OpenVPN

What Is OpenVPN?

You want a VPN connection you can actually control—one that isn’t tied to a single consumer VPN brand, and that can run on your own infrastructure (cloud VM, on‑prem box, or a lab server). That’s the niche OpenVPN fills best: it’s a widely used VPN protocol and open-source implementation, plus a commercial “packaged” server product (Access Server) that wraps the same core tech with a management UI and business features.

This matters if your goal is remote access to private networks, site-to-site connectivity, or secure tunnels for devices you manage—not “one click and pick a country” consumer VPN apps. OpenVPN Connect (the official client app) is also explicit about what it is: it connects to an OpenVPN-compatible server, but it does not provide a VPN service by itself.

What makes OpenVPN distinctive is reach and portability: it’s a common denominator protocol across many VPN providers and self-hosted setups, and it can run over UDP or TCP (useful when you’re dealing with restrictive networks). It’s also licensed as GPL open source at the core, so the protocol implementation is publicly inspectable and widely integrated.

OpenVPN Features and Performance

OpenVPN, in the way most people use it today, is really a stack:

• OpenVPN Community Edition (CE): the free, open-source core project (client/server) you configure yourself (mostly CLI-driven).
• OpenVPN Access Server (commercial): a self-hosted server product built around the open-source OpenVPN core, adding an Admin Web UI, subscription licensing, and enterprise-style capabilities.
• OpenVPN Connect: the official client used to connect to OpenVPN protocol servers; it’s a connector, not a VPN service.

Protocol support (what you’re actually getting)

For VPNSpotter’s purposes, the key spec is protocol coverage. Your database lists OpenVPN and IPsec. Here’s the “No BS” framing: OpenVPN (the project/protocol) is its own thing; it’s not “IPsec compatible” in the sense of speaking the IPsec protocol on the wire. That distinction is widely documented in general references on OpenVPN.

So when you see “OpenVPN + IPsec” in product listings, it typically means the vendor ecosystem supports both protocols across their product line, or you can run OpenVPN alongside IPsec in the same environment (for different use-cases), not that OpenVPN is secretly IPsec. If you’re evaluating OpenVPN as a protocol/implementation, the reliable, source-backed claim is: OpenVPN Connect is designed for OpenVPN-protocol servers and profiles.

Performance characteristics (where OpenVPN historically got dinged)

Classic OpenVPN 2.x deployments have long been associated with performance limits under high throughput—especially when everything is processed in user space and when a single process becomes a bottleneck. That’s not a moral failing; it’s an architecture trade-off.

OpenVPN’s answer in its commercial Access Server track is Data Channel Offload (DCO), which moves data-channel packet handling (including encryption/decryption work) into kernel space to reduce copies/context switches and improve scalability. OpenVPN’s documentation is clear on the “why”: it’s designed for better performance and scalability, and it specifically calls out more efficient multi-threading and reduced CPU overhead.

The community wiki on DCO is even more blunt about what it’s fixing: bouncing packets kernel↔userspace and pushing client traffic through a single-threaded userspace process are known limiting factors for OpenVPN 2.x performance.

Deployment and management features (Access Server vs CE)

If you’re a hands-on admin, CE gives you full control—but you own the complexity. OpenVPN itself draws a bright line between Community Edition (free, CLI, community support) and Access Server (paid/self-hosted, Web UI/API, official support).

Access Server also supports operational features expected in business deployments: it’s explicitly a Linux server product (with virtualized/cloud deployment options), and it includes management via an Admin Web UI.

Simultaneous connections (important: what “2” really means)

Your verified spec says simultaneous connections: 2, which lines up exactly with OpenVPN Access Server’s free tier / unlicensed mode: OpenVPN states that Access Server is free to install and use with two simultaneous VPN connections, with no time limit, and otherwise the same features as paid—just capped by concurrency.

OpenVPN also clarifies the licensing metric: “connections” means simultaneous, active connections (devices online at once), not total users/devices defined in the system.

Pricing and Plans

OpenVPN pricing depends on which “OpenVPN” you mean.

Community Edition (CE)

OpenVPN Community Edition is described by OpenVPN as a free, open-source project maintained by a global community. If you can run and manage it, the software cost is effectively $0 (your hosting, ops time, and support are on you).

Access Server (self-hosted commercial)

OpenVPN Access Server uses a connection-based subscription model:

• Free plan: up to 2 simultaneous connections, “use it free forever,” and OpenVPN’s pricing page states there are no functional differences besides the connection limit (all features available).
• Growth plan: priced per connection. OpenVPN’s pricing page shows a cost per connection of $7/month (and presents an annual billing example).
• Enterprise & IoT: custom pricing for larger requirements.

