The OpenVPN-NL lifecycle
Current release
The current release of OpenVPN-NL is based on:
Required cryptographic options:
- OpenVPN ciphers and cipher modes: AES-256-GCM
- TLS Cipher: TLS1-3-AES-256-GCM-SHA384, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 or TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, with P-256 or P-384 for ECDSA and X448, X25519, P-256 or P-384 for ECDHE.
OpenVPN-NL is available as compiled installable packages for the following platforms:
- Debian Linux
- Red Hat Enterprise Linux Server
- SUSE Linux Enterprise Server
- Ubuntu Linux LTS
- Microsoft Windows
The source code is available as a tarball as well, but not supported.
The current release of the Deployment Advisory is Version 2.6
Releases
| Deployment advisory | Build | Status | Notes |
|---|---|---|---|
| OpenVPN-NL v2.6 | 2.6.22-nl1 | Current | This release is based on OpenVPN 2.6.22 and Mbed TLS 3.6.7. It includes some backported security fixes from OpenVPN 2.7.7. |
| OpenVPN-NL v2.5 | 2.5.11-nl3 | Deprecated | This release is based on OpenVPN 2.5.11 and mbed TLS 2.28.8. It includes backported fixes for CVE-2026-12996, CVE-2026-13698 and CVE-2026-12932. |
| 2.5.11-nl2 | Untrusted | This release is based on OpenVPN 2.5.11 and mbed TLS 2.28.8. It includes backported fixes for CVE-2026-35058 and CVE-2026-40215. | |
| 2.5.11-nl1 | Untrusted | This release is based on OpenVPN 2.5.11 and mbed TLS 2.28.8. | |
| 2.5.10-nl1 | Untrusted | This release is based on OpenVPN 2.5.10 and mbed TLS 2.16.12 and fixes several vulnerabilities in the Windows version. | |
| 2.5.6-nl1 | Untrusted | This release is based on OpenVPN 2.5.6 and mbed TLS 2.16.12. The Windows version is affected by CVE-2024-27459, CVE-2024-24974, CVE-2024-27903 and CVE-2024-1305. | |
| OpenVPN-NL v1.4 | 2.4.12-nl1 | Untrusted | This release is based on OpenVPN 2.4.12 and mbed TLS 2.16.2. This release fixes CVE-2022-0547 by aborting when multiple authentication plugins attempt deferred authentication. |
| 2.4.9-nl1 | Untrusted | This release is based on OpenVPN 2.4.9 and mbed TLS 2.16.2. This release contains a fix for a bug that can cause CRLs to be ignored in chroot mode. | |
| 2.4.7-nl1 | Untrusted | This release is based on OpenVPN 2.4.7 and mbed TLS 2.16.2. This a regular maintenance update, with functional fixes for hangs when using PKCS#11. (announcement) | |
| 2.4.6-nl2 | Untrusted | This release is based on OpenVPN 2.4.6 and mbed TLS 2.9.0. This release contains security fixes for the tap-windows driver, the windows interactive service and mbed TLS. (announcement) | |
| 2.4.4-nl1 | Untrusted | This release is based on OpenVPN 2.4.4 and mbed TLS 2.6.0. This release adds GCM mode, Control Channel encryption, better support for roaming clients and many other new features. (announcement) | |
| OpenVPN-NL v1.3 | 2.3.9-nl4 | Untrusted | This release is based on OpenVPN 2.3.9 and PolarSSL to 1.2.19. This release removes support for the less secure key-method 1 data channel key exchange. (announcement) |
| 2.3.9-nl3 | Untrusted | This release is based on OpenVPN 2.3.9 and PolarSSL to 1.2.19. A number of security issues in OpenVPN are fixed. (announcement) | |
| 2.3.9-nl2 | Untrusted | This release is based on OpenVPN 2.3.9 and PolarSSL to 1.2.19. A number of minor security issues in both OpenVPN and PolarSSL are fixed. (announcement) | |
| 2.3.8-nl1 | Untrusted | This release is based on OpenVPN 2.3.8 and PolarSSL to 1.2.15. A number of minor security issues in PolarSSL are fixed. (announcement) | |
| 2.3.5-nl3 | Untrusted | Fixes a remote exploitable vulnerability in PolarSSL's ASN1 sequence parsing. (announcement) | |
| 2.3.5-nl2 | Untrusted | New fix for a denial-of-service vulnerability in OpenVPN-NL server control channel message parsing. This release is based on OpenVPN 2.3.5. (announcement) | |
| 2.3.5-nl1 | Untrusted | New PolarSSL (1.2.12), which includes a fix for a denial-of-service vulnerability in X509 parsing. This release is based on OpenVPN 2.3.5. (announcement) | |
| 2.3.4-nl1 | Untrusted | New PolarSSL (1.2.11), which includes a fix for a denial-of-service vulnerability when GCM TLS cipher suites are used. This release is based on OpenVPN 2.3.4. (announcement) | |
| 2.3.2-nl2 | Untrusted | New PolarSSL (1.2.10), which includes a fix for a possible side-channel attack. This release is based on OpenVPN 2.3.2. (announcement) | |
| 2.3.2-nl1 | Untrusted | New PolarSSL (1.2.8), which includes a fix for a denial-of-service exploit during a TLS handshake. This release is based on OpenVPN 2.3.2. (announcement) | |
| 2.3.1-nl1 | Untrusted | New OpenVPN-NL release, based on OpenVPN 2.3.1. This release upgrades PolarSSL to version 1.2.6 and adds support for AES-GCM TLS ciphers. (announcement) | |
| OpenVPN-NL v1.2 | 2.1.4-fox6 | Untrusted | New PolarSSL RNG based on multiple entropy sources; deployment advisory updated with a new section about virtual machines. (announcement) |
