Back to catalog
OpenVPN
GPL-3.0OpenVPN is a self-hosted tunneling daemon that links remote developers to private subnets with custom PKI, scriptable routing, and LDAP authentication.
Open-source alternative to — compare it against:
Overview
OpenVPN is a self-hosted tunneling daemon that establishes encrypted point-to-point and site-to-site IP connections across untrusted networks. It routes Layer 2 Ethernet frames or Layer 3 IP packets through virtual TAP and TUN network drivers using custom security handshakes based on OpenSSL and TLS. The daemon gives infrastructure teams authoritative control over packet encapsulation, cryptographic ciphers, and client routing without relying on external relay infrastructure.
Why OpenVPN instead of NordVPN
NordVPN operates as a commercial subscription service routing consumer web traffic through proprietary proxy gateways across multiple countries, packaging desktop apps for personal browsing privacy. OpenVPN provides no external server fleet; it is a self-hosted daemon that developers and operations engineers deploy on their own servers to create secure, bidirectional tunnels into staging clusters, internal database networks, and cloud VPCs.
From an integration perspective, commercial proxy providers remain closed systems unable to bridge workstations directly into corporate infrastructure. OpenVPN interfaces with backend enterprise directories and automation pipelines, supporting authentication via PAM, RADIUS, and LDAP plugins. Operations teams can attach shell scripts to connection hooks to reconfigure routing tables and firewall rules dynamically, managing internal certificate authorities without third-party dependencies or recurring per-seat fees.
What it does well
- Flexible transport: Operates over UDP for low latency or falls back to TCP port 443 to traverse restrictive corporate firewalls.
- Dual-layer tunneling: Supports routed IP tunnels via TUN devices and bridged Ethernet segments via TAP interfaces for complex environments.
- Lifecycle script hooks: Executes administrative scripts on connection events to update routing tables, firewall rules, and session logs dynamically.
- Directory and token authentication: Authenticates users through LDAP, RADIUS, and PAM modules, alongside hardware token support via PKCS#11.
- Kernel acceleration: Offloads data encryption and packet processing into host kernels with ovpn-dco, minimizing context-switching overhead.
- Per-client configuration: Pushes tailored routes, static IP leases, and subnet policies per user by matching certificate common names.
