Are there any plans to upgrade more servers than Telescopium (Canada) and Marsic (Serbia) to OpenVPN 2.6 CDO?

[d1d1d1 0]

Since these servers have been upgraded with the beta test of 2023, and afterward no other migrations have happened.
CDO offers vastly improved speed, to the point where it can even be faster than Wireguard.

[Tech Jedi Alex 1501]

You can use DCO yourself, though, without the server supporting it. This alone can be an improvement, too.
In any case, the servers would need to run kernel 6.16+ and OpenVPN 2.7 (which is in alpha currently) to use the ovpn kernel module. The older ovpn-dco DKMS module is experimental at best, and I believe no longer in development now that DCO is in the kernel. I think the global rollout will not happen before the second half of 2026 or even later, depending on the OS the servers run (if it's Debian, you'd wait for Debian 14 in 2027 as the recently released 13 ships kernel 6.12).

[go558a83nk 380]

2 hours ago, Tech Jedi Alex said:

You can use DCO yourself, though, without the server supporting it. This alone can be an improvement, too.
In any case, the servers would need to run kernel 6.16+ and OpenVPN 2.7 (which is in alpha currently) to use the ovpn kernel module. The older ovpn-dco DKMS module is experimental at best, and I believe no longer in development now that DCO is in the kernel. I think the global rollout will not happen before the second half of 2026 or even later, depending on the OS the servers run (if it's Debian, you'd wait for Debian 14 in 2027 as the recently released 13 ships kernel 6.12).

What's the trick for this?  If I connect to a "non-DCO" server with a DCO client no traffic seems to pass in the tunnel.

[Tech Jedi Alex 1501]

On 11/3/2025 at 2:17 AM, go558a83nk said:

What's the trick for this?  If I connect to a "non-DCO" server with a DCO client no traffic seems to pass in the tunnel.

I've been having the same thing on Arch Linux since ovpn-dco-dkms was available, but since OpenVPN's documentation itself says that a non-DCO server can serve DCO clients and vice versa, I think it's got something to do with my client config somewhere.
Anyway, since I've got an OpenVPN server running myself, I'll think about compiling 2.7 there and on the client and test a "full" DCO setup this way.

[Tech Jedi Alex 1501]

On 11/3/2025 at 2:17 AM, go558a83nk said:

What's the trick for this?  If I connect to a "non-DCO" server with a DCO client no traffic seems to pass in the tunnel.

 

On 11/6/2025 at 7:52 PM, Tech Jedi Alex said:

Anyway, since I've got an OpenVPN server running myself, I'll think about compiling 2.7 there and on the client and test a "full" DCO setup this way. 

Well well, look at that, OpenVPN 2.7_beta3 (which apparently is rc1 according to --version) on both server and client with DCO enabled works.. the speedtest results are a bit inconclusive, though.
OpenVPN v4 DCO:

$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Starry, Inc. (New York, NY) [5888.13 km]: 109.055 ms
Testing download speed................................................................................
Download: 44.17 Mbit/s
Testing upload speed......................................................................................................
Upload: 6.76 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Pilot Fiber (New York, NY) [5888.13 km]: 103.502 ms
Testing download speed................................................................................
Download: 29.70 Mbit/s
Testing upload speed......................................................................................................
Upload: 14.09 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Pilot Fiber (New York, NY) [5888.13 km]: 104.789 ms
Testing download speed................................................................................
Download: 17.22 Mbit/s
Testing upload speed......................................................................................................
Upload: 10.08 Mbit/s

Wireguard v4:

$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by PVDataNet (New York, NY) [5888.13 km]: 110.869 ms
Testing download speed................................................................................
Download: 6.73 Mbit/s
Testing upload speed......................................................................................................
Upload: 30.61 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by PVDataNet (New York, NY) [5888.13 km]: 109.895 ms
Testing download speed................................................................................
Download: 21.84 Mbit/s
Testing upload speed......................................................................................................
Upload: 33.43 Mbit/s
$ speedtest
Retrieving speedtest.net configuration...
Testing from Unknown (x)...
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by Pilot Fiber (New York, NY) [5888.13 km]: 104.929 ms
Testing download speed................................................................................
Download: 21.62 Mbit/s
Testing upload speed......................................................................................................
Upload: 44.56 Mbit/s

So, uuh.. my VPN server is maybe not the best benchmark. OpenVPN measured the highest download throughput in one test, but otherwise Wireguard seems to have higher and more consistent upload throughput. Latency is comparable.

