OpenVPN Data Channel Offload (aka OVPN-DCO)

The expression Data Channel Offload refers to any technique implemented with the goal of moving the processing of data packets from the OpenVPN userspace program to a separate entity.

Given that OpenVPN spends a considerable amount of time passing data packets back and forth from kernel-land to user-land, where decryption and re-routing happens, it was decided to offload the data processing directly to the kernel. As direct consequence, data packets are not required to leave the kernelspace anymore, thus boosting the performance of active VPN connections.

Antonio's speech about DCO on Linux, held at Netdev 0x16 (Lisbon, October 2022), is ​online here

Read more about DCO

• What changes?
• The Linux userspace API
• DCO on non-Linux platforms
• Supported features and limitations
• How to use DCO