--- title: 'Tutorial: Install, Verify, and Troubleshoot OpenVPN DCO in Access Server' canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--turn-on-openvpn-dco/ product: Access Server Docs description: Install and turn on OpenVPN DCO to enhance Access Server's performance. This module offloads the data channel to the Linux kernel. keywords: performance --- # Tutorial: Install, Verify, and Troubleshoot OpenVPN DCO in Access Server ## Overview OpenVPN Data Channel Offload (DCO) improves VPN performance by moving data-channel processing from the user space into the Linux kernel. This reduces CPU overhead and can provide: - Higher throughput. - Lower latency. - Better performance under load. In Access Server 3.x, OpenVPN DCO is enabled by default. - If you install or upgrade Access Server using the [installation script](https://openvpn.net/as-docs/v3/install-script.md) (`install.sh`), the DCO module is installed and enabled automatically. - If you install or upgrade Access Server using your system package manager (`apt`, `yum`, etc.), the DCO module may not be installed and may need to be installed manually. If DCO isn't installed or active, you may see errors such as: - **DCO not in use** - **Not installed** - **OpenVPN data-channel offloading was requested but failed to activate** - **False, Kernel module not loaded** This tutorial shows how to: - Verify that DCO is in use. - Install or enable it if needed. - Optimize your configuration for best performance. > **Tip** > > If you used the installation script, you likely don't need to install anything; you can skip to the step where you verify that DCO is active. ## Prerequisites To deploy and use OpenVPN DCO on Access Server, you need to meet the following requirements. ### Supported Access Server version: - Access Server 3.x (DCO installs automatically using the current install/upgrade script) ### Supported platforms: - Debian 12 - Debian 13 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux 10 - Ubuntu 22.04 LTS (x86\_64 and ARM64 architectures) - Ubuntu 24.04 LTS (x86\_64 and ARM64 architectures) - Ubuntu 26.04 LTS (x86\_64 and ARM64 architectures) ### Compatible clients: - OpenVPN3-based clients such as OpenVPN Connect v3 and OpenVPN3 Linux client - OpenVPN2-based clients that use OpenVPN 2.4 or newer (OpenVPN 2.3 and older are not supported) > **Tip** > > The client doesn't need to use DCO to connect to a server that uses DCO. With only one side doing DCO, there is already a performance benefit. However, it is best if both sides use it. The following clients can utilize DCO on the client side, although it must be enabled separately within the client. > > **Clients with DCO capability:** > > - OpenVPN3 Connect for Windows (as of 3.4.0). > - OpenVPN3 Linux client (check with the [community documentation for the supported Linux operating systems](https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux)). > - OpenVPN 2.6.0 or newer (check with the [community documentation for the supported Linux operating systems](https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux)). > - OpenVPN GUI community client for Windows (refer to [community downloads](https://openvpn.net/community-downloads/)). ## Step 1: Install DCO (if needed) DCO installation depends on how you installed or upgraded Access Server. ### If you used the installation script (recommended) If you installed or upgraded Access Server using the [installation script](https://openvpn.net/as-docs/v3/install-script.md), **you don't need to install DCO manually**. DCO is installed and configured automatically. Skip to [DCO Step 2: Verify OpenVPN DCO is in use](https://openvpn.net/as-docs/v3/tutorials/tutorial--turn-on-openvpn-dco/#step-2--verify-openvpn-dco-is-in-use). ### If you used your system package manager If you installed or upgraded Access Server using your system package manager (`apt`, `yum`, etc.), you need to install the DCO module manually. Continue with the steps below. ### Important notes for Access Server 3.2.0 Access Server 3.2.0 includes OpenVPN 2.7.2, which uses the updated DCO kernel module based on upstream Linux kernel 6.16+. - If your system runs Linux kernel 6.16 or newer and includes DCO support, it can use DCO without installing an additional module. - For older kernels, you need to install the DCO module manually to enable DCO and access the latest features. > **Important** > > Ensure your system uses an officially supported kernel. DCO isn't tested or supported on custom-compiled kernels, and behavior may vary. ### Install DCO on Ubuntu or Debian 1. Connect to the console and get root privileges. 