▲ 35 ▼ Mullvad: Reminder that OpenVPN is being removed January 15th 2026 (mullvad.net) submitted 1 year ago by cm0002@piefed.world to c/privacy@programming.dev 12 comments fedilink hide all child comments
[–] Scoopta@programming.dev 4 points 1 year ago (9 children) Why must everyone be removing OVPN 🙁 permalink fedilink source hideshow 9 child comments replies: [–] tatterdemalion@programming.dev 9 points 1 year ago (2 children) Because wireguard is vastly better. permalink fedilink source parent hideshow 2 child comments replies: [–] Scoopta@programming.dev 1 point 1 year ago (1 child) It isn't in a lot of ways permalink fedilink source parent hideshow 1 child comment replies: [–] tatterdemalion@programming.dev 1 point 1 year ago* How so? EDIT: I see you've already elaborated in other comments. permalink fedilink source parent [–] cellardoor@lemmy.world 4 points 1 year ago (3 children) It is inefficient in both tunnel and transport mode, sacrificing 20-30% of available bandwidth. It is cryptographically expensive, making your clients work harder and costing the VPN provider more money to host nodes. It is complex to setup and deploy. Uses outdated crypto. Operates in Userspace. WireGuard is essentially better in every one of these regards. permalink fedilink source parent hideshow 3 child comments replies: [–] Scoopta@programming.dev 2 points 1 year ago* (2 children) OpenVPN operates in kernel space as of 6.16. Well specifically for the data channel. Control channel is still managed in userspace so you don't have to do asymmetric TLS in the kernel. This also reduces the overhead and increases performance substantially. It is slightly more complicated to setup but barely tbh (I'm speaking from the server side). Is the crypto outdated? Not as far as I'm aware. permalink fedilink source parent hideshow 2 child comments replies: [–] ISO@lemmy.zip 2 points 1 year ago (1 child) And user-space implementations of WireGuard are used a lot anyway, especially on mobile. Every VPN provider app ships with one, at least as a backup (It's wireguard-go usually since boringtun is not well maintained). permalink fedilink source parent hideshow 1 child comment replies: [–] Scoopta@programming.dev 1 point 1 year ago Yeah, I'm just pointing out that OpenVPN has a kernel implementation since it does seem to make quite a large performance difference when available. permalink fedilink source parent [–] Turret3857@infosec.pub 3 points 1 year ago* (last edited 2 days ago) (1 child) . permalink fedilink source parent hideshow 1 child comment replies: [–] Scoopta@programming.dev 3 points 1 year ago The big thing for public VPNs is the server can push the configuration to the client rather than having it be static. Config push, specifically for addressing is basically the only viable way to do a NATless VPN. Additionally while unrelated to public VPN providers wg does not have the ability to bind to individual IPs which is a headache for my internal VPN use case. permalink fedilink source parent
[–] tatterdemalion@programming.dev 9 points 1 year ago (2 children) Because wireguard is vastly better. permalink fedilink source parent hideshow 2 child comments replies: [–] Scoopta@programming.dev 1 point 1 year ago (1 child) It isn't in a lot of ways permalink fedilink source parent hideshow 1 child comment replies: [–] tatterdemalion@programming.dev 1 point 1 year ago* How so? EDIT: I see you've already elaborated in other comments. permalink fedilink source parent
[–] Scoopta@programming.dev 1 point 1 year ago (1 child) It isn't in a lot of ways permalink fedilink source parent hideshow 1 child comment replies: [–] tatterdemalion@programming.dev 1 point 1 year ago* How so? EDIT: I see you've already elaborated in other comments. permalink fedilink source parent
[–] tatterdemalion@programming.dev 1 point 1 year ago* How so? EDIT: I see you've already elaborated in other comments. permalink fedilink source parent