| OpenVPN-NL v1.1 | 2.1.4-fox5 | Untrusted | Deployment advisory update: advises against the use of OpenVPN-NL on virtual machines, pending investigation. (announcement) |
| OpenVPN-NL v1.0 | 2.1.4-fox5 | Untrusted | Initial release. Secure on bare metal PCs, random number generation may be insecure on certain virtual machines |
New releases
The following events can trigger new releases:
- A new release of one of the packages on which OpenVPN-NL is based
- A new release of one of the platforms for which OpenVPN-NL is packaged
Releases which address security issues will be released as quickly as possible, other releases will be dealt with at a more planned pace.
In line with the upstream OpenVPN policy, new releases of OpenVPN-NL will if possible, be backwards compatible in the sense that two different OpenVPN(-NL) releases can connect to one another (they do not break the protocol), and that new OpenVPN(-NL) releases can read the configuration files of older versions of OpenVPN(-NL).
Announcements
When a new release of OpenVPN-NL is available, this will always be announced through the OpenVPN-NL mailing list. This is a low-volume read-only mailing list for this purpose only. Announcements include a statement on whether the new release addresses security issues.
New upstream OpenVPN releases
New upstream OpenVPN releases may add new functionality. While the basic attitude is to adopt these new functions into OpenVPN-NL, this is not guaranteed. Some new functionality may not be adopted for practical or security reasons.
New and old releases of a Linux distribution
When a supported Linux distribution has a new release, we will add a package for that version in the following release of OpenVPN-NL. In the meantime, there is a high likelihood that the package for the previous version of the distribution will work.
We continue to provide packages for a particular major version of a distribution for as long as it receives security updates for free, or under the standard subscription in case of commercial distributions. We do not provide packages for versions where an extended support contract is required to still receive security updates.
Windows
Compared to Linux, Windows is a rather complicated platform to build packages for. The Windows release of OpenVPN-NL will be tested against Windows 11.
Source code
The source code of OpenVPN-NL finds its way to the public via two channels:
- Many of the modifications for OpenVPN-NL have found their way into upstream OpenVPN and we continue to submit patches to the OpenVPN community where relevant. Some patches, typically those that reduce functionality or backwards-compatibility (e.g. reduce the available cryptographic algorithms), remain exclusive to OpenVPN-NL.
- For all OpenVPN-NL releases which are available for download, the source code of that version will be made available. The positive evaluation of Unit Weerbaarheid applies only to the binaries which are distributed via the OpenVPN-NL website. One may choose to compile OpenVPN-NL oneself, but the assessment of Unit Weerbaarheid is not warranted for any self-compiled version. The source code of OpenVPN-NL is distributed in this manner as a courtesy to professionals who really knows what they are doing, and also to comply with the copyright license which applies to the source code (GPLv2).
Old releases
A specific release for a platform is always in one of the following three states:
- Current: this release is up-to-date. This one is the recommended release for that platform.
- Deprecated: this is an old version of OpenVPN-NL for that platform, which is not up-to-date, but has no known security issues. If a current version exists for the platform, that version is recommended for general reasons. There are no security-related reasons to advise against using an deprecated version.
-
Untrusted/insecure: this is an old release of OpenVPN-NL, for which reasons exist to very strongly advise against using it. There are two typical cases:
- The release has become that much different from the current version of OpenVPN-NL, that it is no longer practical to determine whether a vulnerability found in a current (or deprecated) release applies to the old release.
- The version has known vulnerabilities or is for other reasons sufficiently suspect to very strongly advise against using it.
The state of a release always moves down, and may skip the deprecated state. For example, a current release might directly become untrusted/insecure due to the discovery of a vulnerability. A release in the deprecated state may quickly advance into the untrusted/insecure state.
The only version available for download on this website is the current one. Deprecated versions may be found under openvpn.sentyron.com/old.
When an OpenVPN-NL release moves into the untrusted/insecure state, this will be announced on the OpenVPN-NL mailing list. This announcement will typically be complemented with the announcement of a new release.