Are there any plans to upgrade more servers than Telescopium (Canada) and Marsic (Serbia) to OpenVPN 2.6 CDO?

[d1d1d1 0]

Since these servers have been upgraded with the beta test of 2023, and afterward no other migrations have happened.
CDO offers vastly improved speed, to the point where it can even be faster than Wireguard.

[Tech Jedi Alex 1501]

You can use DCO yourself, though, without the server supporting it. This alone can be an improvement, too.
In any case, the servers would need to run kernel 6.16+ and OpenVPN 2.7 (which is in alpha currently) to use the ovpn kernel module. The older ovpn-dco DKMS module is experimental at best, and I believe no longer in development now that DCO is in the kernel. I think the global rollout will not happen before the second half of 2026 or even later, depending on the OS the servers run (if it's Debian, you'd wait for Debian 14 in 2027 as the recently released 13 ships kernel 6.12).

[go558a83nk 380]

2 hours ago, Tech Jedi Alex said:

You can use DCO yourself, though, without the server supporting it. This alone can be an improvement, too.
In any case, the servers would need to run kernel 6.16+ and OpenVPN 2.7 (which is in alpha currently) to use the ovpn kernel module. The older ovpn-dco DKMS module is experimental at best, and I believe no longer in development now that DCO is in the kernel. I think the global rollout will not happen before the second half of 2026 or even later, depending on the OS the servers run (if it's Debian, you'd wait for Debian 14 in 2027 as the recently released 13 ships kernel 6.12).

What's the trick for this?  If I connect to a "non-DCO" server with a DCO client no traffic seems to pass in the tunnel.

[Tech Jedi Alex 1501]

On 11/3/2025 at 2:17 AM, go558a83nk said:

What's the trick for this?  If I connect to a "non-DCO" server with a DCO client no traffic seems to pass in the tunnel.

I've been having the same thing on Arch Linux since ovpn-dco-dkms was available, but since OpenVPN's documentation itself says that a non-DCO server can serve DCO clients and vice versa, I think it's got something to do with my client config somewhere.
Anyway, since I've got an OpenVPN server running myself, I'll think about compiling 2.7 there and on the client and test a "full" DCO setup this way.

[Tech Jedi Alex 1501]

On 11/3/2025 at 2:17 AM, go558a83nk said:

What's the trick for this?  If I connect to a "non-DCO" server with a DCO client no traffic seems to pass in the tunnel.

 

On 11/6/2025 at 7:52 PM, Tech Jedi Alex said:

Anyway, since I've got an OpenVPN server running myself, I'll think about compiling 2.7 there and on the client and test a "full" DCO setup this way. 

Well well, look at that, OpenVPN 2.7_beta3 (which apparently is rc1 according to --version) on both server and client with DCO enabled works.. the speedtest results are a bit inconclusive, though.
OpenVPN v4 DCO:

$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Starry, Inc. (New York, NY) [5888.13 km]: 109.055 ms
Testing download speed................................................................................
Download: 44.17 Mbit/s
Testing upload speed......................................................................................................
Upload: 6.76 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Pilot Fiber (New York, NY) [5888.13 km]: 103.502 ms
Testing download speed................................................................................
Download: 29.70 Mbit/s
Testing upload speed......................................................................................................
Upload: 14.09 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Pilot Fiber (New York, NY) [5888.13 km]: 104.789 ms
Testing download speed................................................................................
Download: 17.22 Mbit/s
Testing upload speed......................................................................................................
Upload: 10.08 Mbit/s

Wireguard v4:

$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by PVDataNet (New York, NY) [5888.13 km]: 110.869 ms
Testing download speed................................................................................
Download: 6.73 Mbit/s
Testing upload speed......................................................................................................
Upload: 30.61 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by PVDataNet (New York, NY) [5888.13 km]: 109.895 ms
Testing download speed................................................................................
Download: 21.84 Mbit/s
Testing upload speed......................................................................................................
Upload: 33.43 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Pilot Fiber (New York, NY) [5888.13 km]: 104.929 ms
Testing download speed................................................................................
Download: 21.62 Mbit/s
Testing upload speed......................................................................................................
Upload: 44.56 Mbit/s

So, uuh.. my VPN server is maybe not the best benchmark. OpenVPN measured the highest download throughput in one test, but otherwise Wireguard seems to have higher and more consistent upload throughput. Latency is comparable.

[go558a83nk 380]

So you weren't able to connect to an AirVPN server and test even yet?  I wish I knew why no data flows if I try DCO on my end.  I can connect to another VPN provider and it works well.

I think it's expected that once DCO rolls out to server and client the speed is as good or better than wireguard.

 

[Tech Jedi Alex 1501]

12 minutes ago, go558a83nk said:

I wish I knew why no data flows if I try DCO on my end

I wish I knew myself. Don't really know how to troubleshoot this, either.
 

9 minutes ago, go558a83nk said:

I think it's expected that once DCO rolls out to server and client the speed is as good or better than wireguard.

Might be comparable, but probably not better. From the roadmap I surmise that OpenVPN 2 will still be a single-core application as multithreading is not found in the feature list, so this bottleneck will persist. Conclusive tests must be done once 2.7 is stable and rolled out to some test servers.

For now, I lost interest in finding out why DCO <> non-DCO doesn't work as my OpenVPN setup is now DCO <> DCO.  Still using Wireguard primarily, though.