OpenVPN — The classic open-source VPN protocol and server stack for private encrypted tunnels
What it is
OpenVPN is the veteran open-source VPN: a mature TLS-based protocol with clients on nearly every platform, used by companies for site-to-site links and remote access as well as by commercial VPN providers. Its OpenSSL-based cryptography has been battle-tested for two decades. Compared with WireGuard it is heavier and slower to set up, which is why many homelabbers now reach for the newer kernel-native option first.
Editor's review
Long-form introduction by the BetterPicker editors · checked against the official site · Oct 13, 2026
OpenVPN is the veteran of the VPN world: a TLS-based protocol built on OpenSSL, refined across two decades of audits, deployments and platform ports. The open-source protocol still underpins a large share of the commercial VPN industry, and Access Server, the company's self-hosted offering, wraps it in an admin interface, a setup wizard and pre-configured client bundles that retire most of the old command-line reputation. Reviewers who run it for clients describe the connectivity as dull in the best sense - tunnels stay up, routing behaves, and the enterprise features around authentication and access control remain the reason regulated organizations keep choosing it. It is not the lightest option - that crown moved to WireGuard - but it remains the answer when the requirements list includes TCP port flexibility, deep directory integration and a protocol a security team already knows how to review.
What it does well
Access control built for organizations: local accounts, RADIUS, LDAP and SAML, multi-factor codes, per-user and per-group network rules, static VPN addresses and split tunneling. Compliance attestations - SOC 2 Type 2, GDPR, HIPAA, ISO 27001 - explain its grip on regulated industries that cannot adopt younger tooling on trust alone.
Deployment fits wherever operations lives: one-click images across the major cloud marketplaces, pre-configured Docker and hypervisor images, airgapped operation, and active-active clustering for high availability. A detailed walkthrough stood up full remote access with site-to-site routing in under an hour.
The client experience is genuinely easy: OpenVPN Connect runs on every mainstream platform, and users download a pre-configured bundle or a profile file, click once, and are in. Onboarding, historically the painful part, is now a link you send around the office.
Who it's for
Small teams start free with two connections and grow into per-connection pricing; mid-size companies get the widest authentication and audit tooling in the category; agencies and MSPs manage many client networks from one interface. Homelabbers linking two sites should honestly compare with WireGuard first - it is lighter and faster to configure - but anyone who needs TCP port flexibility, mature firewall behavior, or a protocol that already passes a security review will end up here regardless.
Where it falls short
Setup still carries prerequisites: a server, a fully qualified domain name and a TLS certificate, and marketplace images have shipped outdated versions that need upgrading before first use. The wizard helps, but there are more moving parts than modern mesh tools present.
Heavier than the new guard: configuration surface, packet overhead and day-two administration all exceed WireGuard's. Kernel-level offload narrows the raw throughput difference on current releases, yet the administration burden remains a bigger job.
Per-connection pricing adds up: two connections free, then roughly seven dollars per connection monthly on entry paid plans, scaling through volume tiers. Teams comfortable with community editions can run the free protocol itself - and rebuild the management layer themselves.
Specs at a glance
Facts from the official site · not editorial opinion
| What it is | Mature open-source VPN protocol built on TLS and OpenSSL, with client apps for essentially every desktop and mobile platform |
|---|---|
| Price | Access Server free tier: 2 simultaneous connections; Growth plans per connection from $7/mo with volume discounts, scaling to 2,000 connections; Enterprise unlimited connections and IoT fleets |
| Deployment | Own hardware or marketplace images for AWS, GCP, Azure, IBM, DigitalOcean, Oracle, Vultr; pre-configured Docker, Hyper-V, ESXi images; supports RHEL, Debian, Ubuntu |
| High availability | Active-active clustering, horizontal scaling across nodes, airgapped offline operation |
| Authentication | Local users, RADIUS, LDAP and SAML with TOTP multi-factor; per-user and per-group access control, static VPN addresses, split tunneling |
| Performance | Data Channel Offload moves encryption into the Linux kernel for substantially higher throughput on current releases |
| Compliance | SOC 2 Type 2, GDPR, HIPAA and ISO/IEC 27001 attested; Cloud Connexa delivers the same stack as a managed cloud service |
Frequently asked questions
▸Is OpenVPN free?
The protocol and the community server are free and open source. Access Server, the edition with the admin interface and client portal, is free for 2 simultaneous connections and moves to per-connection pricing beyond that.
▸OpenVPN or WireGuard?
WireGuard is lighter and faster to configure; OpenVPN offers deeper enterprise authentication, TCP port flexibility and two decades of audit history. Kernel-level offload has narrowed the speed gap on modern servers.
▸What does a self-hosted setup require?
A server you control, a fully qualified domain name and a TLS certificate - either a manual signing request or an automated Let's Encrypt client. Marketplace images and the first-boot wizard handle most of the server configuration.
▸Can it link two office networks?
Yes. A router or gateway runs the client with a static VPN address, routing rules direct chosen subnets through the tunnel, and split tunneling keeps ordinary browsing on each site's own internet connection.
Video reviews
3 review videos aggregated · praise and criticism included alike · click through to the original video
Channels that covered it
Channels are aggregated as sources only — we don’t rate creators
Related tools
Where to go next
External links open in a new tab; external content is independent of this site.
Link down? Every object page is re-checked monthly.