What is OpenVPN: protocol, free edition and paid products

Three things called OpenVPN

Palo Alto Networks, a security vendor, says, in its section on how OpenVPN works, that OpenVPN is an open-source software project, a VPN tunneling protocol, and the name of the company behind the protocol. RTINGS, a testing lab, gives the same three: the protocol itself, a software project, and the company that manages it, OpenVPN Inc., founded in 2001. Surfshark, which sells a VPN service, says the term refers to the protocol, to the open-source software behind it, and to the company that supports that software and builds commercial VPN clients. NordVPN, another seller, says the name refers to several related things, one of them the company that supports the open-source code and offers its own commercial VPN products. That is four pages with the same split, and it is why a question like “what is OpenVPN” has more than one correct answer.

The code has a dated origin. Wikipedia lists James Yonan as the original author, gives 13 May 2001 as the first release, says it is written in C and released under the GNU General Public License version 2, and adds that commercial licenses are available. The blog of OpenVPN Inc. tells the story in its own way: the project was founded in 2001 by Yonan, who was travelling through Central Asia and had to connect remotely to an office, and was concerned about routing through servers in countries with “untrustworthy security practices.” That is the project telling its own history, and we read no independent account of it.

The project’s own page on openvpn.net describes OpenVPN as a community-supported open-source project under the GPL, with contributions from developers at OpenVPN Technologies, Inc. and from the wider community. It lists IRC channels on libera.chat, the openvpn-users and openvpn-devel mailing lists, a community forum, a wiki and GitHub issues as the places to ask and to contribute. The download page for the Community Edition gives version 2.7.8 for Windows, with installers for x86-64, ARM64 and 32-bit systems, a GUI client and a system service, supported “from Windows 10 onward.” Wikipedia gives the same 2.7.8 as the stable release, dated 7 October 2026, though its box still says Windows 7 or later; the download page is the newer statement and is the one we use. The download page also points to two open-source clients it lists among its links: OpenVPN for Android and Tunnelblick for macOS.

What the tunnel is made of

Wikipedia describes OpenVPN as a system for creating secure point-to-point or site-to-site connections in routed or bridged configurations, plus remote access, with both client and server applications. Peers can authenticate with pre-shared secret keys, certificates, or a username and password; Palo Alto Networks lists the same three. For encryption it uses the OpenSSL library and the TLS protocol, in what Wikipedia calls a custom security protocol that uses SSL/TLS for the key exchange. Wikipedia adds that support for mbed TLS, another library, arrived in version 2.3, and Phoronix reported TLS 1.3 support with the latest mbedTLS code when 2.7 came out in February 2026.

The transport is a choice. OpenVPN can run over UDP or TCP, and Wikipedia, whose networking section carries a note from July 2009 asking for more citations, gives port 1194 as the one IANA assigned to it. Palo Alto Networks says it runs over UDP port 1194 by default and often uses TCP port 443 when it runs over TCP, the port HTTPS uses, which it says can help the traffic blend in and make it harder for firewalls to block. The pages disagree a little on which transport is the better habit. The blog of OpenVPN Inc. says UDP is the recommended choice, and that TCP should be used only when strictly needed because performance will likely degrade and the “TCP meltdown” may appear. Wikipedia explains that last point: over TCP, performance stays acceptable only while the un-tunneled link has enough spare bandwidth, and otherwise falls off dramatically. Palo Alto Networks puts the trade in one line: TCP mode is reliable but gives up speed, while UDP is faster and less reliable.

Wikipedia describes two kinds of virtual interface: a layer-3 IP tunnel, called TUN, or a layer-2 Ethernet tunnel, called TAP, which can carry any type of Ethernet traffic. It adds that since version 2.0 one process can manage several tunnels at once. Plug-ins and scripts can be called at defined points, and Wikipedia names RADIUS, PAM, LDAP and SQL databases among the things they connect to. Palo Alto Networks mentions custom directives, such as giving connecting clients static IP addresses or sending traffic through a proxy after the connection is made, and says it can be set up for load balancing and for multifactor authentication.

On ciphers, the pages do not give one answer. Wikipedia says it offers up to 256-bit encryption through OpenSSL, can be configured with ciphers such as ChaCha20 and AES-256, and supports Perfect Forward Secrecy, which regenerates keys at set intervals. It also says OpenVPN runs in userspace and can drop root privileges. Palo Alto Networks says that by default it uses AES-256. A documentation page on openvpn.net about the cryptographic layer says BlowFish is the default cipher and SHA1 the default message digest. We read that page as old wording, since the same text speaks of a key method that will become the default in version 2.0, so we do not use it for current defaults, and we do not choose between the two statements. NordVPN adds that security depends in part on the ciphers and key lengths chosen, which is why it says “proper configuration is so crucial.”

