What is OpenVPN?
Updated: 3 days ago
OpenVPN is open-source VPN software and a VPN protocol that creates an encrypted tunnel between VPN peers. It commonly uses TLS to authenticate peers and establish a secure control channel, then carries protected IP traffic through a separate data channel. OpenVPN can run over UDP or TCP, works with IPv4 and IPv6, and is highly configurable — which is both one of its strengths and one reason it can feel more complex than newer VPN protocols.
For broadband users, the important distinction is that OpenVPN does not make the internet connection itself faster or more private by magic. It changes the network path: traffic is encrypted between your device and the VPN endpoint, then leaves that endpoint towards its final destination. If you need the broader concept first, read What is VPN (Virtual Private Network)?.
The infographic below shows the two-channel model that makes OpenVPN easier to understand: a TLS control channel for authentication and key exchange, and an encrypted data channel for the traffic carried through the tunnel.
How does OpenVPN work?
OpenVPN normally creates a virtual network interface on the client and server using a TUN or TAP device. Applications continue to generate ordinary IP traffic. Routing rules decide which packets enter the virtual interface, OpenVPN encapsulates and protects those packets, and the resulting encrypted traffic is sent across the underlying internet connection to the remote OpenVPN peer.
In TLS mode, OpenVPN multiplexes a control channel and a data channel over the same UDP or TCP transport. The control channel establishes the TLS session, authenticates peers and exchanges the keying material used to protect the data channel. The data channel carries the actual tunnelled packets.
The official OpenVPN 2.6 manual describes TLS mode as using the control channel to exchange cipher and authentication keys while tunnel data passes through the data channel.
OpenVPN control channel vs data channel
Control channel: handles TLS negotiation, authentication, configuration messages and key exchange.
Data channel: carries the protected packets that represent the traffic moving through the VPN tunnel.
Transport layer: carries OpenVPN packets between peers using UDP or TCP.
Virtual interface: presents the VPN to the operating system as a network interface so normal routing rules can direct traffic into the tunnel.
Keeping these jobs conceptually separate helps explain why an OpenVPN connection can be established successfully yet still have data-path problems caused by routing, firewall rules, MTU, DNS, policy or server-side forwarding.
Does OpenVPN use UDP or TCP?
OpenVPN supports both UDP and TCP. UDP is normally the preferred transport because it avoids placing one reliable transport protocol inside another. OpenVPN's own documentation says it is designed to operate optimally over UDP, while TCP is available for situations where UDP cannot be used.
UDP: usually the first choice for performance and resilience on ordinary VPN connections.
TCP: useful where a network blocks or restricts UDP, or where the deployment specifically requires TCP transport.
TCP over TCP: if the traffic inside the VPN is also TCP, packet loss can trigger recovery behaviour in both layers, which can reduce efficiency on congested or unreliable links.
The transport choice does not change your broadband access technology. FTTP, cable, fixed wireless or mobile broadband still carries the outer OpenVPN packets; the VPN is an additional protocol layer above that connection.
How does OpenVPN encryption work?
Modern OpenVPN client/server deployments negotiate a data-channel cipher rather than relying on one hard-coded cipher for every peer. In OpenVPN 2.6, the default data-cipher list includes AES-256-GCM and AES-128-GCM, with ChaCha20-Poly1305 included when it is available in the underlying cryptographic library.
These are authenticated-encryption (AEAD) ciphers, meaning confidentiality and integrity protection are combined in the data-channel cipher. The exact cipher actually used depends on what both peers support and permit.
OpenVPN 2.6 also defaults to a minimum TLS version of 1.2 for the control channel. Administrators can impose different policies, so the fact that a connection says 'OpenVPN' does not by itself tell you the complete security configuration.
What does OpenVPN hide — and what does it not hide?
A correctly configured full-tunnel OpenVPN connection encrypts traffic between your device and the VPN endpoint. Your local network and access ISP can see that you are exchanging traffic with the VPN endpoint, but they do not see the protected payload travelling inside the tunnel in the same way they would without the VPN.
The VPN endpoint is not the end of the internet path. Traffic must leave the VPN server towards websites, applications or other networks. The VPN operator therefore becomes part of your trust model. HTTPS and other end-to-end encryption remain important because they protect application traffic beyond the VPN endpoint.
OpenVPN also does not guarantee anonymity. Account identity, browser fingerprints, cookies, logged-in services, DNS configuration, traffic patterns and the VPN provider's own logging policy can all affect privacy.
OpenVPN vs WireGuard
OpenVPN and WireGuard solve the same broad problem — creating a secure VPN tunnel — but they take different design approaches. WireGuard uses a much smaller protocol design and a fixed modern cryptographic suite, while OpenVPN exposes many more configuration choices and has a long history of compatibility across operating systems, networks and enterprise deployments.
OpenVPN: highly configurable, mature, supports UDP and TCP, certificate-based deployments and many legacy/enterprise scenarios.
WireGuard: simpler protocol design, smaller configuration surface and often lower processing overhead on suitable hardware.
Performance: neither protocol has one universal speed. CPU, implementation, acceleration, MTU, server load, route and broadband connection all affect throughput and latency.
Can OpenVPN slow down broadband?
Yes. A VPN adds encapsulation, encryption, routing and an additional network endpoint. The size of the impact depends on the complete path rather than on the OpenVPN name alone.
Client CPU and cryptographic acceleration.
Router CPU if the router itself terminates the VPN.
Selected cipher and OpenVPN implementation.
Whether data-channel offload is available and usable.
UDP or TCP transport.
MTU and packet fragmentation behaviour.
