OpenVPN

No entries match these filters. Clear filters

1. announced Sep 11, 2026 · issue 072

   OpenVPN launches Access Server Link: browser-based, self-hosted ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. deployment on AWS, Azure, and GCP with automatic DNS and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Deploy a self-hosted Access Server instance on AWS, Azure, or GCP without SSH or manual DNS work — get ZTNA running in minutes from Access Server Hub.
   📍In Access Server Hub, select Deploy with Access Server Link, choose your cloud provider (AWS, Azure, or GCP) and region, enter a hostname and admin password, then launch — DNS and SSL certificates are provisioned automatically.
   • Introduces Access Server Link, a new guided browser-based setup for self-hosted ZTNA that requires only three inputs — hostname, cloud provider/region, and admin password — to deploy Access Server on AWS, Azure, or GCP without SSH, manual DNS configuration, or certificate management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds automatic SSL certificate provisioning and renewal via Access Server Link, replacing self-signed certificates and eliminating certificate-expiry outages.
   • Adds automatic IP-change detection and domain record updates through Access Server Link, keeping deployments reachable without manual DNS intervention after cloud IP changes.
   • Introduces a Zero Trust Application Broker that mediates per-application access using placeholder IP addresses scoped to a single authorized application configured by domain name, making lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. structurally impossible.
   • Access Server deployment through Access Server Link is now available from Access Server Hub.

   5 details in Everything

2. v2.7.6 Aug 6, 2026 · issue 037

   OpenVPN v2.7.6 makes tun the default device, caps --ping/--keepalive at 24 h, and enables TCP_NODELAY by default.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.6 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.7.6

   • Omitting --dev from an OpenVPN config now defaults to --dev tun, removing a previously required boilerplate option for the common tun case.
   • TCP_NODELAY socket flag is now always enabled on the local socket; --tcp-nodelay in server mode now specifically pushes socket-flags TCP_NODELAY to clients that may not have this default.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --ping and --keepalive options now reject values exceeding 86400 seconds (24 hours); configs with larger values will need to be updated.
   • !TCP_NODELAY is now enabled by default on all sockets; previously it was opt-in via --tcp-nodelay.
3. v2.7.2 Apr 22, 2026 · release notes

   OpenVPN v2.7.2 adds base64 multiline password support in the management interface (version 6).

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.2 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.7.2

   • Supports input of very long passwords in base64-encoded multiline format via the management interface, signalled to clients as management version 6.

   1 detail in Everything

4. v2.7.1 Mar 31, 2026 · release notes

   OpenVPN 2.7.1 adds username-only auth mode and boosts default hash map sizing for large-client deployments.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.1 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.7.1

   • Adds username-only flag to --auth-user-pass, letting clients send only a username (with a dummy password) to trigger server-side external challenge schemes.
   • Increases default internal hash map sizing to 4 * --max-clients, improving performance on servers with large client counts.

   2 details in Everything

5. v2.7.0 Feb 11, 2026 · release notes

   OpenVPN 2.7 adds multi-socket servers, PUSH_UPDATE support, epoch data keys, new DCO Linux module, and improved DNS handling on all platforms.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.0 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.7.0

   └──▷ TRY IT
   Push a routing or DNS config update to all connected clients without triggering reconnects, using the new management interface command.
   copy

   $ echo 'push-update-broad route 10.8.1.0 255.255.255.0' | nc 127.0.0.1 7505

   Push an option update to a specific connected client by connection ID without forcing a reconnect.
   copy

   $ echo 'push-update-cid 42 dhcp-option DNS 1.1.1.1' | nc 127.0.0.1 7505

   • Adds multi-socket server support, allowing a single server process to handle multiple addresses, ports, and protocols simultaneously.
   • New client-side DNS implementations for Linux/BSD/macOS and Windows, adding split DNS and DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. support on Windows.
   • Supports the new PUSH_UPDATE control-channel message, enabling servers to push routing and DNS config changes to clients without forcing a reconnect.
   • New management interface commands push-update-broad and push-update-cid for server-side delivery of PUSH_UPDATE option updates.
   • Introduces Epoch data keys and packet format for improved data channel security, including enforcement of AES-GCMAES-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. usage limits.