Free software, paid product

Wikipedia says OpenVPN is available in two versions. The Community Edition is the free and open-source one. Access Server is based on it and adds paid, proprietary features, among them LDAP integration, an SMB server and management through a web interface, along with installation and configuration tools. The blog of OpenVPN Inc., from 10 June 2020, draws the same line from the project’s side: the Community Edition is “entirely free to deploy,” but it needs a strong understanding of Linux and the command line, while Access Server has a web-based admin site that it says suits administrators with or without Linux knowledge. The blog says the licence for Access Server is based on the number of active VPN connections, and that it is free to install and use for two simultaneous connections for testing purposes. That text is more than six years old, but the home page of openvpn.net now lists 2 free connections for Access Server, and up to 5 free seats and a free trial for CloudConnexa; that is the vendor describing its own offer. The same blog says the Community Edition has had over 50 million downloads, a figure from 2020 that comes from the project itself.

The commercial side has moved on. The home page of openvpn.net now offers two products, Access Server, which is self-hosted, and CloudConnexa, which is delivered from the cloud. It also states that the company is SOC 2 and HIPAA compliant and quotes counts of organizations and users that we do not repeat, because they are the vendor’s own claims and the home page we read gives no way to check them. Palo Alto Networks frames the whole protocol around the same buyers: security teams linking a headquarters to its branches, remote access for employees, mobile access, and multifactor authentication within a Zero Trust approach.

For a person who is not an administrator, OpenVPN usually arrives inside a VPN service. Surfshark says to download its app and select OpenVPN in the settings, and adds that those who want to connect on their own can follow guides it recommends. NordVPN says a VPN provider can offer several protocols, WireGuard and IKEv2/IPsec among them, and that the protocol is free in the sense that it is open source. It also says there is a free OpenVPN client you can install, which then needs a server, either your own or one that comes with a subscription. RTINGS warns that a subscriber is at the mercy of how the provider configures its OpenVPN servers, so the experience can vary greatly from server to server. Palo Alto Networks lists setup complexity as a drawback and says that incorrect configurations can compromise security. It also says the protocol often requires additional software, such as third-party clients. Both NordVPN and Surfshark sell other protocols too, so their remarks on OpenVPN come from sellers, and we use them only as statements of what each says.

How fast it is, and what DCO changes

Palo Alto Networks says OpenVPN may not be as fast as newer protocols like WireGuard. Surfshark lists slower speeds than WireGuard among its drawbacks, and NordVPN says the same of newer protocols in general. The only measurement we read in full is RTINGS’s, updated on 31 March 2026. It put four identical ThinkPad laptops running Windows 11 on Speedtest.net’s command-line tool, one as a control on the Montreal office network and three connected to Mullvad servers in London, and ran a test every 40 minutes for 12 hours. The control reached 897.0 Mbps down and 918.5 up. OpenVPN over TCP reached 44.1 down and 39.2 up. OpenVPN over UDP reached 149.1 down and 125.8 up, with 15.2 percent packet loss. WireGuard reached 353.6 down and 366.0 up.

RTINGS is careful about what that shows. Each setup had 19 tests except OpenVPN over UDP, where ten tests failed and only 9 results remain; RTINGS says it cannot say for sure why. It also says the results depend heavily on the provider, its servers and their load, and on where the server sits, and that servers in Montreal would very likely have given significantly different numbers. It still calls the results comparable to each other. The write-up does not say whether the kernel module described below was in use, so the UDP figure should not be read as what OpenVPN can do with it. The head-to-head with WireGuard is on our page WireGuard vs OpenVPN, and we do not repeat it here.

The community wiki on openvpn.net explains why the project built the module, called Data Channel Offload or DCO. On a plain server, packets enter the kernel networking stack, go straight back to userspace so the OpenVPN process can decide where they go and encrypt them, and then return to the kernel. The wiki lists two disadvantages: data packets enter and leave the kernel twice, and all client traffic is handled by one single-threaded process. With DCO, the userspace process still does the handshake and then hands the data channel parameters to a kernel module through its NetLink interface. Encryption and routing then happen in the kernel. The control channel, which covers the TLS handshake and key renegotiation, stays in userspace, which the wiki says keeps the module simple and reduces the attack surface. It says OpenVPN 2.6 or greater is required, and that embedded devices such as small routers will probably benefit considerably.

The Access Server documentation describes the same change in terms of copies: without DCO the packets are copied to user space and back, and with it they stay in the kernel. It says that for best performance both the Access Server and the VPN clients should use DCO, and that from Access Server 3.2.0 the module is called ovpn and is aligned with upstream Linux kernel 6.16 or later, while older versions use ovpn-dco.

