we should rely on the https://github.com/OpenVPN/ovpn-backports repository which contains all required tools to get the latest code compiled on kernel 6.6 (which seems to be the kernel for this release).

Note that OpenVPN 2.7.0 is not compatible anymore with the older 'ovpn-dco-v2' kernel modules which was previously developed.

This version comes with a bunch of new options, including the support for multiple "--local" directives which instantiate a new socket each (leading to multiple listening sockets at the same time). The config parser should be upgraded accordingly.

Details

Version
-
Is it a breaking change?
Perfectly compatible
Issue type
Performance optimization
Forum thread
https://forum.vyos.io/t/openvpn-has-no-dco/17640

Related Objects

Event Timeline

ordex created this task.Feb 12 2026, 12:27 PM
fernando subscribed.Feb 12 2026, 12:29 PM
Viacheslav triaged this task as Normal priority.Feb 12 2026, 1:44 PM
pasik subscribed.Feb 12 2026, 4:44 PM
mrpops2ko subscribed.Wed, Aug 26, 7:28 PM
c-po set Forum thread to https://forum.vyos.io/t/openvpn-has-no-dco/17640.Sat, Aug 29, 7:51 PM
mrpops2ko added a comment.Sat, Aug 29, 11:26 PM

yep hope this gets added. openvpn dco seems ready for primetime and various online benchmarks show it outperforming wireguard and using half the cpu or less in doing so, on x86 AM4 platforms using AES-NI ciphers.

ordex added a comment.EditedSun, Aug 30, 8:53 AM

Long due...PRs posted:

https://github.com/vyos/vyos-build/pull/1281
https://github.com/vyos/vyos-1x/pull/5435
https://github.com/vyos/vyos-1x/pull/5441

ordex added a comment.Sun, Aug 30, 8:54 AM

We don't need ovpn-backports (for now) since the shipped kernel already includes the ovpn module.

We may want to revisit this when the in-kernel ovpn becomes too old.

matthew subscribed.Mon, Aug 31, 1:18 PM
Viacheslav changed the task status from Open to In progress.Mon, Aug 31, 2:07 PM
Viacheslav assigned this task to ordex.
Viacheslav changed the task status from In progress to Needs testing.Mon, Sep 14, 3:51 PM
Viacheslav closed this task as Resolved.Thu, Sep 17, 9:56 AM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.
b3r1k mentioned this in T9337: OpenVPN site-to-site: "keep-alive interval 0" leaves ping-restart armed and flaps an idle tunnel.Fri, Sep 18, 11:06 AM