Tutorial: Turn on OpenVPN DCO in Access Server⁠

Follow these steps to install DCO on your Access Server server based on your Linux OS. Ensure your server has an officially supported kernel. We don't test or support DCO on custom-compiled kernels and can't guarantee it will work in your situation.

The steps below are for systems where your OS installs the latest kernel when available.

If your system requires staying on a specific kernel version, refer to the DCO troubleshooting page.

After installing the DCO kernel module, you can enable DCO in Access Server's Admin Web UI.

1. Sign in to the Admin Web UI.

2. Click Configuration > Advanced VPN.

3. Click Prefer kernel Openvpn data channel offloading if available (ovpn-dco) to set data channel offloading to Yes.

4. Select Save Settings and Update Running Server.

5. Access Server now displays a message on the Status Overview page that the ovpn-dco module is active.

Instead of turning on OpenVPN DCO from the Admin Web UI, you can manage it from the command-line interface (CLI).

1. Connect to your console and get root privileges.

2. Run these commands:

   sacli -k "vpn.server.daemon.ovpndco" -v "true" ConfigPut
   sacli start

From the Admin Web UI:

1. Click Status > Status Overview.

2. Under Kernel data channel offloading, the status displays as active and lists the ovpn-dco version.

From the CLI:

1. Connect to the console and get root privileges.

2. Run this command to verify ovpn-dco is in use:

   ip -details link show

   • Note the interfaces that start with as0; these should include ovpn-dco in the output.

Suppose you've enabled secure boot on the system running your Access Server. In that case, it will fail to boot correctly if you install the DCO loadable kernel module without adding its signature to the secure boot system.

Ensure you do one of two things:

1. Either add the module's signature to verify it and boot securely.

2. Or disable secure boot.

This situation will improve in the future as DCO is under review for inclusion in the Linux kernel itself. Once it is part of the Linux kernel, a separate loadable kernel module won't be required.