{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "item": { "id": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "slug": "review-pfsense-openvpn-feature-compatibility-before-enabling-dco", "url": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco.md", "json": "https://update.dsesecurity.com/api/v1/posts/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/" }, "title": "Review pfSense OpenVPN feature compatibility before enabling DCO", "summary": "Data-channel offload changes processing and has constraints that can affect existing tunnels.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:30+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 258, "potentially_affected": "This concerns the currently documented pfSense DCO implementation.", "dse_recommendation": "DSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload.", "primary_source": { "name": "Netgate — OpenVPN Data Channel Offload (DCO)", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Data-channel offload changes processing and has constraints that can affect existing tunnels.

\n

Source facts

\n

Netgate describes DCO as moving much data handling into the kernel rather than changing the VPN protocol. The documented implementation requires pfSense Plus and supports UDP rather than TCP. Its limitations include compression incompatibility and restrictions around internal iroute use for multiple site-to-site clients. DCO is selected per tunnel, and the guide recommends a new tunnel to reduce disruption to existing clients.

\n

Source: Netgate — OpenVPN Data Channel Offload (DCO).

\n

Applicability

\n

This concerns the currently documented pfSense DCO implementation.

\n

DSE recommendation

\n

DSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload. Build a parallel nonproduction or pilot tunnel instead of changing every remote user at once. Define an application-level acceptance measure and a rollback to the prior tunnel. Keep compatibility success separate from a throughput claim; a faster benchmark is insufficient if required routes or accounting behavior regress. Inventory the features actually used by each candidate tunnel rather than approving DCO for the whole firewall. Keep the existing client population on its accepted path during a separate pilot, and require the pilot owner to report unsupported dependencies as blockers instead of performance findings.

\n

Verification

\n

Test representative clients and remote subnets on the pilot. Confirm route reachability, bidirectional application traffic, reconnect behavior, and the diagnostics required by operations. Compare a measured workload with the existing tunnel under equivalent conditions and document limitations without presenting the result as a universal speed guarantee.

\n

Official reference

\n

Netgate — OpenVPN Data Channel Offload (DCO). Reviewed October 20, 2026.

", "content_text": "Data-channel offload changes processing and has constraints that can affect existing tunnels.\nSource facts\nNetgate describes DCO as moving much data handling into the kernel rather than changing the VPN protocol. The documented implementation requires pfSense Plus and supports UDP rather than TCP. Its limitations include compression incompatibility and restrictions around internal iroute use for multiple site-to-site clients. DCO is selected per tunnel, and the guide recommends a new tunnel to reduce disruption to existing clients.\nSource: Netgate — OpenVPN Data Channel Offload (DCO).\nApplicability\nThis concerns the currently documented pfSense DCO implementation.\nDSE recommendation\nDSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload. Build a parallel nonproduction or pilot tunnel instead of changing every remote user at once. Define an application-level acceptance measure and a rollback to the prior tunnel. Keep compatibility success separate from a throughput claim; a faster benchmark is insufficient if required routes or accounting behavior regress. Inventory the features actually used by each candidate tunnel rather than approving DCO for the whole firewall. Keep the existing client population on its accepted path during a separate pilot, and require the pilot owner to report unsupported dependencies as blockers instead of performance findings.\nVerification\nTest representative clients and remote subnets on the pilot. Confirm route reachability, bidirectional application traffic, reconnect behavior, and the diagnostics required by operations. Compare a measured workload with the existing tunnel under equivalent conditions and document limitations without presenting the result as a universal speed guarantee.\nOfficial reference\nNetgate — OpenVPN Data Channel Offload (DCO). Reviewed October 20, 2026.", "content_markdown": "Data-channel offload changes processing and has constraints that can affect existing tunnels.\n\n## Source facts\n\nNetgate describes DCO as moving much data handling into the kernel rather than changing the VPN protocol. The documented implementation requires pfSense Plus and supports UDP rather than TCP. Its limitations include compression incompatibility and restrictions around internal iroute use for multiple site-to-site clients. DCO is selected per tunnel, and the guide recommends a new tunnel to reduce disruption to existing clients.\n\nSource: [Netgate — OpenVPN Data Channel Offload (DCO)](https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html).\n\n## Applicability\n\nThis concerns the currently documented pfSense DCO implementation.\n\n## DSE recommendation\n\nDSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload. Build a parallel nonproduction or pilot tunnel instead of changing every remote user at once. Define an application-level acceptance measure and a rollback to the prior tunnel. Keep compatibility success separate from a throughput claim; a faster benchmark is insufficient if required routes or accounting behavior regress. Inventory the features actually used by each candidate tunnel rather than approving DCO for the whole firewall. Keep the existing client population on its accepted path during a separate pilot, and require the pilot owner to report unsupported dependencies as blockers instead of performance findings.\n\n## Verification\n\nTest representative clients and remote subnets on the pilot. Confirm route reachability, bidirectional application traffic, reconnect behavior, and the diagnostics required by operations. Compare a measured workload with the existing tunnel under equivalent conditions and document limitations without presenting the result as a universal speed guarantee.\n\n## Official reference\n\n[Netgate — OpenVPN Data Channel Offload (DCO)](https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "url": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Review pfSense OpenVPN feature compatibility before enabling DCO", "item": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/#article", "identifier": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "url": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/", "headline": "Review pfSense OpenVPN feature compatibility before enabling DCO", "description": "Data-channel offload changes processing and has constraints that can affect existing tunnels.", "abstract": "Data-channel offload changes processing and has constraints that can affect existing tunnels.", "articleBody": "Data-channel offload changes processing and has constraints that can affect existing tunnels.\nSource facts\nNetgate describes DCO as moving much data handling into the kernel rather than changing the VPN protocol. The documented implementation requires pfSense Plus and supports UDP rather than TCP. Its limitations include compression incompatibility and restrictions around internal iroute use for multiple site-to-site clients. DCO is selected per tunnel, and the guide recommends a new tunnel to reduce disruption to existing clients.\nSource: Netgate — OpenVPN Data Channel Offload (DCO).\nApplicability\nThis concerns the currently documented pfSense DCO implementation.\nDSE recommendation\nDSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload. Build a parallel nonproduction or pilot tunnel instead of changing every remote user at once. Define an application-level acceptance measure and a rollback to the prior tunnel. Keep compatibility success separate from a throughput claim; a faster benchmark is insufficient if required routes or accounting behavior regress. Inventory the features actually used by each candidate tunnel rather than approving DCO for the whole firewall. Keep the existing client population on its accepted path during a separate pilot, and require the pilot owner to report unsupported dependencies as blockers instead of performance findings.\nVerification\nTest representative clients and remote subnets on the pilot. Confirm route reachability, bidirectional application traffic, reconnect behavior, and the diagnostics required by operations. Compare a measured workload with the existing tunnel under equivalent conditions and document limitations without presenting the result as a universal speed guarantee.\nOfficial reference\nNetgate — OpenVPN Data Channel Offload (DCO). Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:30+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review pfSense OpenVPN feature compatibility before enabling DCO" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 258, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — OpenVPN Data Channel Offload (DCO)", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html" } } ] } }