Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.

Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.

Improved handling of tunnel MTU, including support for pushable MTU.

Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.

New features and improvements in 2.6.0 compared to 2.5.8: The Changes document also contains a section with workarounds for common problems encountered when using OpenVPN with OpenSSL 3. This is a new stable release with some major new features. The OpenVPN community project team is proud to release OpenVPN 2.6.0.

Update included ovpn-dco-win driver to 0.9.2.

On Linux this brings in a new default dependency for libnl-genl (for Linux distributions that are too old to have a suitable version of the library, use 'configure -disable-dco') Note: configure now enables DCO build by default on FreeBSD and Linux. '-cryptoapicert ISSUER:' where is matched as a substring of the issuer (CA) name in the certificate. Certificate selection string can now specify a partial issuer name string as

CryptoAPI (Windows): support issuer name as a selector.

This ensure that only the previously authenticated peer can do trigger renegotiation and complete renegotiations.

Dynamic TLS Crypt: When both peers are OpenVPN 2.6.1+, OpenVPN will dynamically create a tls-crypt key that is used for renegotiation.

This is mostly a bugfix release with some improvements. The OpenVPN community project team is proud to release OpenVPN 2.6.1.

Openvpn client windows download