2. Update the system (recommended): ``` apt update apt upgrade ``` 3. Reboot: the OS ``` reboot ``` 4. Install the DCO module: - For Access Server 3.2.0 or newer: ``` apt install ovpn-dkms ``` - For Access Server 3.1.0 or earlier: ``` apt install openvpn-dco-dkms ``` > **Note** > > If you run into issues, refer to our [troubleshooting tips](https://openvpn.net/as-docs/dco-troubleshooting.md) for dependency requirements. ### Install DCO on Red Hat Enterprise Linux 1. Install the [EPEL repository](https://docs.fedoraproject.org/en-US/epel/#_quickstart). 2. Update the system (using the command appropriate for your RHEL version): ``` yum update ``` or ``` yum upgrade ``` 3. Reboot the OS. 4. Install the DCO module: - For Access Server 3.2.0 or newer: ``` yum install kmod-ovpn ``` - For Access Server 3.1.0 or earlier: ``` yum install kmod-ovpn-dco ``` ## Step 2: Verify OpenVPN DCO is in use After installation, confirm that DCO is active. ### From the Admin Web UI 1. Sign in to the Admin Web UI. 2. Click **Status**. 3. On the **Overview** tab, locate **Server Details**. 4. Confirm that DCO is shown as enabled. Result: - ✅ **Pass:** DCO is shown as enabled → no further action needed. - ❌ **Fail:** DCO is not enabled → return to Step 1 or review troubleshooting. 5. Click **VPN Server**. - The **Network Settings** tab is displayed. 6. Click the **Data Channel Offload** tab. - The DCO status displays with additional details. ### From the CLI You can also confirm DCO availability and usage from the command line. 1. Connect to the console and get root privileges. 2. Check DCO availability: ``` sacli support | grep 'ovpn-dco availability' ``` - Example output for Access Server 3.2.0 or newer: ``` ovpn-dco availability: True, ovpn version: ovpn-net-next/main-7.x ``` - Example output for Access Server 3.1.0 or earlier: ``` ovpn-dco availability: True, ovpn-dco version 0.2.x ``` 3. Verify that DCO is actively in use by the OpenVPN daemon: ``` ip -details link show ``` 4. Look for: - **3.2.0 or newer:** `ovpn` - **3.1.0 or earlier:** `ovpn-dco` > **Tip** > > If DCO is available but not active, it may not be enabled or loaded correctly. 5. Check DKMS module status: ``` dkms status ``` - Example output for 3.2.0 or newer: ``` ovpn/7.x.x, , x86_64: installed ``` - Example output for 3.1.0 or earlier: ``` ovpn-dco/0.2.x, , x86_64: installed ``` 6. Check module details: - For 3.2.0 or newer, run: ``` modinfo ovpn ``` - For 3.1.0 or earlier, run: ``` modinfo ovpn-dco-v2 ``` - Result: 7. Review the outputs from the commands above and use them to determine whether DCO is active: - **✅ Pass:** - `ovpn-dco availability: True` - The correct module appears (`ovpn` for 3.2.0+, or `ovpn-dco` for earlier versions). - The DKMS module shows as installed. - ❌ **Fail:** - Availability is `False` - The DCO module is missing or not loaded. - No DCO interface appears in the output. ## Step 3: Check VPN tunnel MTU (optional) When using DCO, adjusting the MTU can improve performance and reduce fragmentation. We recommend setting the VPN tunnel MTU to 1420 bytes: 1. Sign in to the Admin Web UI. 2. Click **VPN Server**. - The **Network Settings** tab is displayed. 3. Click the **Advanced** tab. 4. Set the **MTU (Maximum Transmission Unit)** value to **1420**. > **Note** > > The minimum allowable MTU is 576. The maximum is 65536. 5. Click **Save** and **Restart**. 6. Result: - VPN traffic uses a more efficient MTU for DCO. - This helps avoid fragmentation issues in some environments. ## Troubleshooting If DCO isn't enabled or not in use, check the common issues below. For more troubleshooting tips, refer to [Troubleshooting Tips for OpenVPN DCO](https://openvpn.net/as-docs/dco-troubleshooting.md). ### 1. Confirm the system was rebooted after upgrade After upgrading Access Server, a DCO installation requires a full system reboot. 