OpenVPN has no DCO

Bugs
1

vyos-2026.08.22-0013-rolling
I am setting up an OpenVPN server:

openvpn vtun0 {
    local-port "1194"
    mode "server"
    offload {
        dco
    }
    server {
        subnet "192.168.2.0/26"
        topology "subnet"
    }
    tls {
        ca-certificate "test"
        certificate "srvr"
    }
}

But OpenVPN does not have DCO enabled. Here is what the log shows:

2026-08-23 14:13:34 Note: Kernel support for ovpn-dco missing, disabling data channel offload.
2026-08-23 14:13:34 OpenVPN 2.6.14 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2026-08-23 14:13:34 library versions: OpenSSL 3.0.20 7 Apr 2026, LZO 2.10
2026-08-23 14:13:34 DCO version: N/A
2026-08-23 14:13:34 MANAGEMENT: unix domain socket listening on /run/openvpn/openvpn-mgmt-intf
2026-08-23 14:13:34 net_route_v4_best_gw query: dst 0.0.0.0
2026-08-23 14:13:34 net_route_v4_best_gw result: via 0.0.0.0 dev
2026-08-23 14:13:34 TUN/TAP device vtun0 opened
2026-08-23 14:13:34 net_iface_mtu_set: mtu 1500 for vtun0
2026-08-23 14:13:34 net_iface_up: set vtun0 up
2026-08-23 14:13:34 net_addr_v4_add: 192.168.224.1/26 dev vtun0

Additionally, OpenVPN version 2.6.14 contains several security vulnerabilities that were fixed in version 2.6.22. It would be a good idea to update the version.

2

I would say that the version is most likely due to whats being available in Debian Bookworm which is currently being used as base.

There is progress to migrate into Debian Trixie but that also uses 2.6.14 of the openvpn-client.

Note however that version alone cannot be trusted since alot is often backported anyway (common issue with some vulnscanner who only look at version number instead of whats actually being vulnerable or not).

Backport to trixie seems to be using version 2.7.5.

It also seems that the DCO module isnt really used any longer?

3

I agree with you regarding the OpenVPN version.

The bug is that OpenVPN fails to detect its modules in the VyOS kernel upon startup.

4

In Stream 2026.03 there is this:

/usr/lib/modules/6.6.128-vyos/extra/ovpn-dco-v2.ko

So perhaps you need to load that manually?

But I can agree that if openvpn config exists the necessary module(s) should get autoloaded.

What does output of this tell you?

sudo bash
lsmod | grep -i dco
5

I’ve found the reason for this.
The VyOS kernel includes a module for OpenVPN 2.7.x but lacks one for 2.6.x.
This means the developers need to either add a module for OpenVPN 2.6.x to the kernel or upgrade the OpenVPN version in the build to 2.7.x.
(If upgrading the version, keep in mind that the behavior of the “multihome” command changed in 2.7.x.)