   +9 more show less

   • Supports the new ovpn DCO Linux kernel module (with backports available via ovpn-backports) for next-generation kernel-level data channel offload.
   • Enforces block-local flag using WFP filters on Windows for stronger local traffic blocking.
   • Windows network adapters are now generated on demand, reducing resource usage at startup.
   • Windows automatic service now runs as an unprivileged user, reducing attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   • Adds server mode support in the win-dco Windows driver.
   • Supports Epoch data channel on Windows via the win-dco driver.
   • Adds TLS 1.3 support with bleeding-edge mbedTLS versions, including support for mbedTLS version 4.
   • Introduces two new environment variables to communicate desired default gateway redirection to plugins such as Network Manager.
   • Makes the Recursive Routing check more granular, dropping in-tunnel packets only when destination IP, protocol, and port all match the VPN server's reach parameters.

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Support for the wintun driver has been removed; win-dco is now the default Windows driver, with tap-windows6 as the fallback.
6. v2.6.13 Jan 15, 2025 · release notes

   OpenVPN v2.6.13 adds OS version reporting to servers, Windows credential memory protection, and removes systemd password timeouts on Linux.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.13 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.6.13

   • Sends the client OS release string via IV_PLAT_VER to the server on non-Windows platforms (macOS, Linux, Unix), enabling server-side tracking of client OS versions.
   • Protects cached usernames, passwords, and tokens in Windows client memory using the CryptProtectMemory() Windows API.
   • Passes --timeout=0 to systemd-ask-password on Linux, removing the previous 90-second default timeout for console credential prompts.
   • Uses a new non-exclusive control device API to retrieve the dco-win driver version on Windows.

   4 details in Everything

7. v2.6.11 Jun 20, 2024 · release notes

   OpenVPN v2.6.11 adds Windows CA template matching and FreeBSD pre-created DCO interfaces

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.11 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.6.11

   • Adds windows_ca_template support in the Windows Crypto-API to match certificates against active directory certificate templates.
   • Enables creation of pre-configured Data Channel Offload (DCO) interfaces on FreeBSD without requiring OpenVPN to set the interface mode.

   2 details in Everything

8. v2.6.10 Mar 20, 2024 · release notes

   OpenVPN v2.6.10 adds test skipping logic to t_client.sh

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.10 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.6.10

   • t_client.sh now supports running pre-tests and skipping test blocks based on environment conditions

   1 detail in Everything

9. v2.6.9 Feb 14, 2024 · release notes

   OpenVPN v2.6.9 adds --force-tls-key-material-export, mbedTLS 3.x support, and TLS alert logging.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.9 https://github.com/OpenVPN/openvpn.git
   # already have the repo? check out this version:
   $ git checkout v2.6.9

   • Add support for building with mbedTLS 3.x.x
   • Add new option --force-tls-key-material-export to enforce TLS keying material export for clients
   • Log incoming SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. alerts in a more readable format, lowering the verbosity threshold from --verb 8 to --verb 3
   • Update protocol_dump() to support printing --tls-crypt packets

   4 details in Everything

10. v2.6.7 Nov 10, 2023 · release notes

    OpenVPN v2.6.7 adds DCO driver version logging and TLS peer temporary key details to help debug Windows and TLS issues.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.7 https://github.com/OpenVPN/openvpn.git
    # already have the repo? check out this version:
    $ git checkout v2.6.7

    └──▷ TRY IT
    Work around the DATA_V1 incompatibility when connecting to an older server.
    copy

    $ openvpn --config legacy-client.ovpn --disable-dco

    • DCO-WIN: get and log driver version for easier debugging
    • print "peer temporary key details" in TLS handshake
    • log OpenSSL errors on failure to set certificate

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --disable-dco flag must now be used when a 2.6.x client connects to a 2.4.0-2.4.4 server due to hard incompatibility with DATA_V1 packets
    • !OpenSSL Engine method for loading a key has been removed
11. v2.6.6 Aug 23, 2023 · release notes

    OpenVPN v2.6.6 adds ability to set WINS server via interactive service for DCO + wintun on Windows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.6 https://github.com/OpenVPN/openvpn.git
    # already have the repo? check out this version:
    $ git checkout v2.6.6

    └──▷ USE IT
    Configure a static WINS server on Windows using DCO and wintun where DHCP is unavailable.
    text copy

    set WINS server 192.0.2.1

    • set WINS server is now supported in the interactive service configuration to provide WINS resolution for DCO + wintun interfaces when no DHCP server is present.

    1 detail in Everything