After I upgraded from Fedora 43 to Fedora 44, the OpenVPN tunnel that had been working without problems for months stopped working. The log of OpenVPN looks normal, with the Initialization Sequence Completed entry that always signals an established tunnel. However, no data gets through; there is no response when pinging the tunnel’s remote endpoint or remote DNS server.
Any ideas what might have changed to cause this?
Starting from kernel 6.16, the OpenVPN module is included in the kernel, which results in OpenVPN trying to use it, which makes the tunnel unusable due to the bug in OpenVPN server 2.4.0 – 2.4.4 (server sends packets in DATA_V1 format, which DCO (data channel offload ) driver doesn’t understand).
The only way to get it working is to disable DCO on the client side, either by running openvpn with the --disable-dco option or by adding disable-dco directive to the configuration.
When the tunnel was working, this was logged (notice DCO version: N/A due to the lack of openvpn kernel module) :
OpenVPN 2.6.20 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
library versions: OpenSSL 3.5.4 30 Sep 2025, LZO 2.10
DCO version: N/A
(…)
Note: Kernel support for ovpn-dco missing, disabling data channel offload.
When the tunnel stopped working, this was logged (notice DCO version 7.0.4-200.fc44.x86_64 (…) due to the presence of openvpn kernel module):
OpenVPN 2.7.3 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
DCO version: 7.0.4-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Fri May 8 16:02:43 UTC 2026
(…)
DCO device ovpn-sfx opened
ovpn-dco device [ovpn-sfx] opened
I raised this issue on openvpn-users and later it was moved to openvpn-devel.