OpenVPN 2.5.0

[Neustradamus]

@angristan: An update is needed:

OpenVPN 2.5.0 (2020-10-27):

• https://openvpn.net/
• https://github.com/OpenVPN/openvpn/releases

Announcement:

• https://sourceforge.net/p/openvpn/mailman/message/37138737/

OpenVPN 2.5 is a new major release with many new features:

• Client-specific tls-crypt keys (–tls-crypt-v2)
• Added support for using the ChaCha20-Poly1305 cipher in the OpenVPN data channel
• Improved Data channel cipher negotiation
• Removal of BF-CBC support in default configuration
• Asynchronous (deferred) authentication support for auth-pam plugin
• Deferred client-connect
• Faster connection setup
• Netlink support
• Wintun support
• IPv6-only operation
• Improved Windows 10 detection
• Linux VRF support
• TLS 1.3 support
• Support setting DHCP search domain
• Handle setting of tun/tap interface MTU on Windows
• HMAC based auth-token support
• VLAN support
• Support building of .msi installers for Windows
• Allow unicode search string in –cryptoapicert option (Windows)
• Support IPv4 configs with /31 netmasks now
• New option –block-ipv6 to reject all IPv6 packets (ICMPv6)
• MSI installer (Windows)
• The MSI installer now bundles EasyRSA 3, a modern take on OpenVPN CA management

Overview of changes in OpenVPN v2.5:

• https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25

Overview of changes in OpenVPN v2.4:

• https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24

[randshell]

An update is needed:

I looked at the changelog and there shouldn't be any breaking changes with our 2.3/2.4 configuration and the new version 2.5. The only update we can do is to support some of the new features that we can benefit of.

In my opinion these are:

• Client-specific tls-crypt keys (--tls-crypt-v2)
  Issue Support client-specific tls-crypt keys #758
• ChaCha20-Poly1305 cipher in the OpenVPN data channel
  ARM devices that doesn't have AES-NI should theoretically have faster speed with this cipher
• Removal of BF-CBC support in default configuration
  The sed command for the Fedora OpenVPN service needs an update. PR Remove unnecessary cipher configuration on Fedora #762
• TLS 1.3 support
  See TLS 1.3 support  #637 discussion
• HMAC based auth-token support
  PR Add auth-gen-token server option #662 needs testing
• Maybe IPv6-only tunnels and --block-ipv6

[TinCanTech]

FTR, --block-ipv6 only blocks IPv6 from the client to the server.
To block server to client IPv6 the server must use other means. eg. Firewall.

[Neustradamus]

@randomshell: Thanks for your reply :)

I am not sure if all features from 2.4 has been added previously too...

[randshell]

Can you please check #33?

After a quick overview what we are missing is:

• HMAC based auth-token support
  PR Add auth-gen-token server option #662 needs testing
• Explicitly bind to IPv4 or IPv6
  Issue Could not determine IPv4/IPv6 protocol. Using AF_INET #756

[dinuka1988]

Guys just want to say thank you for all your hard work! Great work and thank you!