openvpn3 VS ovpn-dco-win

All our products builds on what we call the "OpenVPN Core". In essence, that is the OpenVPN 2.x project and the OpenVPN 3 Core library. This is the "low level" code which provides the core VPN functionality.

OpenVPN 3 (Core) is a complete rewrite and reimplements the OpenVPN protocol as a C++ library. The OpenVPN Connect (macOS, Windows) apps and OpenVPN 3 Linux project are all based on the OpenVPN 3 Core project. In addition, the OpenVPN 3 Core can be activated instead of OpenVPN 2.x on OpenVPN for Android. Currently all of these products and projects only implements the client side.

We also back several OpenVPN related drivers, such as tap-windows6 driver, ovpn-dco-win driver, ovpn-dco linux kernel module. The tap-windows6 driver is the old Windows driver, which gives a pretty basic tun/tap interface. The DCO drivers are the next generation drivers, where more of the cryptographic operations are moved into the OS kernel instead of happening inside the OpenVPN Core components; which has the potential to improve the tunnel performance.

My point is ... if the OpenVPN server is correctly configured, it can perform quite well compared against its competitors. If you're running Linux, the openvpn3-linux client also supports DCO (OpenVPN kernel data-channel off-loading) now. There is also work happening on a Windows driver as well. How much performance boost DCO gives against ProtonVPN is unclear, but against OpenVPN Cloud (which also has kernel acceleration on the server side) it can improve the performance if your network link to the OpenVPN Cloud servers is good enough. OpenVPN 2.6 will come with DCO support for both client and server side too.

All that said, with the work being done in OpenVPN with the Data Channel Offload (DCO), it would probably be easier to get hardware support. The DCO implementations (ovpn-dco, ovpn-dco-win) offloads the data channel crypto operations to the virtual network driver, so the encryption/decryption/packet authentication happens entirely in the kernel space - which results in a noticeable performance boost. The tasks these DCO drivers does should be possible to more easily implement inside some dedicated hardware. But it won't be cheap.