# Review pfSense OpenVPN feature compatibility before enabling DCO

> Data-channel offload changes processing and has constraints that can affect existing tunnels.

- Canonical URL: https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:30+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Data-channel offload changes processing and has constraints that can affect existing tunnels.

## Potentially affected

This concerns the currently documented pfSense DCO implementation.

## DSE recommendation

DSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload.

## Article

Data-channel offload changes processing and has constraints that can affect existing tunnels.

## Source facts

Netgate describes DCO as moving much data handling into the kernel rather than changing the VPN protocol. The documented implementation requires pfSense Plus and supports UDP rather than TCP. Its limitations include compression incompatibility and restrictions around internal iroute use for multiple site-to-site clients. DCO is selected per tunnel, and the guide recommends a new tunnel to reduce disruption to existing clients.

Source: [Netgate — OpenVPN Data Channel Offload (DCO)](https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html).

## Applicability

This concerns the currently documented pfSense DCO implementation.

## DSE recommendation

DSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload. Build a parallel nonproduction or pilot tunnel instead of changing every remote user at once. Define an application-level acceptance measure and a rollback to the prior tunnel. Keep compatibility success separate from a throughput claim; a faster benchmark is insufficient if required routes or accounting behavior regress. Inventory the features actually used by each candidate tunnel rather than approving DCO for the whole firewall. Keep the existing client population on its accepted path during a separate pilot, and require the pilot owner to report unsupported dependencies as blockers instead of performance findings.

## Verification

Test representative clients and remote subnets on the pilot. Confirm route reachability, bidirectional application traffic, reconnect behavior, and the diagnostics required by operations. Compare a measured workload with the existing tunnel under equivalent conditions and document limitations without presenting the result as a universal speed guarantee.

## Official reference

[Netgate — OpenVPN Data Channel Offload (DCO)](https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — OpenVPN Data Channel Offload (DCO)
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review pfSense OpenVPN feature compatibility before enabling DCO,” DSE Security, https://update.dsesecurity.com/updates/review-pfsense-openvpn-feature-compatibility-before-enabling-dco/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.