OpenVPN DCO Looks Like It Might Be Ready For Linux 6.14 To Speed-Up VPN Performance

[phoronix]

Phoronix: OpenVPN DCO Looks Like It Might Be Ready For Linux 6.14 To Speed-Up VPN Performance

In development for several years has been the OpenVPN DCO Linux kernel module for data channel offload (DCO) capabilities to provide for much faster virtual private networking (VPN) performance. It's looking like the lengthy review process on OpenVPN DCO is about wrapping up and leaving hope that it will be ready to premiere in next year's Linux 6.14 kernel...

https://www.phoronix.com/news/OpenVPN-Data-Channel-DCO-Soon

[bug77]

I still want wireguard

[NeoMorpheus]

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

[intelfx]

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

We discussed this in the last thread about OpenVPN DCO.

TL;DR: management capabilities. If you need anything other than a dumb data pipe with pre-shared keys and pre-configured IP addresses, WireGuard is of zero help.

[Raka555]

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

Ease of use.
It is very easy to setup an openvpnAS server +LDAP and let people help themselves.

Wireguard is great for site-to-site VPN, but managing users is a pain. Delivering their private key securely can be challenging.
To ask non-tech savvy people to create their own config and send you the publc key ... well ... uhm...
I cringe at the thought of rolling out wireguard at large scale.

Plain openvpn that you manage yourself probably don't have a lot of advantages except maybe that it can do L2 VPN, which wg can't to my knowledge.

[edxposed]

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

Wireguard limited itself to chacha20 instead of a scalable encryption design for the sake of some embedded ewaste, so it's already lost from the start

[zparihar]

How will the be speed increase compare to WireGuard?

[lyamc]

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

DHCP-type IP Address assignment vs Static-only assignment
Layer 2 (tap) and Layer 3 (tun) support vs just Layer 3
And a lot of other management capabilities

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

First you need to make sure you're comparing apples and oranges. OpenVPN supports TCP and UDP. Some people opt for TCP which will be slower than UDP. As latency increases, TCP throughput falls through the ground.

Aside from that it should make it much more competitive with Wireguard. If you choose Wireguard for the increased throughput, that just means (to me) that you don't need most of what OpenVPN offers. I'm saying this as someone who mainly uses Wireguard.

[tomeq82]

So im curious, which advantages has OpenVPN over Wireguard these days that would make someone choose it?

Manageability and user experience. Raw Wireguard setup is of little real use. Without any programmed/scripted/automated overlay it is just more of proof of concept. Just take a look how does it cope with endpoints behind NAT, what requires it to be operable in such scenario etc. etc.

Don't trust the hype that the Wireguard is "easy to use" or "easiest VPN on the market". It is definitely not.

[fitzie]

Wireguard limited itself to chacha20 instead of a scalable encryption design for the sake of some embedded ewaste, so it's already lost from the start

i think of it more as an experiment. Jason obviously studied ipsec/ssl and the disaster that was both from downgrade attacks and configuration issues and made the decision to fix the algos in. at some point he will have to support newer algos and we'll see how that is handled then. I was resistant at first, but it's a fair decision to decide to make when you've seen all the end user crypto mistakes as he has.