OpenVPN

OpenVPN is the elder statesman of VPN software: open source since 2001, audited more times than anyone can count, and still the protocol most commercial VPN providers offer when you dig into their settings. The community edition here is the full toolkit - the same code that runs under countless corporate gateways and privacy services - free under the GPL for anyone willing to configure it.

What it actually does: it creates encrypted point-to-point or site-to-site tunnels using SSL/TLS, the same family of cryptography that protects HTTPS. It runs in userspace over the TUN/TAP virtual network interface, which is why it ports everywhere: Windows, macOS, Linux, routers and embedded boards. On phones, the official OpenVPN Connect apps (free but proprietary) and third-party clients like the open-source OpenVPN for Android handle the same .ovpn profiles. Tunnels use UDP by default for speed, with TCP as a fallback for networks that block everything except web traffic, and they slip through NAT and firewalls that defeat older protocols like PPTP or L2TP.

One thing newcomers should know: OpenVPN is a protocol and an engine, not a ready-made privacy service. The community Windows installer (version 2.7.8, October 2026, a 5.9MB MSI) gives you the OpenVPN GUI client, which connects to a server you still have to find or build. That server might be one you rent and configure yourself, your employer's gateway, a commercial VPN provider that hands out .ovpn profiles, or OpenVPN Inc.'s paid CloudConnexa service (their separate OpenVPN Connect app - free, but proprietary - is the polished client for it, not to be confused with this community package). The client itself is free in every case.

Security is where the project earned its reputation. Authentication uses certificates and a proper PKI, with optional username and password or multi-factor add-ons on top. Modern versions negotiate AES-256-GCM or ChaCha20-Poly1305, and perfect forward secrecy comes from TLS. The code is GPL-2.0, development happens in public on GitHub, and the 2.7 series has been dropping legacy cruft like the old Blowfish cipher and LZO compression. Independent security audits over the years have kept that record intact.

The honest trade-offs: setup is genuinely fiddly. Rolling your own server means generating certificates (easy-rsa helps), writing config files and opening firewall ports - a weekend project for a first-timer. Speed is fine but not class-leading: OpenVPN is largely single-threaded, so WireGuard beats it on raw throughput on the same hardware. And the community client's interface is functional rather than pretty: a tray icon and a log window, not a shiny map of server locations.

For self-hosters, network admins and anyone who wants a VPN they can fully inspect and control, OpenVPN remains the reference point everything else is measured against. Just budget an evening for the learning curve before the first tunnel comes up.