Distance and routing to the VPN server.
VPN server CPU, capacity and current load.
The underlying broadband upload/download capacity and latency.
Techie Broadband practical example: if a 1 Gbps FTTP service is connected through a router that can process only 300 Mbps of OpenVPN traffic, the VPN router becomes the bottleneck even though the broadband line itself can carry more. Replacing the broadband package would not remove that particular limit.
What is OpenVPN Data Channel Offload (DCO)?
Data Channel Offload moves compatible OpenVPN data-channel processing closer to, or into, the operating-system kernel instead of sending every packet through the traditional userspace path. OpenVPN 2.6 introduced broader DCO support, although availability and supported options depend on the operating system, OpenVPN build and configuration.
DCO can reduce processing overhead and improve throughput on supported systems, but it is not a guarantee that every OpenVPN connection will reach line rate. Hardware, server capacity and the rest of the network path still matter.
Why OpenVPN compression is normally a bad idea
OpenVPN's current documentation warns that VPN compression is generally not recommended because compression can create security risks when secrets and attacker-controlled data share a compressed encrypted channel. Modern configurations normally leave compression disabled.
Compression should not be confused with encryption. Compression tries to reduce data size; encryption protects data. Enabling compression is not a way to make OpenVPN 'more encrypted'.
OpenVPN, IPv4, IPv6 and routing
OpenVPN can carry IPv4 and IPv6 traffic, but the result depends on how the VPN server, client routes and DNS are configured. A VPN that tunnels IPv4 does not automatically guarantee that IPv6 is also routed through the same tunnel. For the underlying address families, see What is IPv4? and What is IPv6?.
This matters when testing for 'VPN leaks'. A device can have multiple routes and address families at the same time. The correct diagnostic question is not simply whether the VPN icon says connected, but which routes, DNS resolvers and interfaces are actually being used for the traffic you care about.
Does OpenVPN work behind NAT and CGNAT?
An OpenVPN client can usually establish an outbound connection through ordinary NAT or CGNAT because the client initiates the session to the VPN server. Hosting an OpenVPN server at home is different: inbound reachability depends on the public addressing and forwarding available on your broadband connection.
If you are hosting a server behind a home router, port forwarding may be required. If the broadband service uses CGNAT, ordinary inbound IPv4 port forwarding at your own router may not be enough because the public IPv4 address is shared upstream.
How to troubleshoot a slow or unreliable OpenVPN connection
Establish a non-VPN baseline using wired Ethernet where possible.
Confirm whether the problem affects throughput, latency, packet loss, DNS or only one application.
Test a geographically closer VPN server to reduce route distance.
Try UDP if the deployment permits it and you are currently using TCP.
Check the OpenVPN log for repeated reconnects, TLS errors, cipher negotiation failures or MTU-related warnings.
Confirm the client and server agree on supported data ciphers.
Check MTU and fragmentation if some sites or applications stall while others work.
Check client/router CPU utilisation during a speed test.
Confirm IPv4, IPv6 and DNS are routed as intended.
Test without competing household traffic before blaming the ISP or VPN provider.
A useful diagnostic principle is to change one variable at a time. If the broadband connection is fast without the VPN but slow with it, the next step is to isolate the VPN endpoint, protocol, CPU and route — not automatically assume the access line is faulty.
OpenVPN security checklist
Keep OpenVPN software and the underlying TLS/crypto libraries current.
Use modern TLS and data-channel cipher settings rather than copying old configuration files blindly.
Verify the server identity correctly; do not disable certificate or peer verification simply to make a connection work.
Protect private keys and credentials.
Keep compression disabled unless you have a specific, well-understood requirement.
Restrict server firewall and routing rules to what the VPN actually needs.
Treat the VPN operator or self-hosted server as part of the trust boundary.
OpenVPN FAQs
Is OpenVPN a VPN provider?
No. OpenVPN is software and a VPN protocol. Commercial VPN providers may use OpenVPN as one of their connection protocols, while businesses and individuals can also run their own OpenVPN servers.
Is OpenVPN free?
The OpenVPN Community Edition is open-source software. OpenVPN Inc also offers commercial products and services, so 'OpenVPN' can refer to both the open-source project and products built around the technology.
Is OpenVPN better than WireGuard?
Not universally. OpenVPN offers extensive configurability and compatibility; WireGuard prioritises a smaller, simpler protocol design. The better choice depends on the deployment, hardware, network restrictions, management requirements and performance goals.
What port does OpenVPN use?
OpenVPN is configurable and is not restricted to one port. Port 1194 is commonly associated with OpenVPN, but deployments can use other ports and either UDP or TCP.
Does OpenVPN change my public IP address?
For traffic routed through a remote VPN server, internet services normally see the public IP address used by that VPN endpoint rather than the public IP address of your local broadband connection. Split-tunnel traffic that bypasses the VPN can behave differently.
Can OpenVPN use IPv6?
Yes. OpenVPN supports IPv6, but IPv6 routing must be configured correctly on the client and server. Do not assume an IPv4 VPN configuration automatically tunnels every IPv6 flow.
Key takeaway
OpenVPN is a mature, flexible VPN protocol and software platform that uses TLS for control-channel security and negotiated encryption for tunnel data. It can run over UDP or TCP, support many network designs and work across a wide range of devices. That flexibility comes with configuration and processing overhead, so real-world security and performance depend on the actual cipher policy, routing, MTU, hardware, server, broadband path and operational setup — not merely on the fact that OpenVPN is connected.
To explore the related technical concepts used in this OpenVPN guide, visit our broadband terminology guide.
