SoftEther VPN User Forum

Dear VPNGate Team,

I request upgrading the default OpenVPN version to at least 2.6, or preferably 2.7, for performance and security improvements.

VPNGate currently uses OpenVPN 2.0 with AES-128-CBC, which is incompatible with DCO (Data Channel Offload). This prevents DCO from being enabled, causing slow speeds—often under 1 Mbps—on high-bandwidth connections. With DCO enabled in OpenVPN 2.6 and later, speeds improve 3-5 times, especially on Windows and Linux platforms.

Additionally, AES-128-CBC is outdated and vulnerable. OpenVPN 2.7 not only supports DCO by default but also integrates stronger ciphers like AES-256-GCM, offering better security and performance. While TAP-Windows6 is available in 2.7, DCO provides a significant performance advantage.

OpenVPN 2.6 and 2.7 also bring improvements such as better network adapter management on Windows and improved stability. Common Linux distributions (Ubuntu, Debian, CentOS, etc.) support these versions, ensuring compatibility across platforms.

Staying with OpenVPN 2.0 is now a performance bottleneck. Upgrading is necessary for better performance, security, and reliability.

SoftEther supports all OpenVPN client versions but requires a minor "data-ciphers" config change, and SE server v5 also supports AES-256-GCM.

As for DCO, check this log of OpenVPN 2.6.10 connecting to SE v5... So, Windows' OpenVPN client has no driver for DCO anyway (although it can be fixed).