OpenVPN
The veteran TLS-based VPN — runs anywhere, traverses anything, configurable to a fault — now the incumbent that WireGuard is steadily retiring.
What is OpenVPN?
OpenVPN is the open-source VPN that carried a generation of remote access: tunnels built on TLS, running over UDP or — its signature trick — TCP port 443, where it slips through firewalls and captive portals that break IPsec. Two decades of ubiquity mean clients exist for everything, every router vendor embeds it, and its configuration language can express almost any topology, certificate scheme, or routing policy you can imagine.
Strengths that keep it deployed
Middlebox traversal: when the network between you and home is actively hostile (hotel Wi-Fi, national firewalls, corporate proxies), TCP/443 OpenVPN connects where slicker protocols fail. Operational maturity: PKI tooling, RADIUS/LDAP hooks, per-client config, and a commercial ecosystem (Access Server) for enterprises that want support contracts. Flexibility: site-to-site, road-warrior, bridged Ethernet — it does all of it, documented by twenty years of forum posts.
Why WireGuard is winning anyway
The comparison is stark: WireGuard is ~4k lines of kernel code against OpenVPN’s userspace bulk, connects in a round trip where OpenVPN’s TLS negotiation takes several, roams networks without dropping, and typically doubles throughput on the same hardware. OpenVPN’s TCP mode also suffers the classic TCP-over-TCP meltdown under loss — two congestion-control loops fighting — so its best trick is also its worst performance mode. New deployments now default to WireGuard unless firewall traversal or entrenched tooling dictates otherwise; OpenVPN increasingly plays the compatibility fallback.
What people get wrong
- Choosing TCP mode by default “because it always connects” — accept its meltdown behavior knowingly, prefer UDP when possible.
- Static keys and eternal certificates: OpenVPN’s flexibility includes insecure configurations; short-lived certs and revocation discipline still apply.
- Measuring throughput single-threaded — classic OpenVPN is largely single-core; benchmark accordingly before blaming the network.
Primary source: OpenVPN documentation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.