[go558a83nk 380]

So you weren't able to connect to an AirVPN server and test even yet?  I wish I knew why no data flows if I try DCO on my end.  I can connect to another VPN provider and it works well.

I think it's expected that once DCO rolls out to server and client the speed is as good or better than wireguard.

 

[Tech Jedi Alex 1501]

12 minutes ago, go558a83nk said:

I wish I knew why no data flows if I try DCO on my end

I wish I knew myself. Don't really know how to troubleshoot this, either.
 

9 minutes ago, go558a83nk said:

I think it's expected that once DCO rolls out to server and client the speed is as good or better than wireguard.

Might be comparable, but probably not better. From the roadmap I surmise that OpenVPN 2 will still be a single-core application as multithreading is not found in the feature list, so this bottleneck will persist. Conclusive tests must be done once 2.7 is stable and rolled out to some test servers.

For now, I lost interest in finding out why DCO <> non-DCO doesn't work as my OpenVPN setup is now DCO <> DCO.  Still using Wireguard primarily, though.

[EMULE 4]

I believe AirVPN is awaiting the official release of the OpenVPN 2.7 series. The OpenVPN 2.7 series DCO adds dual-side acceleration for both the server and client, while the 2.6 series DCO only supports single-side acceleration for either the server or client. Furthermore, OpenVPN removed support for Wintun in the 2.7 series; future OpenVPN 2.7 series servers will only use the DCO driver. Let's wait patiently for a few more months.

[EMULE 4]

I think the DCO driver support in the OpenVPN 2.6 series is incomplete. The 2.6 series DCO server can serve non-DCO clients, but non-DCO servers cannot serve DCO clients. This is the result of my multiple attempts, after all, I am not a professional.

[Tech Jedi Alex 1501]

13 hours ago, EMULE said:

The 2.6 series DCO server can serve non-DCO clients, but non-DCO servers cannot serve DCO clients.

Is this a fact, or simply your own observations? I've made the same observations with the in-kernel ovpn module, so I don't think it has anything to do with how complete the ovpn-dco-v2 out-of-tree module was.
 

14 hours ago, EMULE said:

The OpenVPN 2.7 series DCO adds dual-side acceleration for both the server and client, while the 2.6 series DCO only supports single-side acceleration for either the server or client

Would you kindly link to some documentation outlining exactly this? OpenVPN blogged about throughput once and clearly outlined results for DCO <> non-DCO setups, so it must be possible somehow.

[EMULE 4]

9 hours ago, Tech Jedi Alex said:

Is this a fact, or simply your own observations? I've made the same observations with the in-kernel ovpn module, so I don't think it has anything to do with how complete the ovpn-dco-v2 out-of-tree module was.
 
Would you kindly link to some documentation outlining exactly this? OpenVPN blogged about throughput once and clearly outlined results for DCO <> non-DCO setups, so it must be possible somehow.

This is merely my observation. I don't understand the code. I feel that DCO should be compatible with Tap and Tun. Could this be due to some directives in the OVPN configuration file being incompatible with DCO?

I learned about the dual-side acceleration for both servers and clients from the update notes of the ovpn-dco-win 2.x series. The 2.x series explicitly added a DCO server mode, while the 1.x series defaulted to client mode. Since two modes have been introduced, dual-side acceleration must have been implemented. The OpenVPN 2.7 series on Windows uses the ovpn-dco-win 2.x series driver, while the previous 2.6 series used the 1.x series driver. Comparing 1.0.0...2.4.0 · OpenVPN/ovpn-dco-win · GitHub