OpenVPN

OpenVPN Guide and Best Providers Offering the Protocol

In 2001, when James Yonan released OpenVPN under the open source GPL license, few people outside of the corporate, government, or techie culture knew much about VPNs. In the 14 years since its initial release OpenVPN has grown to be a dominant player in the VPN market. As open source software, the source code is available for peer review by anyone, which has proven in other projects such a GnuPG or PGP to create a much more secure product.


Quick Links


Being open source also allows the world community to contribute to the code base, often increasing innovation. To aid in this innovation, OpenVPN has been engineered in a modular fashion. This allows other projects to easily contribute to the functionality of the software. By default, it utilizes the widely known OpenSSL library to provide its encryption capabilities.

OpenVPN’s design enables the software to be robust, highly stable, scalable, and flexible. In choosing the C programming language, it is also highly portable and efficient. It is available on most known platforms, including Microsoft Windows, OS X, Linux, FreeBSD, NetBSD, Solaris, and Android devices. In addition, it runs on many popular router firmware packages, such as the open source DD-WRT, OpenWRT, and Tomato firmwares.

Commercial adoption of the OpenVPN protocol is growing, notably Asus offers models of their wireless routers capable of running both OpenVPN server and client applications. OpenVPN is a SSL/TLS VPN, the two other major VPN protocols are PPTP, and L2TP/IPSec. PPTP was the first VPN protocol to be adopted by Microsoft for their Windows operating systems. However, Microsoft’s PPTP implementation has proven to be deeply flawed and insecure, and most experts would advise against using PPTP.

L2TP/IPSec is considered to be as secure as OpenVPN, when properly implemented. A properly implemented L2TP/IPSec VPN can edge out OpenVPN on performance. However, OpenVPN is more flexible, allowing it to be configured for specific situations, such as bypassing the Chinese government’s firewall. For example, OpenVPN is registered with the IANA on port number 1194 and as such the Chinese Government has begun blocking port 1194.

However, unlike L2TP/IPSec, it is fairly trivial to change OpenVPN’s port number, or even its transport layer from the default UDP to TCP. If port 1194 were being blocked for example, one could configure OpenVPN to use the well known port 443 (HTTPS). It is particularly difficult to block port 443 as HTTPS is used for a lot of legitimate traffic. However, restrictive countries such as China, Iran, and Syria, also employ techniques like Deep Packet Inspection (DPI) to try and determine traffic they wish to block.

Although OpenVPN, when properly encrypted, does not allow DPI to filter on actual content, there are methods to analyze traffic for patterns that are indicative of VPN traffic. China has not made VPNs illegal, but they are known to block VPN providers and VPN traffic. If you live in such a highly restrictive country, you may be best served by finding a VPN provider familiar with bypassing your country’s blocks.

Sometimes, to bypass blocks and in a few other instances it is necessary to run OpenVPN over TCP rather then UDP. However, one should not connect over TCP without a good reason, such as bypassing a firewall, as there can be significant throughput degradation. Unlike the UDP protocol, TCP is a reliable transmission protocol. The algorithms used by TCP to guarantee transmission can feedback on one another when tunneling TCP over TCP.  Under certain conditions this can result in what is sometimes called “TCP meltdown”.

Another interesting feature of OpenVPN is that it allows clients and servers to push or pull configuration options. So, your VPN provider might allow you to change your DHCP, transport, DNS servers, or even your routing, and more by setting the options on the client side.

Top 6 OpenVPN Providers

Logo Name Links Monthly Price
VPN.AC VPN.AC Read Review
Visit Provider
$9
VyprVPN VyprVPN Read Review
Visit Provider
$9.99
LiquidVPN LiquidVPN Read Review
Visit Provider
$6
Private Internet Access Private Internet Access Read Review
Visit Provider
$6.95
PureVPN PureVPN Read Review
Visit Provider
$9.95
ExpressVPN ExpressVPN Read Review
Visit Provider
$8.32

OpenVPN Encryption

OpenVPN does not offer any encryption of its own. Instead the designers make use of the very popular open source OpenSSL libraries for encryption and authentication functionality. OpenSSL is a proven library that is used by many applications. By using the OpenSSL library, OpenVPN designers are able to focus on their application protocol whilst leaving the complex cryptography to others.

