Re: openvpn 2.6 -> 2.7

Hi Miroslav, Andrea,

Matthias copied me into this thread as I'm one of the upstream OpenVPN
maintainers, and I also maintain the openvpn-devel port.

On Sat, May 02, 2026 at 08:24:48PM +0200, Matthias Andree wrote:
> Am 02.05.26 um 11:56 schrieb Miroslav Lachman:
> > On 02/05/2026 10:52, Andrea Venturoli wrote:
[..]
> > > Unfortunately 2.7 breaks many of my configs and while I can easily
> > > upgrade some of them, for many others it will be hard and long to
> > > have the other side fixed.

Can you elaborate on this, please?  Our ("upstream") plan was to make
2.7 a mostly-plug-in replacement for 2.6, so it really should not break
"many" configs.

It does break *some*, though - everything with static keys (--secret)
now needs to acknowledge that this is not a recommended config anymore
by adding --allow-deprecated-insecure-static-crypto to the config 
(but after that it should work as before).

It also can break setups that have no "topology" in the server config,
as the default changed from "topology net30" to "topology subnet" - this
can be fixed by just adding "topology net30" to the server, no changes
to the clients needed.

So we're really curious on what else we broke, and I'm all willing to
help move over to 2.7 - as this is, of course, what will see more focus.


This said, I do not object to having an openvpn26 port around - I hope
it is not necessary ("another thing to take care of"), but the overall
effort should not be very large.  One thing important is communication
here - "why is there an openvpn26 port?", so the scenarios where it is
needed shoud be well understood.

gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             [email protected]