openvpn

OpenVPN活跃维护

开源 VPN 守护进程，用 C 实现，支持 SSL/TLS 加密隧道，可自建安全远程访问与站点互联网络。

OpenVPN is an open source VPN daemon

v2.7.9发布于 2026-11-05 15:14 UTC14,792star +11 / 7 天3,433fork同步于 2026-11-10 05:27 UTC

VPN 加密隧道远程访问网络安全守护进程

对比 GitHub 官网 security vpn

怎么上手

README 里没有找到可直接复制的安装命令

原文

README 里没有找到可直接复制的安装命令，请到 README 或官方文档查看安装方式。

硬件要求

README 没有说明硬件要求。

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

这个项目的说明还在生成中，先参考下面「最近发版」和 README。

最近发版

5 个版本v2.7.9

全部 release

v2.7.9最新正式版2026-11-05 · 2026-11-05 15:14 UTC
Security fixes
- win32: restrict loading plugin dependencies (DLLs) to plugin, app and system directories.
- win32: run openvpn.exe from the interactive service at "high integrity level", that is, process memory of openvpn.exe and all its threads are protected from tampering. Signals/Events are still permitted.
- win32: openvpnserv: strictly filter user-defined environment variables before passing to openvpn.exe (CVE-2026-121720)
  
  (Issue found by @refiaa, tracked in Github: OpenVPN/openvpn-private-issues#186)
- win32: openvpnserv: make validation of openvpn command line more robust to invalid-quoting attacks (CVE-2026-115342)
- win32: openvpn.exe: change parsing of commandline to use the same function that the interactive service uses (CommandLineToArgvW()) (CVE-2026-115342)
  
  (Issues found by Heiko Hund, tracked in Github: OpenVPN/openvpn-private-issues#184)
Bug fixes
- Username/Password parsing from --auth-user-pass file (or inline) left parts of overlong usernames in the password field. Fix. (GH OpenVPN/openvpn#1140)
- win32: openvpnserv: fix memory leak for security descriptors
- win32: repair logging of errors in Windows tun_read_queue()
- win32: avoid accessing uninitialized structure data if GetInterfaceInfo() or GetPerAdapterInfo() fail
- win32: openvpnserv: avoid double free() if GetTokenInformation() fails
- win32: openvpnserv: avoid potential format-string issue on registry defaults
- win32: openvpnserv: repair error reporting on RegGetValueA() failures inside GetItfDnsServersV4()
- win32: openvpnserv: fix inet_ntop() return code check in GetItfDnsServersV6(), making it ignore DHCP-provided DNS servers.
- route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info - the actual gateway handling was correct, just not printing anything anymore.
- config: check_file_access: fix --extra-certs access check
- win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)
- route: close socket in Haiku get_default_gateway() (FD leak)
- win32: openvpnserv: skip conversion of empty domain names
- win32: cmake+mingw: don't prefix the event message DLL with lib (it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')
- win32: pass the buffer size in bytes to get_openvpn_reg_value()
- PUSH_UPDATE server: free temporary options after sending message (memleak)
User-visible Changes
- Linux: set IFF_BACKPRESSURE on Linux (if available)
  
  This helps the kernel tun/tap to apply proper prioritization (qdisc etc) to incoming packets if userspace is slow to process them. Without the flag, the kernel would just drop everything.
- Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts
  
  If an openvpn config has a username set but no password, and OpenVPN wants to prompt for the password, the GUI could not see the username today and prompted for both. With this change, OpenVPN sends a hint to the management interface, so a GUI can pre-fill the username field, or only prompt for the password.
  
  This is only done if the management interface client announces support for it (compatibility level >= 6).
Code improvements/general hardening
- crypto_epoch: wipe key material with secure_memzero()
- do not look up "none" cipher in OpenSSL - this avoids leaving an "error" on the OpenSSL error stack, which can then later lead to spurious SSL error prints on CRL loading.
- Make CRL reload EOF detection independent of stale error queue entries (GH: OpenVPN/openvpn#1104)
- tls_crypt: fix handling of "cipher final out
v2.7.82026-10-07 · 2026-10-07 14:18 UTC
查看更新说明
Security fixes:
- Check for NULL-Bytes in certificate subjects - refuse all such certificates now as "invalid" (CVE-2026-84790).
  
  (Bug reported by Vivek Parikh)
- TLS handshake with tls-crypt-v2: do not try to add a wrapped client key if no key material is available (client bug in response to an ill-behaving server).
  
