OpenVPN Version 2.7.0 Introduces Multi-Address Support and Enhanced Features
- Securityish
- Tools & Best Practices
Quick Summary
OpenVPN has released version 2.7.0, which enhances support for multi-address server configurations and improves client functionality across various operating systems. This update includes better data channel handling, support for new kernel modules, and updated cryptographic components. These changes are significant as they simplify server configurations and improve security features for users relying on OpenVPN for secure communications.
The Securityish Brief
OpenVPN version 2.7.0 is now available, advancing the platform’s capabilities with several key updates. The release enhances support for multi-address server configurations, allowing servers to manage multiple addresses, ports, and protocols from a single process. This simplifies configurations for services that need to listen on more than one interface or handle different transport options concurrently.
The update also introduces preliminary support for the upstream DCO Linux kernel module, which is expected to be included in future Linux kernels. This replaces the earlier out-of-tree ovpn-dco-v2 driver, with backported versions available for current kernels through related projects.
Client functionality has improved across Linux, BSD, and macOS platforms, with enhanced DNS options. A new Windows client implementation has been added, featuring control channel capabilities like split DNS and DNSSEC handling. The control channel now supports a PUSH_UPDATE message, enabling servers to update client options during an active session without requiring a reconnect.
Architectural changes for Windows include the use of Windows Filtering Platform filters for the block-local flag, on-demand generation of network adapters, and automatic service execution under unprivileged user contexts. The release also supports server mode in the win-dco driver while maintaining tap-windows6 as a fallback option.
Data channel handling has been updated to enforce usage limits for AES-GCM, and support for epoch data keys and an updated packet format has been integrated. The codebase now supports TLS 1.3 when paired with certain newer cryptographic libraries, including compatibility with mbedTLS version 4.
Additionally, two new environment variables have been introduced to communicate preferred gateway redirection to external plugins used in network management software. A change to the recursive routing check aims to drop fewer tunneled packets when the destination matches the VPN server path.
- Multi-address server configurations allow OpenVPN servers to manage multiple addresses, ports, and protocols from a single process.
- Preliminary support for the upstream DCO Linux kernel module replaces the earlier ovpn-dco-v2 driver.
- Client support for DNS options has been improved across Linux, BSD, and macOS platforms.
- A new Windows client implementation offers control channel features like split DNS and DNSSEC handling.
- The control channel gains support for a PUSH_UPDATE message, allowing servers to update client options during active sessions.
- Architectural adjustments on Windows include the use of Windows Filtering Platform filters and on-demand network adapter generation.
- Data channel handling has been updated to enforce usage limits for AES-GCM and support epoch data keys.
- The codebase adds support for TLS 1.3 and compatibility with mbedTLS version 4.
Key Takeaways
- Update to OpenVPN version 2.7.0 to take advantage of new features and security enhancements.
- Review server configurations to utilize multi-address support for improved management of services.
- Check client settings for DNS options, especially if using Linux, BSD, or macOS platforms.
- Monitor updates related to the DCO Linux kernel module for future compatibility improvements.
- Evaluate the use of TLS 1.3 and mbedTLS version 4 to enhance cryptographic security.
Key Terms & Concepts
- DCO Linux kernel module: In this article, the DCO Linux kernel module refers to a new module expected to replace the previous ovpn-dco-v2 driver in future Linux kernels.
- AES-GCM: In this article, AES-GCM refers to a cryptographic algorithm that has enforced usage limits in OpenVPN version 2.7.0 for enhanced security.
- TLS 1.3: In this article, TLS 1.3 refers to the latest version of the Transport Layer Security protocol, which provides improved security features.
Read the original article here: https://www.helpnetsecurity.com/2026/02/12/openvpn-releases-version-2-7-0/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
