OpenVPN 2.7 and DCO

This topic is targeted ONLY to OpenVPN users OpenVPN

All AirVPN VPN servers run OpenVPN 2.7 with Data Channel Offload (DCO). The migration announced in 2023 is complete.
DCO moves the OpenVPN data channel into the operating system kernel, while the control channel stays in the OpenVPN process. See more here

Advantages

Packets are encrypted and decrypted inside the kernel, with no copy to and from the OpenVPN process for each packet: higher throughput and lower latency.
Lower CPU usage for the same traffic, and better use of multiple CPU cores.
The server side gains apply to every OpenVPN connection, also from clients that do not use DCO. A client that supports DCO gets the same gains on its own side.

Compatibility: OpenVPN 2.3 is no longer supported

The DCO kernel module does not support AES-CBC. Offering AES-CBC on the Data Channel, even only as a fallback, would make the OpenVPN daemons disable DCO globally, for every client. Therefore our servers accept only AEAD ciphers (AES-GCM, CHACHA20-POLY1305) on the Data Channel.
OpenVPN 2.3 and older versions cannot use these ciphers on the Data Channel, so they can no longer connect. Please run OpenVPN 2.4 or a higher version, linked against an SSL library that supports AES-GCM / CHACHA20-POLY1305. OpenVPN 2.6 or 2.7 is recommended.
If your device is stuck on an old OpenVPN version (for example an old router or NAS firmware), consider WireGuard: it is supported on all our servers.

Config Generator

The default profile of the Config Generator is compatible with DCO: it uses only AEAD ciphers and contains no compression directive. Continent, country and server selection work as usual.
If your device runs OpenVPN 2.4, choose the OpenVPN 2.4 profile in the advanced settings: OpenVPN 2.4 does not understand some directives of the default profile.
If you generated your files a long time ago and your OpenVPN client warns that 'comp-lzo' was deprecated, simply generate them again.

Client side

Linux

OpenVPN 2.7 uses the kernel module ovpn, included in the mainline Linux kernel since version 6.16. On older kernels it can be installed from ovpn-backports. Use

modinfo ovpn

to check whether it is available.
The old ovpn-dco-v2 module works only with OpenVPN 2.6.

Windows

The official OpenVPN 2.6 and 2.7 installers include the ovpn-dco driver and use it by default.

FreeBSD, pfSense, OPNsense

FreeBSD 14 and higher versions include DCO support in the kernel (if_ovpn).

Other systems

On macOS, Android and iOS DCO is not available on the client side. OpenVPN works as before through the standard TUN interface and still benefits from DCO on the server side.

How to know if DCO is in use

When DCO is available, the OpenVPN log reports the DCO version at startup, for example

DCO version: ...

If the log shows

Note: (various reasons): disabling data channel offload.

then DCO is not used on your side, because of your system or of an option that DCO does not support (for example a non-AEAD cipher, or --windows-driver wintun). The connection works anyway, without client-side offload.

WireGuard or OpenVPN?

Both are fully supported on every server. In October 2026, WireGuard carries about 84% of the sessions on our infrastructure and OpenVPN about 16% (24% in March 2026). OpenVPN remains the best choice when you need TCP, or when you need to connect through a proxy or Tor.

Sign In