Hi, I'd like to get back on this task and give it a shot, but I have troubles building and testing images from scratch.
What's the recommended procedure? Installing the latest rolling release and hacking that one?

Thanks for the pointer. I am even surprised that this worked with --cipher. In any case, I presume that template needs an exception.

FTR --ncp-disable was only supposed to disable the cipher negotiation. It was not meant to disable encryption entirely. --data-ciphers none is the way to go, but it seems you've already figure this out.

Hey @fernando thanks for your comment.
Personally I haven't tried openvpn2.6.0 + ovpn-dco on Debian 12 yet. However, there should be no real difference as ovpn-dco can happily run up to linux-6.1/6.2 as well.

@Viacheslav unfortunately I am not too familiar with your build system, but basically you need to clone the ovpn-dco repository (https://github.com/OpenVPN/ovpn-dco.git) and compile it against your kernel, as you would normally do for any other out-of-tree kernel module.

when an incompatible option is found, OpenVPN will simply disable DCO and go back to tun (this info will be logged). Therefore the limitations should not be a reason for not including DCO in VyOS.

I created a PR to solve this specific issue (and some more related to this): https://github.com/vyos/vyos-1x/pull/1637