OpenSSL is a widely used open source library. It is estimated that as of 2014 more than two thirds of web servers in operation utilize the library. Due to its widespread use, there are many “eyes” auditing its code. On my setup, OpenVPN supports 60 different encryption schemes via the OpenSSL libaries. The default cipher for OpenVPN is Blowfish with a 128 bit key length utilizing cipher-block chaining (CBC).

16th century French cipher machine
16th-century book-shaped French cipher machine, with arms of Henri II of France.

Blowfish was designed in 1993 by cryptography expert Bruce Schneier as a replacement for the DES and IDEA ciphers. It is a fast, secure, unpatented and license-free cipher. OpenVPN’s flexibility allows the user to choose from various other ciphers or even no cipher, i.e. unencrypted traffic. Another common cipher in use with OpenVPN is Advanced Encryption Standard (AES).

In 2003, the U.S. Government announced that AES, using a 128 bit key length, is sufficient to protect classified information up to the government’s SECRET level. In order to protect TOP SECRET level, key lengths of 192 or 256 bits are required.  VPN providers who support these ciphers and key lengths, will sometimes advertise themselves as offering government or military strength security.

The encryption cipher one chooses needs to be balanced upon the user’s needs of performance versus cryptographic strength, i.e. security.  Because of its modular design, it is not difficult to link OpenVPN with other cryptographic libraries.  A notable fork of the OpenVPN code is OpenVPN-NL, which was commissioned by the Dutch Government for use in protecting their networks.  Rather than using the OpenSSL library, OpenVPN-NL utilizes the smaller, more easily audited, PolarSSL library. The Dutch fork allows only the AES-256-CBC cipher, with the SHA256 message digest. There are three aspects to consider when encrypting with OpenVPN or any VPN for that matter.

  1. Data Encryption
  2. Data Authentication
  3. Handshake Encryption

Data encryption is the encryption of your actual data stream. As stated earlier in this article, OpenVPN utilizing the OpenSSL library, allows many options for data encryption.

Blowfish-128 in CBC mode is the default cipher, and is considered secure and reasonably efficient on most platforms.

AES-128 in CBC mode in my own non-stringent testing, was faster than Blowfish utilizing the OpenSSL library.

AES-256 is significantly stronger than AES-128 and in my own testing was only slightly less efficient than AES-128.

OpenSSL Speed Benchmark
Cipher 16 Bytes 64 Bytes 256 Bytes 1024 Bytes 8192 Bytes
The ‘numbers’ are in 1000s of bytes per second processed.
BLOWFISH-CBC 104986.42k 113926.70k 116234.67k 117049.69k 117573.01k
AES-128-CBC 113747.48k 121465.09k 125275.65k 281390.42k 286826.85k
AES-256-CBC 83263.67k 87589.97k 89457.15k 208131.75k 209986.44k

These results show AES-128-CBC to be nearly 59% more efficient than BF-128-CBC and nearly 28% more efficient than AES-256-CBC. This is on my workstation, and your mileage may vary.

You might be wondering what CBC means on these ciphers. This refers to the block cipher mode. IBM invented cipher-block chaining (CBC) in 1976. It is a method in which each block of data, is XORed with the previous block of ciphertext before being encrypted. This creates a chain of ciphertext that is dependent all the way back to the first block of cleartext.

CBC mode is the default mode for OpenVPN and should be used, unless you really know what you are doing and have a good reason to use a different block cipher mode.

Cipher Block Chaining (CBC) mode decryption

Data Authentication protects you from active attacks, where an attacker might modify or inject data into your data stream. In other words, it is a method of verifying that your data has not been maliciously modified. This is done utilizing the hash functions in the OpenSSL library. A hash function takes a set of data and produces a hash value or checksum that is ideally unique to the input data. Another important aspect of a cryptographic hash function is that one can not create the original data from the hash value.

OpenVPN defaults to the SHA-1, however SHA-1 is getting old and many experts recommend moving to SHA-2. In late 2013, Microsoft announced it would no longer recognize SHA-1 signed certificates after January 1, 2016.

I would not be surprised if OpenVPN changed their default to SHA-2 soon. As some users may not be concerned with active attacks, and might instead desire a more efficient data stream, users can choose to use no hash method authentication control (HMAC) at all if they desire.

The only real downside to using HMAC is performance. As the HMAC is performed on each block of data, there will be some efficiency hit. Again the user must consider the balance of performance versus security.

