What is OpenVPN?

OpenVPN is an open-source VPN daemon that creates encrypted point-to-point and server-to-multiclient tunnels over UDP or TCP, using TLS for authentication and key exchange and a virtual tun (routed IP) or tap (bridged Ethernet) interface on each host. This listing covers OpenVPN Community Edition, the OpenVPN 2.x program developed in the OpenVPN/openvpn repository and described on the project site as the open source community edition. The source is copyright 2002 to 2026 by OpenVPN Inc., and "OpenVPN" is a trademark of OpenVPN Inc.

The program is licensed under the GNU General Public License version 2, as stated in the README and the COPYING file. COPYING adds a special exception that permits linking with OpenSSL and an exception for linking with Apache 2.0 licensed libraries. OpenVPN Inc. also sells commercial products that are separate from this daemon: the community downloads page names Access Server and CloudConnexa as the company's commercial solutions for businesses, both with 24/7 support. Those products, and the OpenVPN Connect client, are not part of the GPL Community Edition described here.

The latest release is OpenVPN 2.7.9, published November 5, 2026. It is mainly a security and bug-fix release for Windows: plugin DLL dependencies are only loaded from the plugin, application and system directories, openvpn.exe started by the interactive service runs at high integrity level, the interactive service filters user-defined environment variables and validates command lines more strictly, and several memory leaks and error paths in openvpnserv were fixed. It also fixes username and password parsing from --auth-user-pass files, sets IFF_BACKPRESSURE on Linux where available, and lets the management interface pass the username to a GUI when only the password is needed. Version 2.7.0 was first released on February 11, 2026; according to the supported versions page, 2.7 has full stable support, while 2.6 is in old stable support (security and critical fixes) with end of life in August 2028.

OpenVPN is written in C and builds with autotools on Unix-like systems or CMake for Windows. The INSTALL file lists a tun/tap driver and a TLS library (OpenSSL 1.1.1 or later, or mbed TLS) as requirements, plus libnl-gen and libcap-ng on Linux; the repository also documents builds with wolfSSL and AWS-LC. The PORTS file lists Windows, Windows Server, Linux, FreeBSD and macOS as tier 1 platforms tested for every commit, and OpenBSD, NetBSD, DragonFly BSD and Solaris as tier 2. Release 2.7 adds Haiku support.

Official community builds are Windows MSI installers for x86-64, ARM64 and x86 (Windows 10 or later, including Windows Server), which bundle the OpenVPN GUI, plus a source tarball with GnuPG signatures. Linux packages come from the official community software repositories for Debian and Ubuntu and from Fedora Copr for Fedora and RHEL. Certificates are commonly created with the separate easy-rsa project. WireGuard-based tools listed on iThub include NetBird, Firezone and Defguard; ZeroTier and Nebula build peer-to-peer overlay networks with their own protocols.

Inside the application

OpenVPN screenshots

Explore the interface. Open a screenshot to view it at full size.

View full size ↗

OpenVPN screenshot 1

OpenVPN GUI connection window with a connected tunnel on a Windows laptop, from the official community downloads page.

View full size ↗

Packet path without DCO

Packet path without Data Channel Offload, from the OpenVPN community wiki.

View full size ↗

Packet path with DCO

Packet path with Data Channel Offload: the kernel module handles routing and crypto, from the OpenVPN community wiki.

Source: official OpenVPN project page.

