--- title: 'Tutorial: Turn on OpenVPN DCO in Access Server' canonical: https://openvpn.net/as-docs/tutorials/tutorial--turn-on-openvpn-dco/ product: Access Server Docs description: Install and turn on OpenVPN DCO to enhance Access Server's performance. This module offloads the data channel to the Linux kernel. keywords: performance --- # Tutorial: Turn on OpenVPN DCO in Access Server ## Overview Enabling OpenVPN DCO for your VPN server and clients can improve performance. This document describes how to enable it in Access Server and OpenVPN Connect for Windows. > **Tip** > > If you upgrade to the latest Access Server version using the current installation script, OpenVPN DCO is installed and enabled by default. After upgrading, you can skip the manual installation steps below and simply sign in to the **Admin Web UI** to verify that DCO is running. > > If you prefer to remain on your current Access Server version, follow the steps in this tutorial to manually install and enable OpenVPN DCO. ## Prerequisites To deploy and use OpenVPN DCO on Access Server, you need to meet the following requirements. ### Supported Access Server version: - 2.12.0 and newer ### Supported platforms: - Debian 12 - Debian 13 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux 10 - Ubuntu 22.04 LTS (x86\_64 and ARM64 architectures) - Ubuntu 24.04 LTS (x86\_64 and ARM64 architectures) - Ubuntu 26.04 LTS (x86\_64 and ARM64 architectures) ### Compatible clients: - OpenVPN3-based clients such as OpenVPN Connect v3 and OpenVPN3 Linux client - OpenVPN2-based clients that use OpenVPN 2.4 or newer (OpenVPN 2.3 and older are not supported) > **Tip** > > The client doesn't need to use DCO to connect to a server that uses DCO. With only one side doing DCO, there is already a performance benefit. However, it is best if both sides use it. The following clients can utilize DCO on the client side, although it must be enabled separately within the client. > > **Clients with DCO capability:** > > - OpenVPN3 Connect for Windows (as of 3.4.0). > - OpenVPN3 Linux client (check with the [community documentation for the supported Linux operating systems](https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux)). > - OpenVPN 2.6.0 or newer (check with the [community documentation for the supported Linux operating systems](https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux)). > - OpenVPN GUI community client for Windows (refer to [community downloads](https://openvpn.net/community-downloads/)). ## Step 1: Install DCO from the console Follow these steps to install DCO on your Access Server server based on your Linux OS. Ensure your server has an officially supported kernel. We don't test or support DCO on custom-compiled kernels and can't guarantee it will work in your situation. The steps below are for systems where your OS installs the latest kernel when available. If your system requires staying on a specific kernel version, refer to the [DCO troubleshooting page](https://openvpn.net/as-docs/dco-troubleshooting.md). > **Tip** > > After installing the DCO module, you can verify its installation on your server from the Admin Web UI **Status Overview** page — check the row for **kernel data channel offloading**. The field displays the ovpn-dco version. ### Ubuntu/Debian install commands 1. Connect to your server's console and obtain root privileges. 2. Update and upgrade the operating system (recommended): ``` apt update apt upgrade ``` 3. Reboot the OS: ``` reboot ``` 4. Upgrade Access Server to 2.12.0 or newer or do a fresh install of 2.12.0 with the [install commands in the Access Server portal](https://as-portal.openvpn.com/billing/create-activation-key). (Refer to our detailed instructions for [updating Access Server](https://openvpn.net/as-docs/tutorials/tutorial--update-access-server.md), if helpful.) 5. Install the DCO module: ``` apt install openvpn-dco-dkms ``` Due to the various envrionments in which our customers deploy DCO, if you encounter installation issues with these steps, refer to our [troubleshooting tips](https://openvpn.net/as-docs/dco-troubleshooting.md). We provide information about possible dependencies you may need to address. ### Red Hat Enterprise Linux install commands 1. Install the [Extra Packages for Enterprise Linux (EPEL) repository](https://docs.fedoraproject.org/en-US/epel/#_quickstart). 2. Update and upgrade the OS (choose the command  appropriate for your RHEL version): ``` yum upgrade ``` or ``` yum update ``` 3. Reboot the OS. 4. Upgrade Access Server to 2.12.0 or newer or do a fresh install of 2.12.0 with the [install commands in the Access Server portal](https://as-portal.openvpn.com/billing/create-activation-key). (Refer to our detailed instructions for [updating Access Server](https://openvpn.net/as-docs/tutorials/tutorial--update-access-server.md), if helpful.) 5. Install the DCO module: ``` yum install kmod-ovpn-dco ``` ## Step 2: Enable OpenVPN DCO in Admin Web UI After installing the DCO kernel module, you can enable DCO in Access Server's Admin Web UI. 1. Sign in to the Admin Web UI. 2. Click **Configuration \> Advanced VPN**. 3. Click **Prefer kernel Openvpn data channel offloading if available (ovpn-dco)** to set data channel offloading to **Yes**. 4. Select **Save Settings** and **Update Running Server**. 5. Access Server now displays a message on the **Status Overview** page that the ovpn-dco module is active. ### Set VPN tunnel MTU (recommended) Access Server has a maximum transmission unit (MTU), previously a background setting. With DCO, we provided a way for you to adjust it as needed. We recommend setting the VPN tunnel MTU to 1420 when you enable DCO: 1. Sign in to the Admin Web UI. 2. Click **Configuration \> Advanced VPN**. 3. Enter '1420' as the value in the field, **VPN tunnel MTU**. 4. Select **Save Settings** and **Update Running Server**. > **Note** > > For **VPN tunnel MTU**: the minimum allowable value is 576, and the maximum is 65536. ## (Alternative) Step 2: Enable OpenVPN DCO from CLI Instead of turning on OpenVPN DCO from the Admin Web UI, you can manage it from the command-line interface (CLI). 1. Connect to your console and get root privileges. 2. Run these commands: ``` sacli -k "vpn.server.daemon.ovpndco" -v "true" ConfigPut sacli start ``` ## Step 3: Verify OpenVPN DCO is now in use **From the Admin Web UI:** 1. Click **Status \> Status Overview**. 2. Under **Kernel data channel offloading**, the status displays as active and lists the ovpn-dco version. **From the CLI:** 1. Connect to the console and get root privileges. 2. Run this command to verify **ovpn-dco** is in use: ``` ip -details link show ``` - Note the interfaces that start with **as0**; these should include **ovpn-dco** in the output. ## Note about Access Server with Secure Boot Suppose you've enabled secure boot on the system running your Access Server. In that case, it will fail to boot correctly if you install the DCO loadable kernel module without adding its signature to the secure boot system. Ensure you do one of two things: 1. Either add the module's signature to verify it and boot securely. > **Important** > > Refer to your selected operating system or platform documentation for specific instructions on this process. 2. Or disable secure boot. This situation will improve in the future as DCO is under review for inclusion in the Linux kernel itself. Once it is part of the Linux kernel, a separate loadable kernel module won't be required. --- Prev: [Data Channel Offload (DCO) Optimization](https://openvpn.net/as-docs/tutorials/data-channel-offload--dco--optimization.md) Next: [Tutorial: Upgrade the OpenVPN DCO module](https://openvpn.net/as-docs/tutorials/tutorial--upgrade-openvpn-dco.md) Index: https://openvpn.net/as-docs/llms.txt