1. Run: ``` reboot ``` 2. After the system comes back online, verify DCO again from the Admin Web UI **Status** page. ### 2. Check the running kernel Ensure your system is running a supported kernel. 1. Run: ``` uname -a ``` 2. Verify that: - You are running a [supported Linux platform](https://openvpn.net/as-docs/v3/tutorials/tutorial--turn-on-openvpn-dco/#supported-platforms-). - You're not using a custom-compiled kernel (not supported for DCO). ### 3. Check if Secure Boot is enabled If Secure Boot is enabled, the DCO kernel module may fail to load unless properly signed. 1. Run: ``` mokutil --sb-state ``` - Output when Secure Boot is enabled: ``` root@openvpnas:~# mokutil --sb-state SecureBoot enabled ``` 2. If Secure Boot is enabled, you must either: 1. Sign the DCO module for Secure Boot validation, or > **Important** > > Refer to your selected operating system or platform documentation for specific instructions on this process. 2. Disable Secure Boot. ### 4. Check DKMS module status OpenVPN DCO uses DKMS (Dynamic Kernel Module Support) to build and install the kernel module. 1. Run: ``` dkms status ``` 2. Review the output for the DCO module installed for your current kernel. - Example output for Access Server 3.2.0 or newer: ``` ovpn/7.x.x, , x86_64: installed ``` - Example output for Access Server 3.1.0 or earlier: ``` ovpn-dco/0.2.x, , x86_64: installed ``` 3. Result: - ✅ **Pass:** The module (`ovpn` or `ovpn-dco`) is listed as installed for your running kernel. - ❌ **Fail:** The module is missing or not listed as installed for your current kernel. 4. If the module isn't installed for your running kernel, DCO won't function. Return to the installation steps to install or rebuild the module. ### 5. Check for legacy data ciphers Access Server uses DCO-compatible data ciphers by default. However, if legacy ciphers are configured, DCO will fail. OpenVPN DCO doesn't support legacy CBC-type ciphers. It only supports modern AEAD ciphers such as: - `AES-256-GCM` - `AES-128-GCM` - `CHACHA20-POLY1305` If a legacy cipher is configured, you may see the following warning: ``` "[Warning] OpenVPN data-channel offloading was requested but failed to activate: OpenVPN data-channel offloading was requested but failed to activate. This typically happens if there is a configuration option that is incompatible with DCO or if the DCO kernel module could not be loaded. (dco_not_active)" ``` 1. Check both data cipher and legacy cipher settings: ``` sacli ConfigQuery | egrep "vpn.server.data_ciphers|vpn.server.cipher" ``` 2. If the output includes CBC-type ciphers (such as `AES-256-CBC` or Blowfish), DCO won't be enabled. 3. To use DCO, ensure both server and clients are configured to use AEAD ciphers only. Refer to the following tutorial for instructions on updating encryption settings in Access Server: - [Tutorial: Change the Data-Channel Encryption Cipher](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-encryption-cipher.md) - Ensure you select DCO-supported AEAD ciphers mentioned here. > **Important** > > **Important details** > > - Access Server uses `AES-256-CBC` by default, with automatic negotiation to `AES-256-GCM` when supported. > - OpenVPN 2.4 and newer clients default to `AES-256-CBC` with automatic upgrade to `AES-256-GCM`. > - OpenVPN3-based client ssupport AEAD ciphers and are compatible with DCO. > - OpenVPN 2.3 and older clients require CBC-type ciphers and are incompatible with DCO. > > If you must support OpenVPN 2.3 or older clients, you may need to retain CBC-type cipher support, which prevents DCO from being used. --- Prev: [Data Channel Offload (DCO) Optimization](https://openvpn.net/as-docs/v3/tutorials/data-channel-offload--dco--optimization.md) Next: [Tutorial: Upgrade the OpenVPN DCO Module](https://openvpn.net/as-docs/v3/tutorials/tutorial--upgrade-openvpn-dco.md) Index: https://openvpn.net/as-docs/llms.txt