OpenVPN is an open-source VPN system that builds encrypted tunnels using the TLS protocol, via the OpenSSL library, for authentication and key exchange. It runs in user space and can use either UDP (the default, port 1194) or TCP.
Why it matters
OpenVPN is mature, runs on nearly every platform and is highly configurable: certificates, username and password, or both; routed or bridged modes; and many cipher choices. Because it can run over TCP port 443, it often passes through restrictive firewalls that block other VPNs. Compared with WireGuard, it is usually slower and has a much larger code base, but it offers more features such as pushing routes and DNS settings to clients.
Running a VPN over TCP can cause "TCP meltdown", where retransmissions at both layers worsen congestion, so UDP is preferred when possible.
Example
A client profile (client.ovpn) might contain:
client
dev tun
proto udp
remote vpn.example.com 1194
cipher AES-256-GCMThe client reads its certificate and key, connects, and receives a tunnel address such as 10.8.0.6.
Common mistakes
- Defaulting to TCP when UDP would work.
- Leaving old certificates valid after an employee leaves instead of revoking them.
- Using outdated ciphers from old example configs.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.