Any plans to support OpenVPN DCO with 2.7.0?

[meruserasus]

Hi,

With OpenVPN 2.7.0, they state that there are backports to current kernels via https://github.com/OpenVPN/ovpn-backports and am just wondering if anything has changed since old 2.6.0 thread asking about DCO support and it it would be now easier to support OpenVPN DCO on newer routers?

 

[RMerlin]

DCO requires at least kernel 5.x, Broadcom's newest models are still under 4.19. DCO is not possible, it relies on low level kernel features that do not exist in 4.19.

 

[meruserasus]

DCO requires at least kernel 5.x, Broadcom's newest models are still under 4.19. DCO is not possible, it relies on low level kernel features that do not exist in 4.19.

Is there anything the community could do? Like message someone at broadcom en masse or anything?

 

[Tech9]

Is there anything the community could do?

The chance to see kernel version change on an embedded device for the entire life of the product is close to zero. Your best chance for this to happen is OpenWrt project or full blown Linux based OS like pfSense, OPNsense, Arista NG, Sophos XG, UniFi OS, etc. on purposely built appliance.

 

[elorimer]

GL-iNet is claiming 1G over OpenVPN and 1.1G over Wireguard for its Beryl 7. The Flint series is less, but more than any Asus router. If you need/can use that speed that is an alternative. Asus needs to kick Broadcom (maybe in both senses).

 

[RMerlin]

Is there anything the community could do? Like message someone at broadcom en masse or anything?

No. kernel versions don't get changed in the middle of a product's lifecycle because it would break everything else that's tied to the previous kernel. In Asus's case, it would break compatibility with BWDPI, HNS, Tuxera and ARK, which are all based on kernel modules tied to a specific kernel version.

It's possible the SDK does support newer kernel versions, but due to the other depdencies it's not something that Asus could easily switch to.

 

[xwildx]

I confirm that the backport project works on RHEL 8 with OpenVPN 2.7, which uses the 4.18 kernel.

I believe the newer ASUS routers are running kernel 4.19. I’m not sure whether anything can be done in that case, but the new backport project with OpenVPN 2.7 support kernel versions 4.18 and later.

 

[RMerlin]

I confirm that the backport project works on RHEL 8 with OpenVPN 2.7, which uses the 4.18 kernel.

I believe the newer ASUS routers are running kernel 4.19. I’m not sure whether anything can be done in that case, but the new backport project with OpenVPN 2.7 support kernel versions 4.18 and later.

Red Hat's kernel is heavily patched and contains tons of upstream backports. That's why it's compatible, it's far from being a vanilla kernel.

That DCO backport is hardly "new", I have been keeping an eye on it for close to a year now.

 

[kernol]

With WireGuard fully available in most reputable VPN service providers and is now native to recent Asus Routers ... why continue to use OpenVPN? Not being cheeky to OpenVPN loyalists [I was one too] - just genuinely curious ... ?

 

[Tech9]

It's kernel, not kernol.

 

[kernol]

It's kernel, not kernol.

View attachment 70310

It's gotta be more than POTAYTO POTAHTO ...

 

[RMerlin]

With WireGuard fully available in most reputable VPN service providers and is now native to recent Asus Routers ... why continue to use OpenVPN? Not being cheeky to OpenVPN loyalists [I was one too] - just genuinely curious ... ?

OpenVPN is far more flexible, also easier to manage/troubleshoot. I still prefer to use OpenVPN for my remote access.