OpenVPN

term

securitynetworking

An open-source tunnel that runs its own protocol over UDP or TCP using TLS for key exchange, independent of any vendor's appliance.

It occupies the space between the two families: like an SSL VPN it can hide inside port 443 and traverse restrictive networks, and like IPsec it is a full network tunnel with no web application in front of it. That combination, plus an implementation that runs on everything and is auditable by anyone, made it the default for people who did not want to buy a concentrator - community and commercial VPN services, small offices, and laboratories. The cost is throughput, because the data path runs in user space and each packet crosses the kernel boundary, and configuration surface, because the flexibility that makes it portable also makes it easy to deploy badly. It is the reference point against which WireGuard's argument about size is usually made.

Also known as: openvpn, tun/tap vpn

Sources

OpenVPN community documentation: OpenVPN uses the OpenSSL library for cryptography and can run over UDP or TCP, with the TLS handshake used to establish the session keys

← All glossary entries