Anyone using Data Channel Offload (OVPN-DCO) on any of your client devices/networks yet?

[JTnola]

Anyone using Data Channel Offload (OVPN-DCO) on any of your client devices/networks yet?

 

[sfx2000]

No... it's still experimental...

GitHub - OpenVPN/ovpn-dco: OpenVPN Data Channel Offload in the linux kernel

OpenVPN Data Channel Offload in the linux kernel. Contribute to OpenVPN/ovpn-dco development by creating an account on GitHub.

github.com

 

[RMerlin]

No... it's still experimental...

It's no longer experimental since the release of OpenVPN 2.6.0 a few months ago.

 

[sfx2000]

It's no longer experimental since the release of OpenVPN 2.6.0 a few months ago.

It's still in net-next over in kernel land...

I'll consider it not experimental when it gets merged...

 

[avtella]

I was thinking of trying it in pfsense as it allows OpenVPN to leverage Intel’s QAT.

 

[sfx2000]

I was thinking of trying it in pfsense as it allows OpenVPN to leverage Intel’s QAT.

It's a linux kernel module, so I don't see this directly applicable to pfSense, which is BSD based...

Also note that QAT (QuickAssist) in pfSense needs specific hardware, for example, C2*** isn't supported in pfSense for QAT as it's too old - Intel made changes at the HW level with more recent chips...

 

[avtella]

I have a C3758R which has the supported QAT and pfsense supports DCO as of 22.05 and the option is in the default OpenVPN (2.6.2 on pf+ 23.05) package.

Virtual Private Networks — OpenVPN — OpenVPN Data Channel Offload (DCO) | pfSense Documentation

docs.netgate.com

 

[RMerlin]

It's still in net-next over in kernel land...

You don`t need to be mainlined in the linux kernel to be considered "not experimental". Plenty of device drivers aren't mainlined yet they are still considered "stable" by their developers. And also there are things that are mainlined and yet carry the EXPERIMENTAL kconfig flag.

Mainlining isn`t only determined by the release state of the code, it can sometimes be based on interest by the kernel maintainer, timing, etc...

Also, Linux ain't the only platform out there that supports DCO. If I remember, DCO is enabled by default on the Windows client as of 2.6.0. Which means in the eyes of the DCO developers, it's release-ready.

 

[sfx2000]

You don`t need to be mainlined in the linux kernel to be considered "not experimental". Plenty of device drivers aren't mainlined yet they are still considered "stable" by their developers. And also there are things that are mainlined and yet carry the EXPERIMENTAL kconfig flag.

So when can we expect it to be merged into AsusWRT-RMerlin?

 

[sfx2000]

So when can we expect it to be merged into AsusWRT-RMerlin?

And while you're at it - might consider ksmbd - smb3 support as a kernel module

KSMBD - SMB3 Kernel Server — The Linux Kernel documentation

GitHub - namjaejeon/ksmbd: ksmbd kernel server(SMB/CIFS server)

ksmbd kernel server(SMB/CIFS server). Contribute to namjaejeon/ksmbd development by creating an account on GitHub.

github.com

just saying...

 

[avtella]

Here’s the DCO platform support/restrictions table from the OpenVPN website:

 

[sfx2000]

Sounds like they're trying to compete and stay relevant now that WG is out there...

Which in some ways... their strength was portability as they were userland, so straightforward to port on to any platform, and low maint once the port was done, as those API's don't change very often.

Touching the kernel - API's can and do change very often inside the kernel - so more work for them...

 

[RMerlin]

So when can we expect it to be merged into AsusWRT-RMerlin?

Kernel 5.2+ is required.

 

[RMerlin]

And while you're at it - might consider ksmbd - smb3 support as a kernel module

Already did, long ago. Requires a newer kernel than what the newest SDK uses.

 

[sfx2000]

Kernel 5.2+ is required.

to restate...

No...

 

[sfx2000]

Already did, long ago. Requires a newer kernel than what the newest SDK uses.

And again - not there either,,,

 

[sfx2000]

Which goes back to my original point about OPVN-DCO...

No... not supported

 

[RMerlin]

Which goes back to my original point about OPVN-DCO...

No... not supported

OP never said he wanted to use it with an Asuswrt router, he simply asked in general if anyone had been using it.

 

[avtella]

I did some iperf testing today with and without DCO on pfsense with an OpnVPN Windows client (seems DCO is enabled by default on the app), so far I didn't see much difference.

 

[RMerlin]

so far I didn't see much difference.

It depends on where the bottleneck is. If the bottleneck is the CPU, then DCO will help get higher throughput. But if the bottleneck is your WAN link, then DCO might only help in reduce CPU usage.