openvpn VS ovpn-dco

All our products builds on what we call the "OpenVPN Core". In essence, that is the OpenVPN 2.x project and the OpenVPN 3 Core library. This is the "low level" code which provides the core VPN functionality.

If you have complaints about the [email protected] unit file, please let me know ... that's all my work! At least that's where it started ;-)

We also back several OpenVPN related drivers, such as tap-windows6 driver, ovpn-dco-win driver, ovpn-dco linux kernel module. The tap-windows6 driver is the old Windows driver, which gives a pretty basic tun/tap interface. The DCO drivers are the next generation drivers, where more of the cryptographic operations are moved into the OS kernel instead of happening inside the OpenVPN Core components; which has the potential to improve the tunnel performance.

With Linux, there's lots of stuff going on in the OpenVPN community, in particular with a kernel module to accelerate the performance. The OpenVPN 3 Linux client already supports it and the coming OpenVPN 2.6 release (currently in development) will add support for both server and client mode with data channel offload (aka DCO).

Here is link number 1 - Previous text "DCO"

All that said, with the work being done in OpenVPN with the Data Channel Offload (DCO), it would probably be easier to get hardware support. The DCO implementations (ovpn-dco, ovpn-dco-win) offloads the data channel crypto operations to the virtual network driver, so the encryption/decryption/packet authentication happens entirely in the kernel space - which results in a noticeable performance boost. The tasks these DCO drivers does should be possible to more easily implement inside some dedicated hardware. But it won't be cheap.

There are work in progress on a OpenVPN kernel module, which will improve OpenVPN performance considerably: https://gitlab.com/openvpn/ovpn-dco