the brief
A VPN technology provider in the USA wanted the OpenVPN data plane inside the Linux kernel: encryption and forwarding in kernel space, spread across CPUs, with no packet making the round trip through userspace.
And they wanted it in mainline, not as one more out-of-tree module.
We designed the module, carried it through 26 rounds of review, and it was merged in Linux 6.16. It’s called ovpn, and we maintain it.
why it's hard
Writing a kernel module is one job. Getting a new one accepted into the networking subsystem is another, and it rarely happens.
Out-of-tree wasn’t an option. A module outside the kernel has to be rebuilt for every release, drifts between distributions, and misses the kernel’s own security process.
Mainline sets a higher bar. Maintainers judge more than correctness: they ask whether the design fits where the subsystem is going, and whether they’ll be happy living with it for years. A patch that works can still be turned down.
the approach
We built a working prototype and put it in front of the kernel community early, before the design set, while objections were still cheap to address.
Feedback went straight back into the code. Every point raised on the netdev mailing list got an answer: a change, or a reasoned case for keeping things as they were.
26 rounds
Then came the long part: 26 patch series over more than 16 months. Each round addressed the last round’s review, until the code met the kernel’s standards and the netdev maintainers’ view of how the subsystem should be built.
This is where most upstreaming attempts stall. We stayed until it was merged.
results
In mainline since Linux 6.16. The code lives in drivers/net/ovpn in Linus Torvalds’ tree. Distributions that enable it ship it with no vendor patches.
Over 7 Gbps. Measured in our lab, and still improving.
No maintenance debt. Build coverage, security fixes and internal API changes are handled upstream, not on the vendor’s budget.
Maintained by us. Antonio Quartulli is listed as the maintainer of ovpn in the kernel’s MAINTAINERS file, with status “Supported”: in kernel terms, someone is paid to look after it.
where ovpn is now
On Linux, OpenVPN 2.7 uses ovpn for its data channel offload, and network operating systems have started shipping it. VyOS now runs OpenVPN 2.7 on the in-kernel module, an integration we carried out.
Products pinned to an older LTS kernel can still get the current module through ovpn-backports, which we also maintain.
OpenWrt ships it too: since April 2026, OpenVPN 2.7 in OpenWrt runs on ovpn through ovpn-backports and it has been on by default in the 25.12 release since July 2026.
what it took
Code good enough for mainline, a design the netdev maintainers agreed belongs in the tree, and 16 months of persistence. We do this routinely.
if this sounds familiar
If you’re carrying out-of-tree kernel code, or you want a feature upstream instead of in your own patch stack, we can take it there.
Just book a call and let’s discuss.
More about our networking and kernel work · Our open-source contributions