Phoronix, a news site about Linux, followed the module into the kernel. On 20 April 2025 it reported the driver queued in the net-next networking tree after its patches were revised a 25th time, with the 6.16 merge window as the target, and said the performance advantages in its article were benchmarks shown by OpenVPN Inc. On 11 February 2026 it reported OpenVPN 2.7, with multi-socket support on servers, better DNS options on clients and Windows-specific changes, and said the userspace can work with the DCO module upstreamed into Linux 6.16. The home page of openvpn.net carries a news headline saying OpenVPN is now the fastest VPN protocol with DCO, and the vendor’s comparison page says OpenVPN reaches parity with DCO. The benchmark charts in the Phoronix articles are images that we did not read, and the pages we read contain no independent speed test of DCO: the figures that appear are OpenVPN Inc.'s own, or GL.iNet's router tests as quoted by OpenVPN Inc., and we do not repeat them

Where it still gets used, and where it gets spotted

Palo Alto Networks lists the platforms: Windows, macOS, Linux, iOS, Android, FreeBSD, OpenBSD, NetBSD, Solaris, QNX, Maemo, Synology NAS devices, ChromeOS, routers running firmware such as DD-WRT, OpenWrt and Tomato, and network appliances running OPNsense and pfSense. Wikipedia adds that router firmware can run it in client or server mode, and that a router in client mode lets any device on the network use the VPN without being able to install OpenVPN. That is the idea behind the VPN router. It also says SoftEther VPN and VyOS include it.

The other place the protocol is picked is a network that gets in the way. RTINGS says some networks completely block UDP traffic, and that this is when the TCP mode of OpenVPN is needed. Wikipedia says it can traverse NATs and firewalls and can work through most proxy servers, HTTP ones included, and Palo Alto Networks calls it particularly effective at navigating firewalls and NAT. The comparison page on openvpn.net says it falls back to TCP on port 443 and can speak through HTTP and SOCKS proxies, but that is the vendor describing its own product against WireGuard.

The same pages also warn that it can be spotted. Wikipedia says OpenVPN connections can be detected with deep packet inspection, which works from known header data of the packets whatever the protocol or port used. It says the inspection cannot reveal what is inside the tunnel, but can be used to block the connection, identify who is taking part and log related data. Surfshark lists potential firewall blocks among the drawbacks. Wikipedia’s section on networking carries a note, dated July 2009, asking for more citations, and its detectability paragraph cites several references.

Here our reading comes in, marked as ours. Palo Alto Networks says port 443 makes traffic harder for firewalls to block; Wikipedia says inspection finds OpenVPN whatever the port. The two statements need not conflict, if one is about blocking by port and the other about blocking by inspection. The pages we read do not put them side by side, so we cannot say which kind of block a given network uses. For the feature that keeps traffic from leaking when a tunnel drops, see the kill switch page.

Palo Alto Networks, the only page we read that sets OpenVPN beside the older protocols, puts it this way. PPTP may be fast but lags on encryption, using 128-bit keys. L2TP/IPsec is better than PPTP but lacks OpenVPN’s flexibility and firewall traversal, and it has more trouble with NAT firewalls. IKEv2/IPsec can be faster and quickly re-establishes lost connections, which it says suits mobile users, while OpenVPN offers more configurability. SSTP, which is built into Windows, it calls comparable in service, with OpenVPN open to scrutiny by the wider community. That is one security vendor’s summary, with no test behind it, and we did not check it against a second independent page.

What the pages leave open

Open source is the usual answer to is it safe. Palo Alto Networks says the code is available for audit by any third party, Surfshark says it has been vetted by security experts worldwide, and RTINGS says decades of existence have seen numerous extensive security audits. RTINGS also says the code base runs to hundreds of thousands of lines, which makes review by individuals highly impractical and gives bugs a much wider attack surface than a small one would. The pages we read do not name an audit with its auditor and date, so we cannot tell you who looked at what, or when; the vendor's comparison page mentions only “an independent audit with all high-priority findings fixed in 2.4.2,” without auditor or date.

Four more points stay open. The pages do not agree on the default cipher, as above. The community wiki and the Access Server page do not say which settings DCO requires; the vendor's comparison page says only that DCO runs over UDP and TCP with AEAD ciphers and that the legacy TAP mode gets no DCO. None of the pages includes an independent speed test of it. The only speed test we read in full does not say whether DCO was on. And on how widely OpenVPN is used, the pages we read give only the project’s own figures, the 50 million downloads from 2020 and the vendor’s counts on its home page. We tested nothing ourselves: no installation, no configuration and no speed test.

If you came for the choice between protocols, go to WireGuard vs OpenVPN. If you came for the bigger question of what a VPN does and does not do, What is a VPN used for? sets out the uses and the limits the pages put on each.