  (No CVE assigned as "a malicious server can stop the client from working properly" is not considered a CVE-worthy security issue according to the CRA guidelines)
- options: fix unsigned underflow when clearing domain_search_list (CVE-2026-88964)
  
  (Bug reported and fix contributed by Cole Munz)
- win32: stop cmd.exe from expanding variables in quoted arguments (CVE-2026-84256)
  
  (Bug reported by Darren Carreras)
User-visible Changes:
- Certificate validation is now stricter regarding NULL bytes in strings (see above). This might break existing installations if such certificates exist and OpenSSL builds are used. mbedTLS builds always rejected this.
- On a certificate with duplicate fields (multiple CN, for example) OpenSSL builds would use the last one, mbedTLS builds use the first one - changed in the mbedTLS build so behaviour is identical.
Bugfixes:
- DCO: remove installed iroutes at client exit time, not at delayed multi instance cleanup time - otherwise there is a race with reconnecting clients, possibly ending up having "no iroutes installed in the system at all". Bug reported by OpenVPN Inc Access Server team.
- DCO Linux: fix remaining races between synchronous netlink operations and incoming asynchronous notifications, by adding a second netlink socket and strictly separating sync/async operations.
- Client: refuse incoming pushed option combination of epoch data format with non-AEAD ciphers (restart session instead of aborting with a fatal error).
- DCO (Linux and Windows): on failures to set up a new peer or install key materials for a peer, do not exit OpenVPN with a fatal error. Instead, signal the error up the call-chain and restart the (multi) instance.
  
  The handshake is inherently racy when a peer is removed kernel-side due to transport errors or timeouts, and userland does not yet know this and wants to, for example, install new keys. This is fatal for the particular client instance, but must not end the whole server process.
- DCO: stop fetching peer stats during client disconnect The intention of the original code was to ensure reported counters are always correct, but it did not work (because at query time, the peer in kernel is already gone, so we only got an error message) - and very inefficiently so (because we queried all the peers all the time). End-of-session final counter values will be implemented properly by a followup patch leveraging counters piggybacked on the kernel's "DEL_PEER" notification message.
- p2mp server: improve handling of mbuf lists in the face of broadcast or multicast traffic, and fix a bug on client exit that could lead to a server queue deadlock in very particular scenarios.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.7...v2.7.8
v2.6.232026-09-23 · 2026-09-23 15:13 UTC
查看更新说明
Security fixes:
- ssl: do not trust the peer's request to resend the wrapped client key
- reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for packets that cannot be outstanding (CVE-2026-84732)
  
  Both reliability layer bugs found by Mark Bregman (Fox-IT)
- improve on check_session_buf_not_used(), catch possible double-free in the lame duck case (CVE-2026-84471)
  
  Bug reported by Andreas Gabriel Berbescu and Haruki Oyama (Waseda University)
- windows: fix CreateProcess() command line quoting for characters that are special to cmd.exe, where a combination of validation script plus rogue CA could lead to misbehavior (CVE-2026-84256)
  
  Bug found by Clouditera Security
- windows: fix tapctl to always call netsh.exe with full path (as we do elsewhere) (CVE-2026-84226)
  
  Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- windows: don't use NULL DACL with system objects, namely the --service exit event and the netsh.exe guard semaphore.
  
  The old approach was prone to a local DoS where one user could interfere with other users' openvpn processes by blocking the netsh semaphore or sending events. This only affects setups not using the iservice, or using the automatic service to start/stop openvpn (CVE-2026-82312)
  
  Bug found by DEBRAJ BASAK
- dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer guard - suitable DHCP options could lead to a single-byte overflow of a temp buffer (CVE-2026-81738)
  
  Bug found by Andre Kropp (Nexory) and ChinhNguyen
- openvpnserv (windows): detect and refuse sibling dirs in CheckConfigPath() (CVE-2026-81830)
  
  Bug found by Harshit Varu
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.6.22...v2.6.23
v2.7.72026-09-03 · 2026-09-03 18:09 UTC
查看更新说明
Security fixes:
- reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for packets that cannot be outstanding (CVE-2026-84732)
  
  Both reliability layer bugs found by Mark Bregman (Fox-IT)
- windows: fix CreateProcess() command line quoting for characters that are special to cmd.exe, where a combination of validation script plus rogue CA could lead to misbehavior (CVE-2026-84256)
  
  Bug found by Clouditera Security
- windows: fix tapctl to always call netsh.exe with full path (as we do elsewhere) (CVE-2026-84226)
  
  Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- windows: don't use NULL DACL with system objects, namely the --service exit event and the netsh.exe guard semaphore.
  
  The old approach was prone to a local DoS where one user could interfere with other users' openvpn processes by blocking the netsh semaphore or sending events. This only affects setups not using the iservice, or using the automatic service to start/stop openvpn (CVE-2026-82312)
  
  Bug found by DEBRAJ BASAK
- openvpnserv (windows): pass correct NRPT domains size - when IDN domains with UTF8 encoding were involved, a buffer overread could be achieved (CVE-2026-78221)
  
  Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- openvpnserv (windows): don't allow '/' in config paths.
  
