Review pfSense OpenVPN feature compatibility before enabling DCO

Data-channel offload changes processing and has constraints that can affect existing tunnels.

Source facts

Netgate describes DCO as moving much data handling into the kernel rather than changing the VPN protocol. The documented implementation requires pfSense Plus and supports UDP rather than TCP. Its limitations include compression incompatibility and restrictions around internal iroute use for multiple site-to-site clients. DCO is selected per tunnel, and the guide recommends a new tunnel to reduce disruption to existing clients.

Source: Netgate — OpenVPN Data Channel Offload (DCO).

Applicability

This concerns the currently documented pfSense DCO implementation.

DSE recommendation

DSE recommends inventorying transport, topology, ciphers, compression, client versions, and site-to-site routing before trialing offload. Build a parallel nonproduction or pilot tunnel instead of changing every remote user at once. Define an application-level acceptance measure and a rollback to the prior tunnel. Keep compatibility success separate from a throughput claim; a faster benchmark is insufficient if required routes or accounting behavior regress. Inventory the features actually used by each candidate tunnel rather than approving DCO for the whole firewall. Keep the existing client population on its accepted path during a separate pilot, and require the pilot owner to report unsupported dependencies as blockers instead of performance findings.

Verification

Test representative clients and remote subnets on the pilot. Confirm route reachability, bidirectional application traffic, reconnect behavior, and the diagnostics required by operations. Compare a measured workload with the existing tunnel under equivalent conditions and document limitations without presenting the result as a universal speed guarantee.

Official reference

Netgate — OpenVPN Data Channel Offload (DCO). Reviewed October 20, 2026.