[–] cellardoor@lemmy.world 4 points 1 year ago (3 children) It is inefficient in both tunnel and transport mode, sacrificing 20-30% of available bandwidth. It is cryptographically expensive, making your clients work harder and costing the VPN provider more money to host nodes. It is complex to setup and deploy. Uses outdated crypto. Operates in Userspace. WireGuard is essentially better in every one of these regards. permalink fedilink source parent hideshow 3 child comments replies: [–] Scoopta@programming.dev 2 points 1 year ago* (2 children) OpenVPN operates in kernel space as of 6.16. Well specifically for the data channel. Control channel is still managed in userspace so you don't have to do asymmetric TLS in the kernel. This also reduces the overhead and increases performance substantially. It is slightly more complicated to setup but barely tbh (I'm speaking from the server side). Is the crypto outdated? Not as far as I'm aware. permalink fedilink source parent hideshow 2 child comments replies: [–] ISO@lemmy.zip 2 points 1 year ago (1 child) And user-space implementations of WireGuard are used a lot anyway, especially on mobile. Every VPN provider app ships with one, at least as a backup (It's wireguard-go usually since boringtun is not well maintained). permalink fedilink source parent hideshow 1 child comment replies: [–] Scoopta@programming.dev 1 point 1 year ago Yeah, I'm just pointing out that OpenVPN has a kernel implementation since it does seem to make quite a large performance difference when available. permalink fedilink source parent
[–] Scoopta@programming.dev 2 points 1 year ago* (2 children) OpenVPN operates in kernel space as of 6.16. Well specifically for the data channel. Control channel is still managed in userspace so you don't have to do asymmetric TLS in the kernel. This also reduces the overhead and increases performance substantially. It is slightly more complicated to setup but barely tbh (I'm speaking from the server side). Is the crypto outdated? Not as far as I'm aware. permalink fedilink source parent hideshow 2 child comments replies: [–] ISO@lemmy.zip 2 points 1 year ago (1 child) And user-space implementations of WireGuard are used a lot anyway, especially on mobile. Every VPN provider app ships with one, at least as a backup (It's wireguard-go usually since boringtun is not well maintained). permalink fedilink source parent hideshow 1 child comment replies: [–] Scoopta@programming.dev 1 point 1 year ago Yeah, I'm just pointing out that OpenVPN has a kernel implementation since it does seem to make quite a large performance difference when available. permalink fedilink source parent
[–] ISO@lemmy.zip 2 points 1 year ago (1 child) And user-space implementations of WireGuard are used a lot anyway, especially on mobile. Every VPN provider app ships with one, at least as a backup (It's wireguard-go usually since boringtun is not well maintained). permalink fedilink source parent hideshow 1 child comment replies: [–] Scoopta@programming.dev 1 point 1 year ago Yeah, I'm just pointing out that OpenVPN has a kernel implementation since it does seem to make quite a large performance difference when available. permalink fedilink source parent
[–] Scoopta@programming.dev 1 point 1 year ago Yeah, I'm just pointing out that OpenVPN has a kernel implementation since it does seem to make quite a large performance difference when available. permalink fedilink source parent
[–] Turret3857@infosec.pub 3 points 1 year ago* (last edited 2 days ago) (1 child) . permalink fedilink source parent hideshow 1 child comment replies: [–] Scoopta@programming.dev 3 points 1 year ago The big thing for public VPNs is the server can push the configuration to the client rather than having it be static. Config push, specifically for addressing is basically the only viable way to do a NATless VPN. Additionally while unrelated to public VPN providers wg does not have the ability to bind to individual IPs which is a headache for my internal VPN use case. permalink fedilink source parent
[–] Scoopta@programming.dev 3 points 1 year ago The big thing for public VPNs is the server can push the configuration to the client rather than having it be static. Config push, specifically for addressing is basically the only viable way to do a NATless VPN. Additionally while unrelated to public VPN providers wg does not have the ability to bind to individual IPs which is a headache for my internal VPN use case. permalink fedilink source parent