OpenSSL Speed Benchmark
Hash 16 Bytes 64 Bytes 256 Bytes 1024 Bytes 8192 Bytes
The ‘numbers’ are in 1000s of bytes per second processed.
SHA1 74502.96k 202619.27k 430732.54k 659471.36k 757334.02k
SHA256 67065.71k 144992.92k 257856.09k 323112.75k 344436.61k
SHA512 50833.08k 204469.55k 335875.42k 480276.82k 554401.13k

These numbers show SHA-1 to the clear winner in performance. Interestingly, SHA-512 is faster than SHA-256 on all but the 16 byte block size. This is because SHA-256 has a block size of 32 bits versus SHA-512’s 64 bit block size. In other words, the number of block operations required for SHA-256 is twice that of SHA-512.

In most configurations, SHA-512 will not only be more secure, but faster than SHA-256. I would recommend using at least SHA-1 HMAC and SHA-512 for most cases. Of course, if you do not care about data authentication you can turn HMAC off completely.

Handshake encryption is a crucial aspect to the security of SSL/TLS VPNs. In other words, it is critical that the VPN client is connected to the correct VPN server. This prevents man-in-the-middle attacks.

Many VPN services provide an X.509 certificate which can be used to ensure your VPN connection is truly connected with their servers. Performance is not as critical as the handshake is only performed once when connecting to the server, unless you are using ephemeral keys, in which case it is done each time you establish a new ephemeral key.

OpenSSL Speed Benchmark
Key Size Sign Verify Sign/s Verify/s
RSA-1024 0.000216s 0.000013s 4627.5 76037.2
RSA-2048 0.001449s 0.000044s 690.3 22596.0
RSA-4096 0.010560s 0.000162s 94.7 6155.5

The performance on signature verification drops considerably with increased key size. However, as the handshake, even with ephemeral keys, rarely happens more than once an hour (OpenVPN default), performance is not as important here.

The NIST requires the U.S. Government to use RSA key size of at least 2048 bits. This should be a reasonable choice for most users. Ephemeral keys are keys that are only used for a certain period of time and then they are discarded. If the keys are discarded securely, then even if someone captures all of your encrypted traffic, it will be impossible to retrieve the key. Hence, the attacker will never be able to decrypt your traffic.

OpenVPN defaults to renegotiate the data channel at 3600 seconds, or one hour. Don’t worry if some of this technical stuff sounds like Greek to you, unless of course you speak Greek.

But seriously, this article details the OpenVPN protocol at a level most users don’t need to know.  But I didn’t want to make recommendations without providing my reasoning behind them.  The VPN providers recommended in this article can be configured to meet or exceed my recommended levels of security.

“Just because you’re paranoid doesn’t mean they aren’t after you” ― Joseph Heller, Catch-22

Encryption keys
Without the proper key, strong encryption should be nearly impossible to break. Thus ensuring your communications and data are safe from prying eyes.

How to install OpenVPN

As OpenVPN is open source software, the user has different options when installing it on their platform. Many Linux distributions include OpenVPN in their official repositories. It is also supported via the OpenVPN NetworkManager plugin, which is easy to configure via the popular NetworkManager framework. The user can choose to go directly to the OpenVPN web site and download one of their clients. If you are technically inclined, you can even download the source code and compile your own executable.

Many VPN service providers offer a customized version of the client to aid in installation and configuration for their customers. Most VPN service providers have a client configuration file available, which can be loaded into any OpenVPN  build.

There are also commercial versions of the OpenVPN client available from third party development houses. These commercial versions try to add some value to justify charging for the software. Router manufacturers are also increasingly including OpenVPN servers and clients in their firmware. If your router supports this, you can encrypt all of your LAN’s devices with one VPN connection. If your router supports a server, you can even connect back to your home router from a public network without the need for a VPN service provider. However, this will not give you an anonymous IP address as your traffic will appear to originate at your home routers IP address.

For most users of Microsoft Windows, downloading your VPN service providers customized client or downloading directly from the OpenVPN site, is probably the best option. The client works on Windows XP and later versions of Microsoft Windows. OpenVPN’s open source client executables can be found here; http://openvpn.net/index.php/open-source/downloads.html It is probably a good idea to verify the signature of the downloaded executable before installing it. This ensures, that you are installing a legitimate copy of OpenVPN. This can be done using GnuPG, a free open source implementation of the OpenPGP standard.

