Tutorial: Install, Verify, and Troubleshoot OpenVPN DCO in Access Server⁠

If you used the installation script (recommended)⁠

If you installed or upgraded Access Server using the installation script, you don't need to install DCO manually.

DCO is installed and configured automatically. Skip to DCO Step 2: Verify OpenVPN DCO is in use.

If you used your system package manager⁠

If you installed or upgraded Access Server using your system package manager (apt, yum, etc.), you need to install the DCO module manually.

Continue with the steps below.

Important notes for Access Server 3.2.0⁠

Access Server 3.2.0 includes OpenVPN 2.7.2, which uses the updated DCO kernel module based on upstream Linux kernel 6.16+.

• If your system runs Linux kernel 6.16 or newer and includes DCO support, it can use DCO without installing an additional module.

• For older kernels, you need to install the DCO module manually to enable DCO and access the latest features.

Install DCO on Ubuntu or Debian⁠

1. Connect to the console and get root privileges.

2. Update the system (recommended):

   apt update
   apt upgrade

3. Reboot: the OS

   reboot

4. Install the DCO module:

   • For Access Server 3.2.0 or newer:

     apt install ovpn-dkms

   • For Access Server 3.1.0 or earlier:

     apt install openvpn-dco-dkms

Install DCO on Red Hat Enterprise Linux⁠

1. Install the EPEL repository.

2. Update the system (using the command appropriate for your RHEL version):

   yum update

   or

   yum upgrade

3. Reboot the OS.

4. Install the DCO module:

   • For Access Server 3.2.0 or newer:

     yum install kmod-ovpn

   • For Access Server 3.1.0 or earlier:

     yum install kmod-ovpn-dco

From the Admin Web UI⁠

1. Sign in to the Admin Web UI.

2. Click Status.

3. On the Overview tab, locate Server Details.

4. Confirm that DCO is shown as enabled. Result:

   • ✅ Pass: DCO is shown as enabled → no further action needed.

   • ❌ Fail: DCO is not enabled → return to Step 1 or review troubleshooting.

5. Click VPN Server.

   • The Network Settings tab is displayed.

6. Click the Data Channel Offload tab.

   • The DCO status displays with additional details.

From the CLI⁠

You can also confirm DCO availability and usage from the command line.

1. Connect to the console and get root privileges.

2. Check DCO availability:

   sacli support | grep 'ovpn-dco availability'

   • Example output for Access Server 3.2.0 or newer:

     ovpn-dco availability: True, ovpn version: ovpn-net-next/main-7.x

   • Example output for Access Server 3.1.0 or earlier:

     ovpn-dco availability: True, ovpn-dco version 0.2.x

3. Verify that DCO is actively in use by the OpenVPN daemon:

   ip -details link show

4. Look for:

   • 3.2.0 or newer: ovpn

   • 3.1.0 or earlier: ovpn-dco

5. Check DKMS module status:

   dkms status

   • Example output for 3.2.0 or newer:

     ovpn/7.x.x, <kernel>, x86_64: installed

   • Example output for 3.1.0 or earlier:

     ovpn-dco/0.2.x, <kernel>, x86_64: installed

6. Check module details:

   • For 3.2.0 or newer, run:

     modinfo ovpn

   • For 3.1.0 or earlier, run:

     modinfo ovpn-dco-v2

   • Result:

7. Review the outputs from the commands above and use them to determine whether DCO is active:

   • ✅ Pass:

     • ovpn-dco availability: True

     • The correct module appears (ovpn for 3.2.0+, or ovpn-dco for earlier versions).

     • The DKMS module shows as installed.

   • ❌ Fail:

     • Availability is False

     • The DCO module is missing or not loaded.

     • No DCO interface appears in the output.