Key capabilities

Download for Windows The community downloads page offers OpenVPN-2.7.9-I001-amd64.msi, -arm64.msi and -x86.msi, each with a GnuPG .asc signature. The installers support Windows 10 and later, including Windows Server editions, and include the OpenVPN GUI tray application and the interactive service. They are built from the OpenVPN/openvpn-build repository.
Packages for Linux The official apt repository at build.openvpn.net covers Debian 11, 12 and 13 and Ubuntu 20.04, 22.04, 24.04 and 25.10, with stable, testing, release/2.6 and release/2.7 channels. Fedora and RHEL builds are published through Fedora Copr projects such as @OpenVPN/openvpn-release-2.7 (RHEL via EPEL) and @OpenVPN/openvpn-release-2.6. Most Linux distributions also ship their own OpenVPN packages.
Source builds The release tarball (openvpn-2.7.9.tar.gz, with signature) builds with ./configure && make && make install; README.cmake.md covers MinGW and MSVC builds for Windows. Development happens on GitHub, with mirrors on GitLab and SourceForge. Tier 1 platforms are Windows, Linux, FreeBSD and macOS; OpenBSD, NetBSD, DragonFly BSD and Solaris are tier 2.
TLS-based authentication and key exchange Peers authenticate with X.509 certificates in TLS mode, optionally combined with username and password checks through scripts, plugins or the management interface. --peer-fingerprint allows TLS mode without a full CA. --tls-auth, --tls-crypt and --tls-crypt-v2 protect the control channel; release 2.7 adds --tls-crypt-v2-max-age to reject old client keys. Static-key mode (secret) is removed by default in 2.7 and scheduled for removal in 2.8.
Data channel ciphers The data channel negotiates AEAD ciphers listed in --data-ciphers, which can now include the keyword DEFAULT. Release 2.7 enforces AES-GCM usage limits with the same margin as TLS 1.3 and introduces the epoch data packet format with automatic key switchover, 64-bit packet IDs and an AEAD tag at the end of the packet. Compression on send was removed in 2.7; received compressed data can still be decompressed.
Routed and bridged tunnels A tun device carries routed IP traffic and a tap device carries bridged Ethernet frames. Servers push routes, DNS settings and other options to clients, can assign per-client settings from a client-config directory, and can redirect a client's default gateway. Linux supports user-defined routing tables through --route-table since 2.7.
Multi-socket servers Since 2.7, a server can listen on several sockets at once by using multiple --local statements, for example UDP and TCP on the same server or several addresses and ports. --port-share, which passes non-OpenVPN TCP connections to another server on the same port, now supports IPv6.
Data Channel Offload (DCO) With DCO, encryption and routing of data packets move into a kernel module while the OpenVPN process keeps the control channel. The Linux module ovpn was merged into Linux 6.16, and OpenVPN 2.7 supports only that new API; out-of-tree builds for older kernels are in ovpn-backports. On Windows, the ovpn-dco-win driver now also works in server mode. See README.dco.md and the DCO wiki pages.
DNS handling on clients Release 2.7 ships a default --dns-updown script for Linux, BSD and macOS that applies server-pushed DNS settings through systemd-resolved, resolvconf or /etc/resolv.conf, which enables split DNS on Linux and macOS. The Windows client uses the Name Resolution Policy Table (NRPT) for split DNS and DNSSEC, which requires the interactive service.
Windows client components The Windows build uses the ovpn-dco-win driver for modern configurations and falls back to tap-windows6; wintun support was removed in 2.7. Network adapters are created on demand, the automatic service runs as an unprivileged user and delegates privileged tasks to the interactive service, and the block-local flag is enforced with Windows Filtering Platform rules.
PUSH_UPDATE Release 2.7 lets a server update parts of a connected client's configuration (IP address, routes, MTU, DNS) with a PUSH_UPDATE control message. Servers trigger it through the management interface commands push-update-broad and push-update-cid. The feature is disabled while DCO is active.
Management interface A TCP or Unix socket management interface lets external programs such as GUIs and controllers query state, supply credentials, kill clients and handle client authentication. The commands are described in management-notes.txt; 2.7.9 adds a username hint in password prompts for clients that announce compatibility level 6 or later.
Plugins and scripts Hooks such as --up, --down, --client-connect, --auth-user-pass-verify and --tls-verify run scripts at connection events, and a C plugin API is available for authentication and policy modules. Release 2.7 adds the environment variables route_redirect_gateway_ipv4 and route_redirect_gateway_ipv6 for tools like NetworkManager, and --override-username for use with --auth-gen-token.
Proxy and NAT traversal options Clients can connect through HTTP and SOCKS proxies; NTLMv1 proxy authentication was removed in 2.7 and NTLMv2 remains. TCP mode, configurable ports and keepalive options help tunnels pass firewalls and NAT. DCO implementations detect clients that move to a new IP address (floating) and notify userland.
Testing without privileges Release 2.7 can take a tun/tap device from a Unix domain socket. Combined with the lwIP-based lwipovpn program, a client can emulate a full IP stack that answers pings or serves a website without elevated permissions.
Documentation and support channels The OpenVPN 2.7 manual documents every option, and the community how-to walks through PKI, server and client configuration. Community support is available through the forum, the community wiki and GitHub issues.

Where OpenVPN fits

Remote access for users to a private network

An administrator builds a small PKI with easy-rsa, configures an OpenVPN server in tun mode with a client address pool, and pushes routes or a default gateway redirect plus DNS settings to clients. Windows users install the MSI and import a profile into the OpenVPN GUI; Linux users install the package and run the client profile. The community how-to describes this setup step by step.

Site-to-site links between networks

Two gateways connect their LANs over a routed tunnel, with routes for the remote subnet on each side, or with a single server and per-client iroute entries in a client-config directory for several branch sites. Tap mode bridges Ethernet segments when layer 2 connectivity is needed.

High-throughput servers with Data Channel Offload

On Linux 6.16 or later, or with the ovpn-backports module, and on Windows with ovpn-dco-win, OpenVPN hands data packet encryption and routing to the kernel driver while the daemon handles TLS and configuration. DCO supports only AES-GCM (128, 192, 256) and ChaCha20-Poly1305 data ciphers and has further limitations by design; the DCO documentation lists the details.

Split DNS for corporate domains

A server pushes DNS servers and search domains with the --dns option. Since 2.7, Linux and macOS clients apply them with the bundled --dns-updown script, and Windows clients use NRPT rules, so that only selected domains resolve through the tunnel.

Integrating with authentication and management systems

Servers delegate user checks to scripts, plugins or an external controller connected through the management interface, for example to verify username and password, apply per-client firewall rules or disconnect a client. Since 2.7, a controller can also send PUSH_UPDATE messages to change client addresses, routes or DNS without reconnecting, except while DCO is active.