  The APIs windows uses for path validation do not handle '/' as path separator, while the file open APIs do, so this could be used to circumvent our config path validation, leading to openvpn.exe starting a user-controlled config file even if administratively not allowed (CVE-2026-78043)
  
  Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer guard - suitable DHCP options could lead to a single-byte overflow of a temp buffer (CVE-2026-81738)
  
  Bug found by Andre Kropp (Nexory) and ChinhNguyen
- linux netlink: validate netlink replies against the request
  
  Suggested by Joshua Rogers as a security improvement
- openvpnserv (windows): fix off-by-one on input validation (discovered while fixing CVE-2026-78221)
- openvpnserv (windows): harden CheckConfigPath() a bit more (another improvement while working on CVE-2026-78043)
User-visible Changes:
- when using EPOCH data channel format, reduce the number of future keys from 16 to 4 - the previous calculation was wrong, and 4 spare keys are sufficient for 100+ Gbit/s links. This means less log spam in userland and fewer resources used in in-kernel implementations.
Bugfixes:
- work around a pubkey-handling bug in mbedTLS 4.1.0 and 4.2.0 (supposedly fixed in 4.3.0)
- multi: don't let stale-routes-check delete permanent routes - --stale-routes-check did not only delete dynamic cached routes, but also routes installed by --iroute and --ifconfig-push. Fixed by introducing route flags and restraining the check on them (Github: OpenVPN/openvpn#1063)
- ssl: do not queue control ciphertext while a packet is still queued (fixes problems in TCP p2p handshake when both sides try to handshake at the same time) (Github: OpenVPN/openvpn#1089)
- reenable xmit_hold when using p2p tcp-server and tls-server - in TCP server mode the server is not expected to initiate the TLS handshake. This was introduced by the multisocket code checking the wrong variable for socket protocol
v2.6.222026-08-06 · 2026-08-06 10:06 UTC
查看更新说明
Security fixes:
- openvpnserv (windows): better scrutinize command line passed in from the control socket to openvpn. This would lead to circumventing admin restrictions on allowed openvpn config directories (but never to "read files the user has no permissions for") (CVE-2026-63649)
  
  Bug found by 章鱼哥 (www.aipyaipy.com)
- dco: make key state desync recoverable
  
  This was reported as a "with suitable timing, a key-update de-sync between OpenVPN and the kernel could trigger an ASSERT()", and was initially handled as security report. It turned out to be not exploitable, but the state machine was not very robust and so the opportunity was used to improve the code.
  
  Bug found by 章鱼哥 (www.aipyaipy.com)
Bugfixes:
- refuse incoming HARD RESET packets with a sequence ID != 0 (this is basically making an OpenVPN server ignore and log a "should never happen" client-side misbehaviour, which could lead to TLS handshake establishment failures in p2p TLS setups)
- correct minimum packet length check for 802.1q tagged packets (Github: OpenVPN/openvpn#1044).
  
  This was also reported (twice) as a security bug, as technically OpenVPN with --client-nat would read and write up to 4 bytes "after the end of the packet" - but due to the OpenVPN packet buffer layouts, which are always full-frame-sized this is fully safe and has no adverse consequences.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.6.21...v2.6.22

用户点评

登录用户的真实使用记录，可按版本和硬件筛选

共 0 条

还没有人点评。第一个说出真实体验的人最有价值。

README 原文

未翻译

在 GitHub 打开

OpenVPN -- A Secure tunneling daemon

Copyright (C) 2002-2026 OpenVPN Inc. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation.

To get the latest release of OpenVPN, go to:

https://openvpn.net/community-downloads/

To Build and Install,

tar -zxf openvpn-<version>.tar.gz
cd openvpn-<version>
./configure
make
make install

or see the file INSTALL for more info.

For information on how to build OpenVPN on/for Windows with MinGW or MSVC see README.cmake.md.

For detailed information on OpenVPN, including examples, see the man page http://openvpn.net/man.html

For a sample VPN configuration, see http://openvpn.net/howto.html

To report an issue, see https://github.com/OpenVPN/openvpn/issues/new

For a description of OpenVPN's underlying protocol, see the file ssl.h included in the source distribution.

Other Files & Directories:

configure.ac -- script to rebuild our configure script and makefile.
sample/sample-scripts/verify-cn

A sample perl script which can be used with OpenVPN's --tls-verify option to provide a customized authentication test on embedded X509 certificate fields.
sample/sample-keys/

Sample RSA keys and certificates. DON'T USE THESE FILES FOR ANYTHING OTHER THAN TESTING BECAUSE THEY ARE TOTALLY INSECURE.
sample/sample-config-files/

A collection of OpenVPN config files and scripts from the HOWTO at http://openvpn.net/howto.html

Note that easy-rsa and tap-windows are now maintained in their own subprojects. Their source code is available here:

https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/tap-windows6

Community-provided Windows installers (MSI) and Debian packages are built from

https://github.com/OpenVPN/openvpn-build

See the INSTALL file for usage information.

怎么上手

项目说明

最近发版

Security fixes

Bug fixes

User-visible Changes

Code improvements/general hardening

Security fixes:

User-visible Changes:

Bugfixes:

Security fixes:

Security fixes:

User-visible Changes:

Bugfixes:

Security fixes:

Bugfixes:

用户点评

README 原文

相关项目