There is also a 14-day trial flow on the pricing page that allows more connections during evaluation, and then the account converts to the Free plan with two connections if you don’t upgrade.

Refunds / cancellation

OpenVPN’s published legal/terms state a 30-day refund window for canceling an OpenVPN subscription (request within 30 days of purchase), with important caveats for certain license types and renewal situations.

For Access Server specifically, the Access Server EULA also describes refund constraints around activation keys (refund within 30 days, and conditions around activation), so if refunds matter, read the exact document terms before buying.

Privacy and Security Assessment

This section is where OpenVPN gets misunderstood. OpenVPN is primarily a protocol/implementation and self-hosted server product, not a consumer VPN provider promising “no logs.” Privacy outcomes depend heavily on who runs your server (you vs an employer vs a VPN provider) and how it’s configured.

Open-source posture and auditability

OpenVPN’s core project is described by OpenVPN as an open-source GPL project. The code and license terms are public (including the GPL-2.0 licensing posture in the repository).

On third-party security review: OpenVPN has published results of an independent audit of OpenVPN v2.7 performed by Security Research Labs (SRLabs), including a referenced full report.

OpenVPN also documents earlier audit work (OSTIF-funded) where OpenVPN 2.4.0 was independently audited and findings (including DoS-class issues) were fixed in subsequent releases.

Net: OpenVPN’s security story is not “trust us.” It’s “the code is public, and it has received third-party audits at multiple points in time,” which is a materially stronger position than closed, unaudited VPN implementations.

Known limitations and real-world risk

Because OpenVPN is often bundled inside other products (VPN provider apps, router firmware, embedded devices), patching discipline matters. A recent report highlighted that some VPN apps ship outdated OpenVPN components, which can expose users to security and performance issues even if the app itself updates. That’s not a protocol flaw, but it is a practical ecosystem risk: you need updates to actually land where you run OpenVPN.

OpenVPN also maintains a public security advisories page and has historically published advisories about vulnerabilities and their fixes.

Jurisdiction and “logging” (what we can and can’t honestly claim)

OpenVPN, Inc. is a company with commercial products (Access Server and CloudConnexa), but OpenVPN Community Edition is an open-source project. OpenVPN Connect and Access Server are not, by themselves, a consumer anonymity service.

So: there is no single truthful, universal “OpenVPN logs / doesn’t log” statement that applies across all OpenVPN deployments. What is source-backed is that Access Server includes logging features (for example, OpenVPN’s product comparison materials mention streaming connection events to a remote syslog server, and the pricing/features list includes session and connection logs).

If your threat model depends on strict non-retention, you need to evaluate the operator’s policy and the specific server configuration—not the protocol name.

Strengths and Limitations

Strengths

• Mature, widely adopted protocol/implementation with broad ecosystem support and client availability.
• Open-source core (GPL), which improves inspectability and makes third-party review possible.
• Independent audits exist (including a v2.7 SRLabs audit and earlier OSTIF-funded audit work with documented fixes).
• Access Server free tier supports 2 simultaneous connections forever, with paid scaling when you need more.
• Performance work is real (DCO): documented kernel-space offload to reduce overhead and improve scalability on Access Server.

Limitations

• Not a VPN service: OpenVPN Connect explicitly does not provide VPN service; you need a server/provider.
• Privacy depends on operator and configuration, and Access Server supports connection/session logging (so “no logs” is not inherent).
• Performance without DCO can be constrained by kernel↔userspace overhead and single-threaded userspace handling (classic OpenVPN 2.x architecture).
• Ecosystem patching risk: third-party apps may ship outdated OpenVPN components unless vendors update them.

Who Should Use OpenVPN?

Good fit

1. Small teams who need a self-hosted VPN now and can live within 2 concurrent connections on Access Server’s free plan (or pay to scale later).
2. IT/admin users who want control (routing, access policies, identity integrations) and prefer a self-hosted model with a web UI (Access Server) rather than pure DIY.
3. Organizations pushing OpenVPN throughput that can benefit from documented kernel offload (DCO) on supported Access Server versions and client setups.

Not a good fit

1. People shopping for “a VPN subscription” for streaming/location shifting: OpenVPN Connect doesn’t sell you exit nodes; it’s a client for your server/provider.
2. Users who can’t manage infrastructure (or don’t want to): Community Edition is powerful but expects operational competence; Access Server reduces that burden but is still self-hosted.
3. Anyone who needs a universal “no-logs guarantee” from the protocol alone: OpenVPN is technology, not a privacy policy. At minimum, Access Server includes logging capabilities.