That's a pretty nice improvement in OpenVPN performance. I wonder why the package isn't compiled with DCO support and I hope that it will be in the not too distant future.
But I'll try to spell it out in easy-to-digest way:
Install a main snapshot build for your device.
Install kmod-ovpn-dco-v2 package.
Download snapshot SDK package for your platform on a suitable build host.
Use the SDK to compile a new openvpn package. Make sure to select "Enable support for data channel offload (NEW)"
Copy the newly compiled openvpn package to your device and install it, overwriting any existing one.
Done.
I'll leave it to the reader to dive into configuring a build host, how to use the SDK, etc. All of the specifics for this are documented fully in the Wiki under the Developer Guide.
I tried to do it a few days ago but I got lost in the many options that have to be selected on the compiling menu. For some of them I didn't know what to select and I gave up.
For the people with little to no knowledge of self compiling (I'd guess the vast majority of OpenWRT users), it'd be much easier if the package were just compiled with DCO support by default, unless there are good reasons not to do it, like regressions and the like, but I don't think it'd be the case here, would it?
Could anyone please confirm if that's the case or if they know why DCO support isn't added by default?
Then the easiest way must be to build a complete image from source with the kmod package and OpenVPN with data channel offloading installed right away.
Using SDK for this just seems to be a lot of unnecessary work.
I checked and if you enable this open in the menu you automatically get: kmod-ovpn-dco-v2 - 6.6.30.0.2.20240320-r1
So I think you should be good with just enabling this option.
Why it is not enabled by default it is just guessing, but it adds size to the build, DCO is not compatible with some options which should be removed, DCO is still in its infancy there have been frequent updates and if you want a fast VPN you use WireGuard.
But still I can imagine that at some point it will/should be enabled by default.
Also because you can easily disable it in the openvpn config just add: disable-dco
I have tested DCO on an other platform and WireGuard is still faster than OpenVPN with DCO at least in my limited testing on low end (e.g. routers like R7800) hardware
Actually, I had got confused with the different compiling methods. When I tried a few days ago I used the Building a single package guide, not the SDK method.
I've now tried the actual SDK method following this guide and I did make it! I'm already running the self built OpenVPN package with DCO support enabled.
The first quick tests on an MT7621, using the OpenVPN for Android app as client and AES-256-GCM, seem to show a small speed improvement, but I'll look into that part better in the next few days.
I'm more and more convinced that the best thing about OpenWrt is the learning opportunities it offers. Getting to use and benefit from the best router firmware ever is just a bonus
Bravo, @grifo. Remember to check your logs to verify that DCO is actually being used for the connection, simply having it compiled in and the kernel module loaded does not guarantee it's on and active.
After building system with dco + enabling support for data... in my mt7621 I can't reach more than 25 mbit/s, before building/dco... I could reach about 17 mbit/s (both with GCM-128)
Set verb 5 and look in the log if DCO is enabled.
I have heard mixed reports about the speed increase, but it could well be users using incompatible settings causing openvpn to fallback to non DCO
I'm already running the self built OpenVPN package with DCO support enabled.