  1. Once you have downloaded the binary, verify the signature and then double click on the application to open it.
  2. Your “User Access Control” will most likely ask you if you want to allow the program to make changes to your computer. Say “yes” and you will continue to the next step of the install.
  3. Follow the prompts, when selecting components to install most users will be OK with the defaults. Choose your installation folder and install.
  4. If you do not have a TAP installed you will need to install this for OpenVPN to work.  TUN/TAP drivers are virtual (software) network devices available on many platforms.
  5. Then you should finish the installation. You can now run the OpenVPN GUI to help you configure your connection to your VPN Service Provider. You can also use your file explorer to open a configuration file.  Please see below;
Installation of the OpenVPN client.
Installation of the OpenVPN client.

OpenVPN for Windows can be run from the command prompt or from the file explorer.  OpenVPN configuration can be very complex, and it is suggested that you download a *.ovpn configuration file from your VPN Service Provider. The client installer will associate the *.ovpn file extension with the OpenVPN client. Many times your VPN Provider will include other files necessary to connect to their service along with the configuration file. These will usually include a X.509 certificate used in the “Handshake Authentication” phase.

Some providers will also include a Certificate Revocation List in case their keys are compromised. In most cases, you should put all of these files in a folder together. Then you can use your file explorer to find the *.ovpn file, right click on it, and select “Start OpenVPN on this config file”.  You may also choose to install the configuration files in the “config” folder in your OpenVPN client installation folder.  Any configuration files in this folder can be accessed by right clicking on the OpenVPN icon on the toolbar.

OpenVPN GUI showing options and with status window open.
OpenVPN GUI showing options and with status window open.

You can also choose to run a command prompt and run “openvpn myconfig.ovpn” from the directory where your config files are.

A reproduction of Thomas Jeffereson's wheel cipher. Jefferson invented this cipher to encrypt U.S. Government correspondence.
A reproduction of Thomas Jeffereson’s wheel cipher. Jefferson invented this cipher to encrypt U.S. Government correspondence.

Conclusion

Given PPTP’s vulnerabilities, no one serious about security should be using PPTP for their VPN protocol. This leaves L2TP/IPSec or SSL/TLS as the only real secure VPN protocol options. OpenVPN is the clear winner in SSL/TLS VPN implementations.

Although, OpenVPN-NL is a less flexible but more foolproof fork of OpenVPN. Due to OpenVPN’s flexibility and scalability it is often easier and less expensive to implement than L2TP/IPSec. The AES cipher is the clear winner over Blowfish for efficiency. AES-128-CBC is slightly more efficient than AES-256-CBC. AES-128 is approved by the U.S. Government for protecting data up to the SECRET level and AES-256-CBC is approved for the TOP SECRET level.

OpenVPN utilizing the AES-128-CBC cipher should be an excellent solution for most users security and performance needs. Using SHA-512 for data authentication will offer excellent performance and security for most users. Utilizing RSA-2048 or higher pre-shared keys for handshake verification, will ensure that you are connecting to your real VPN server, and avoiding man-in-the-middle attacks.

Overall, OpenVPN’s efficiency, scalability, security, and versatility have pushed the software to be a clear leader in the VPN space. Although, its versatility also make it more complicated to setup, through the use of shared configuration files and VPN providers customized clients, it can be quite easy to use and setup. We hope you find our OpenVPN recommended service providers to be as easy to use and secure as we have.

Top 6 OpenVPN Providers

Logo Name Links Monthly Price
VPN.AC VPN.AC Read Review
Visit Provider
$9
VyprVPN VyprVPN Read Review
Visit Provider
$9.99
LiquidVPN LiquidVPN Read Review
Visit Provider
$6
Private Internet Access Private Internet Access Read Review
Visit Provider
$6.95
PureVPN PureVPN Read Review
Visit Provider
$9.95
ExpressVPN ExpressVPN Read Review
Visit Provider
$8.32

Like this article? Spread the word!
Tweet about this on TwitterShare on Facebook0Share on Reddit0Share on Google+0Share on LinkedIn0Share on VK

My hacking career began at age 12, when my father brought home a Sinclair ZX-81 computer kit and a lifelong fascination with computing was born. I became a privacy and security advocate after learning of the US Government's criminal investigation against Phil Zimmermann. Years later I found myself in Silicon Valley being paid to hack Phil's PGP code. I soon tired of the rat race and moved to the Northwoods of Minnesota where I have over 2 million acres of protected wilderness to roam. Here I indulge in my passions for wilderness and technology and as an advocate for computer security and privacy.

Leave a Comment