OpenVPN Explained: How the Protocol Works, Its Ports, Versions and Limits

OpenVPN is an open-source VPN protocol plus the free software that implements it: two peers open a TLS session, authenticate with certificates, agree on session keys, and pass traffic through a tunnel between your device and the VPN server, with encryption covering that leg only; beyond the server, traffic travels to the website as usual. The first release came out on 13 May 2001 from James Yonan.

Two channels behind every tunnel

Each connection has two streams. The control channel is a TLS conversation where peers verify each other and negotiate keys, renewed hourly by default, which provides perfect forward secrecy. The data channel carries the actual IP packets, sealed with AES-256-GCM, AES-128-GCM or ChaCha20-Poly1305. Optional static keys harden the control channel: tls-auth signs packets before TLS starts, tls-crypt signs and encrypts them, hiding the certificate exchange. Tunnels run over TUN (routed IP) or TAP (bridged Ethernet).

UDP or TCP, port 1194 or 443

IANA assigned port 1194, and UDP there is the stock, faster setup. TCP mode exists for networks that block UDP: TCP on port 443 slips past firewalls that only allow web traffic. The cost is a TCP tunnel inside a TCP connection, where both layers retransmit lost packets and speed collapses on lossy links. Keep TCP as the last resort.

Neither port hides the protocol: DPI recognises the handshake on any port, so censors can block it, and getting past that needs an obfuscation layer.

Certificates, passwords and the .ovpn file

A server usually runs its own certificate authority, and Easy-RSA, the project's tool for building a CA, signs certificates for the server and each client. Providers often add username-and-password authentication on top; pre-shared static keys count as legacy. Everything lands in one plain-text .ovpn profile:

Certificates and keys can sit embedded in tags or as separate files. Treat a profile holding an embedded key the way you treat a password: anyone with a copy connects as you.

Origins, licence and the company

Written in C, the code leans on OpenSSL for encryption and authentication (mbed TLS also works). The community edition is free software under GPLv2, and the OpenVPN repository on GitHub holds the source. OpenVPN Inc. earns from Access Server, a self-hosted business VPN with a web panel (free for two simultaneous connections), and from the cloud-managed CloudConnexa.

OpenVPN 2, OpenVPN 3 and OpenVPN Connect

Connect carries no VPN service itself: load a profile from your server or provider and it joins any OpenVPN-compatible endpoint. Tunnelblick covers macOS, and router firmware like OpenWrt or pfSense speaks OpenVPN natively.

Speed: user space and Data Channel Offload

Running in user space costs CPU on fast links, as every packet crosses between kernel and application. Version 2.6 introduced Data Channel Offload: data-channel encryption shifts into a kernel module, the control channel stays put. The ovpn module reached the mainline Linux kernel at version 6.16, and Windows uses a separate DCO driver. OpenVPN 3 turns DCO on automatically when the module is present.

Where WireGuard wins

WireGuard is newer, far smaller in code, UDP-only and kernel-resident, and it usually connects and moves data faster. OpenVPN keeps two advantages: TCP mode where UDP is filtered, and support on gear without WireGuard. Neither hides from DPI. The WireGuard vs OpenVPN comparison covers the details.

OpenVPN with a VPN service

Out of the 543 consumer services VPNRadarLab checked, 242 say they offer OpenVPN, another group of 88 states it does not, and the remaining 213 publish nothing about whether they support it. You can either pick the protocol inside the provider's app or import its .ovpn profiles into any client, when the provider hands them out. The OpenVPN ranking lists those 242 services with their scores, prices and terms.

FAQ

Does OpenVPN cost anything?

The program is free. What costs money is a server to connect to.

Can my internet provider see I use OpenVPN?

It can recognise the traffic pattern, but not read what flows through the tunnel.

Do I need tls-crypt?

On a server you administer, yes. With a commercial provider, the choice is theirs.

Does it work on iPhone and Android?

Yes, using the Connect app or the provider's application, on both platforms.

OpenVPN at a glance

Free and open-source since 2001 under GPLv2, with TLS for key exchange and UDP as the default transport. Visible to DPI, slower than WireGuard without DCO, and still the fallback where UDP is blocked.