OpenVPN

Last reviewed Aug 26, 2026 · 803 words

The reason to run OpenVPN in 2026 is TCP port 443. Hotel, airport, corporate and university networks that block everything else still pass what looks like HTTPS, and OpenVPN over TCP 443 with tls-crypt looks enough like HTTPS to get through where WireGuard's UDP packets die quietly. For every other use, WireGuard is faster, simpler and the default I recommend. But "works from anywhere" is a real requirement, OpenVPN has served it since 2001, and a modern install is 10 minutes, not the weekend its Hard rating implies.

Skip Easy-RSA on day one; use an install script

OpenVPN's difficulty comes from its PKI. Every client needs a certificate signed by your CA, and doing that by hand with Easy-RSA teaches you a lot and delays a working tunnel by hours. The community install scripts (Nyr's openvpn-install and angristan's fork are the well-known ones) ask 6 questions, generate the CA, server cert, tls-crypt key and a first client .ovpn, and configure the firewall. On a fresh Debian or Ubuntu VPS:

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
sudo ./openvpn-install.sh

Pick UDP 1194 for speed if your clients will be on friendly networks, or TCP 443 if the whole point is hostile ones. Re-run the script to add or revoke clients; it maintains the CRL for you. Learn Easy-RSA later, when you need certificate lifetimes or an offline CA.

The 3 settings that decide throughput

OpenVPN's reputation for being slow is partly earned and partly old configs. Three lines in server.conf matter most. First, data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305: GCM modes are hardware-accelerated on anything with AES-NI, and ChaCha20 wins on Raspberry Pi class ARM without it. Second, protocol: UDP is materially faster than TCP because TCP-over-TCP retransmits fight each other; only pay for TCP when you need port 443. Third, OpenVPN 2.6 added Data Channel Offload, a kernel module (openvpn-dco) that moves packet encryption out of userspace and closes much of the gap to WireGuard on Linux servers with Linux or Windows clients. Install the openvpn-dco-dkms package and the server picks it up when the cipher list is GCM or ChaCha20 only.

Idle RAM is tiny; the catalogue's 128 MB is generous. A 1 vCPU VPS moves 100 to 300 Mbit/s through a tuned tunnel, which is more than most home uplinks.

Site-to-site, LDAP and the corporate features

This is where OpenVPN still has no free peer. Site-to-site between 2 routers with client-config-dir and iroute pushes whole subnets across the tunnel and has been stable for 2 decades. Username and password auth against LDAP or Active Directory comes via plugin openvpn-plugin-auth-pam.so or the LDAP plugin, and 2-factor with TOTP is a PAM module away. Per-client static IPs, per-client routes, push "dhcp-option DNS" to hand out your Pi-hole address: all of it is config-file work, which is the "complex configuration" con and also why it is the Cisco AnyConnect replacement the catalogue names.

Note the split: the GPL-2.0 community edition is what the script installs. OpenVPN Access Server is the company's commercial product with a web UI; at last check it allows 2 concurrent connections free and charges per connection above that. The community edition has no limit and no UI, and a self-hoster rarely needs the UI.

Where WireGuard and Tailscale win

For "reach my homelab from my phone", wg-easy gives you WireGuard with a web page for adding peers in 5 minutes, roams between Wi-Fi and cellular without reconnecting, and drains far less battery. For "connect all my devices to each other", Tailscale or self-hosted Headscale do NAT traversal and key distribution that OpenVPN never will; the Headscale vs Tailscale piece covers which. OpenVPN's remaining edge is the port-443 case, the LDAP case, and the fact that every router firmware and every corporate laptop policy has a client for it.

What I'd do

Two tunnels, not one. WireGuard via wg-easy as the daily driver for all devices. Alongside it, OpenVPN on TCP 443 with tls-crypt, DCO enabled, GCM ciphers, installed by the angristan script on the same VPS, as the tunnel that works from the hotel with the hostile captive portal. Revoke and reissue client certs yearly, keep the CA key off the server if you ever move past the script, and browse the rest of the remote-access category before adding a third.