Tutorial: Upgrade the OpenVPN DCO Module

Abstract

Upgrade the OpenVPN DCO module on Access Server. Learn when upgrades are automatic, how to update manually, and how to reload DCO without rebooting.

Overview

This tutorial shows you how to upgrade the OpenVPN Data Channel Offload (DCO) module installed on your Access Server.

In Access Server 3.x, DCO is enabled by default.

If you install or upgrade Access Server using the installation script (install.sh), the DCO module is installed and enabled automatically.
If you install or upgrade Access Server using your system package manager (apt, yum, etc.), the DCO module may not be installed and may need to be installed manually.

Prerequisites

Access Server with OpenVPN DCO enabled.
Root access to the server console.

Step 1: Upgrade DCO (if needed)

How you upgrade DCO depends on how you installed or upgraded Access Server.

If you used the installation script (recommended)

If you installed or upgraded Access Server using the installation script, you don't need to install DCO manually.

The correct DCO module is installed automatically.

Skip to Step 2: Apply the updated module.

If you used your system package manager

If you installed or upgraded Access Server using your system package manager (apt, yum, etc.), you need to install the DCO module manually.

Continue with the steps below.

Upgrade DCO on Ubuntu or Debian

Connect to the console and get root privileges.
Update the system:
```
apt update
apt upgrade
```
Install or update the DCO module:
- For Access Server 3.2.0 or newer:
```
apt install ovpn-dkms
```
- For Access Server 3.1.0 or earlier:
```
# No additional package required
```

Upgrade DCO on Red Hat Enterprise Linux

Connect to the console and get root privileges.
Update the system:
```
yum update
```
Install or update the DCO module:
- For Access Server 3.2.0 or newer:
```
yum install kmod-ovpn
```
- For Access Server 3.1.0 or earlier:
```
# No additional package required
```

Step 2: Apply the updated module

After upgrading, you need to load the updated DCO module.

Option A: Reboot (recommended)

Reboot your system:
```
reboot
```

Option B: Reload the module without rebooting

Note

Use this option if you can't reboot your server.

For Access Server 3.2.0 or newer:

systemctl stop openvpnas
modprobe -r ovpn
modprobe ovpn
systemctl start openvpnas

For Access Server 3.1.0 or earlier:

systemctl stop openvpnas
modprobe -r ovpn_dco_v2
modprobe ovpn_dco_v2
systemctl start openvpnas

Step 3: Verify DCO is active

After the upgrade, confirm that DCO is active.

From the Admin Web UI

Sign in to the Admin Web UI.
Click Status.
On the Overview tab, locate Server Details.
Confirm that DCO is shown as enabled. Result:
- ✅ Pass: DCO is shown as enabled → no further action needed.
- ❌ Fail: DCO is not enabled → return to Step 1 or review troubleshooting.
Click VPN Server.
- The Network Settings tab is displayed.
Click the Data Channel Offload tab.
- The DCO status displays with additional details.

From the CLI

You can also confirm DCO availability and usage from the command line.

Connect to the console and get root privileges.

Check DCO availability:

sacli support | grep 'ovpn-dco availability'

Example output for Access Server 3.2.0 or newer:

ovpn-dco availability: True, ovpn version: ovpn-net-next/main-7.x

Example output for Access Server 3.1.0 or earlier:

ovpn-dco availability: True, ovpn-dco version 0.2.x

Verify that DCO is actively in use by the OpenVPN daemon:
```
ip -details link show
```
Look for:
- 3.2.0 or newer: ovpn
- 3.1.0 or earlier: ovpn-dco
Tip
If DCO is available but not active, it may not be enabled or loaded correctly.
Check DKMS module status:
```
dkms status
```
- Example output for 3.2.0 or newer:
```
ovpn/7.x.x, <kernel>, x86_64: installed
```
- Example output for 3.1.0 or earlier:
```
ovpn-dco/0.2.x, <kernel>, x86_64: installed
```
Check module details:
- For 3.2.0 or newer, run:
```
modinfo ovpn
```
- For 3.1.0 or earlier, run:
```
modinfo ovpn-dco-v2
```
- Result:
Review the outputs from the commands above and use them to determine whether DCO is active:
- ✅ Pass:
  - ovpn-dco availability: True
  - The correct module appears (ovpn for 3.2.0+, or ovpn-dco for earlier versions).
  - The DKMS module shows as installed.
- ❌ Fail:
  - Availability is False
  - The DCO module is missing or not loaded.
  - No DCO interface appears in the output.

In this section: