https://cybertoolchain.io/tools/openvpn New releases and features in OpenVPN, tracked by The Cyber Toolchain. en Thu, 06 Aug 2026 10:05:17 GMT https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6 https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6 Thu, 06 Aug 2026 10:05:17 GMT OpenVPN v2.7.6 makes `tun` the default device, caps `--ping`/`--keepalive` at 24 h, and enables `TCP_NODELAY` by default. • Omitting `--dev` from an OpenVPN config now defaults to `--dev tun`, removing a previously required boilerplate option for the common tun case. • `TCP_NODELAY` socket flag is now always enabled on the local socket; `--tcp-nodelay` in server mode now specifically pushes `socket-flags TCP_NODELAY` to clients that may not have this default. Breaking changes: • The `--ping` and `--keepalive` options now reject values exceeding 86400 seconds (24 hours); configs with larger values will need to be updated. • `TCP_NODELAY` is now enabled by default on all sockets; previously it was opt-in via `--tcp-nodelay`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.7.2 https://github.com/OpenVPN/openvpn/releases/tag/v2.7.2 Wed, 22 Apr 2026 19:49:39 GMT OpenVPN v2.7.2 adds base64 multiline password support in the management interface (version 6). • Supports input of very long passwords in base64-encoded multiline format via the management interface, signalled to clients as management version 6. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1 https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1 Tue, 31 Mar 2026 16:01:26 GMT OpenVPN 2.7.1 adds username-only auth mode and boosts default hash map sizing for large-client deployments. • Adds `username-only` flag to `--auth-user-pass`, letting clients send only a username (with a dummy password) to trigger server-side external challenge schemes. • Increases default internal hash map sizing to `4 * --max-clients`, improving performance on servers with large client counts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.7.0 https://github.com/OpenVPN/openvpn/releases/tag/v2.7.0 Wed, 11 Feb 2026 13:06:33 GMT OpenVPN 2.7 adds multi-socket servers, PUSH_UPDATE support, epoch data keys, new DCO Linux module, and improved DNS handling on all platforms. • Adds multi-socket server support, allowing a single server process to handle multiple addresses, ports, and protocols simultaneously. • New client-side DNS implementations for Linux/BSD/macOS and Windows, adding split DNS and DNSSEC support on Windows. • Supports the new `PUSH_UPDATE` control-channel message, enabling servers to push routing and DNS config changes to clients without forcing a reconnect. • New management interface commands `push-update-broad` and `push-update-cid` for server-side delivery of PUSH_UPDATE option updates. • Introduces Epoch data keys and packet format for improved data channel security, including enforcement of AES-GCM usage limits. • Supports the new `ovpn` DCO Linux kernel module (with backports available via ovpn-backports) for next-generation kernel-level data channel offload. • Enforces `block-local` flag using WFP filters on Windows for stronger local traffic blocking. • Windows network adapters are now generated on demand, reducing resource usage at startup. • Windows automatic service now runs as an unprivileged user, reducing attack surface. • Adds server mode support in the win-dco Windows driver. • Supports Epoch data channel on Windows via the win-dco driver. • Adds TLS 1.3 support with bleeding-edge mbedTLS versions, including support for mbedTLS version 4. • Introduces two new environment variables to communicate desired default gateway redirection to plugins such as Network Manager. • Makes the Recursive Routing check more granular, dropping in-tunnel packets only when destination IP, protocol, and port all match the VPN server's reach parameters. Breaking changes: • Support for the wintun driver has been removed; win-dco is now the default Windows driver, with tap-windows6 as the fallback. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13 https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13 Wed, 15 Jan 2025 15:17:50 GMT OpenVPN v2.6.13 adds OS version reporting to servers, Windows credential memory protection, and removes systemd password timeouts on Linux. • Sends the client OS release string via `IV_PLAT_VER` to the server on non-Windows platforms (macOS, Linux, Unix), enabling server-side tracking of client OS versions. • Protects cached usernames, passwords, and tokens in Windows client memory using the CryptProtectMemory() Windows API. • Passes `--timeout=0` to `systemd-ask-password` on Linux, removing the previous 90-second default timeout for console credential prompts. • Uses a new non-exclusive control device API to retrieve the dco-win driver version on Windows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.6.11 https://github.com/OpenVPN/openvpn/releases/tag/v2.6.11 Thu, 20 Jun 2024 12:17:34 GMT OpenVPN v2.6.11 adds Windows CA template matching and FreeBSD pre-created DCO interfaces • Adds `windows_ca_template` support in the Windows Crypto-API to match certificates against active directory certificate templates. • Enables creation of pre-configured Data Channel Offload (DCO) interfaces on FreeBSD without requiring OpenVPN to set the interface mode. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.6.10 https://github.com/OpenVPN/openvpn/releases/tag/v2.6.10 Wed, 20 Mar 2024 19:13:42 GMT OpenVPN v2.6.10 adds test skipping logic to t_client.sh • `t_client.sh` now supports running pre-tests and skipping test blocks based on environment conditions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.6.9 https://github.com/OpenVPN/openvpn/releases/tag/v2.6.9 Wed, 14 Feb 2024 13:43:18 GMT OpenVPN v2.6.9 adds `--force-tls-key-material-export`, mbedTLS 3.x support, and TLS alert logging. • Add support for building with mbedTLS 3.x.x • Add new option `--force-tls-key-material-export` to enforce TLS keying material export for clients • Log incoming SSL alerts in a more readable format, lowering the verbosity threshold from `--verb 8` to `--verb 3` • Update protocol_dump() to support printing `--tls-crypt` packets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.6.7 https://github.com/OpenVPN/openvpn/releases/tag/v2.6.7 Fri, 10 Nov 2023 14:16:27 GMT OpenVPN v2.6.7 adds DCO driver version logging and TLS peer temporary key details to help debug Windows and TLS issues. • DCO-WIN: get and log driver version for easier debugging • print "peer temporary key details" in TLS handshake • log OpenSSL errors on failure to set certificate Breaking changes: • The `--disable-dco` flag must now be used when a 2.6.x client connects to a 2.4.0-2.4.4 server due to hard incompatibility with DATA_V1 packets • OpenSSL Engine method for loading a key has been removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn https://github.com/OpenVPN/openvpn/releases/tag/v2.6.6 https://github.com/OpenVPN/openvpn/releases/tag/v2.6.6 Wed, 23 Aug 2023 15:34:29 GMT OpenVPN v2.6.6 adds ability to set WINS server via interactive service for DCO + wintun on Windows. • `set WINS server` is now supported in the interactive service configuration to provide WINS resolution for DCO + wintun interfaces when no DHCP server is present. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openvpn