BSD Ports

security/openvpn 2.7.8 FreeBSD

Secure IP/Ethernet tunnel daemon

System
FreeBSD
Repository
FreeBSD ports
Maintainer
[email protected]
Last update
Commit
4fbd626e70
License
GPLv2
Categories
security, net, net-vpn
Package size
657.5 KiB, 1930.1 KiB installed

Description

OpenVPN is a robust, scalable and highly configurable VPN (Virtual Private Network) daemon which can be used to securely link two or more private networks using an encrypted tunnel over the internet. It can operate over UDP or TCP, can use SSL or a pre-shared secret to authenticate peers, and in SSL mode, one server can handle many clients.

In the other systems

SystemPortVersion
FreeBSDsecurity/openvpn2.7.8
OpenBSDnet/openvpn2.7.8
NetBSDnet/openvpn2.7.7
DragonFlysecurity/openvpn2.6.14
MidnightBSDsecurity/openvpn2.6.14_1

Install

Binary package:

pkg install openvpn

From the ports tree:

cd /usr/ports/security/openvpn/ && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	openvpn>0:security/openvpn

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

Repositoryaarch64amd64armv6armv7i386
FreeBSD:14:latest2.7.82.7.82.5.82.6.14_12.7.8
FreeBSD:14:quarterly2.7.82.7.8n/a2.6.142.7.8
FreeBSD:15:latest2.7.82.7.8n/a-2.6.14_1
FreeBSD:15:quarterly2.7.82.7.8n/an/an/a
FreeBSD:16:latest2.7.72.7.8n/an/an/a
FreeBSD:16:quarterlyn/an/an/an/an/a

Dependencies

As this port's Makefile names them.

Build 2

Test 1

The full lists below include those, and their dependencies in turn.

Build dependencies 13
Run dependencies 4

Configuration

Options name: security_openvpn

OptionDefaultDescription
ASYNC_PUSHoffEnable async-push support
DCOonData Channel Offload/ovpn(4) support->README.dco.md
DOCSoffBuild and/or install documentation
EASYRSAonInstall security/easy-rsa RSA helper package
EXAMPLESoffBuild and/or install examples
LZ4onLZ4 compression support
LZOonLZO compression (incompatible with LibreSSL)
PKCS11onUse security/pkcs11-helper, needs same SSL lib!
SMALLoffBuild a smaller executable with fewer features
TESTonBuild and/or run tests
UNITTESTSoffEnable unit tests
X509ALTUSERNAMEoffEnable --x509-username-field
USES
cpe libtool localbase:ldflags pkgconfig python:build shebangfix ssl
Service scripts
openvpn
Conflicts with
openvpn-devel

Message after installing

Edit /etc/rc.conf[.local] to start OpenVPN automatically at system
startup. See /usr/local/etc/rc.d/openvpn for details.

Connect to VPN server as a client with this command to include the
/usr/local/libexec/openvpn/dns-updown script in the initialization:
openvpn-client <spec>.ovpn

For compatibility notes when interoperating with older OpenVPN
versions, please see online documentation at
<https://github.com/OpenVPN/openvpn/blob/release/2.7/Changes.rst>

Note that OpenVPN does not officially support LibreSSL.

Note that OpenVPN configures a separate user and group "openvpn",
which should be used instead of the NFS user "nobody"
when an unprivileged user account is desired.

You may want to add user openvpn and group openvpn when creating your
configuration files, the example configuration shows this only as comments.

Note that OpenVPN now configures a separate user and group "openvpn",
which should be used instead of the NFS user "nobody"
when an unprivileged user account is desired.

It is advisable to review existing configuration files and
to consider adding/changing user openvpn and group openvpn.

For compatibility notes when interoperating with older OpenVPN
versions, please see online documentation at
<https://github.com/OpenVPN/openvpn/blob/release/2.7/Changes.rst>

Note that the 2.7 version of the port replaced the
libexec/openvpn-client.down and .up scripts with a shared
/usr/local/libexec/openvpn/dns-updown script
(the sbin/openvpn-client script has been updated accordingly).

Files

Manual pages 2
  • openvpn(8)
  • openvpn-examples(5)
pkg-plist 9
  • include/openvpn-msg.h
  • include/openvpn-plugin.h
  • lib/openvpn/plugins/openvpn-plugin-auth-pam.so
  • lib/openvpn/plugins/openvpn-plugin-down-root.so
  • libexec/openvpn/dns-updown
  • share/man/man5/openvpn-examples.5.gz
  • share/man/man8/openvpn.8.gz
  • sbin/openvpn
  • sbin/openvpn-client
distinfo 1
FileSizeSHA256
openvpn-2.7.8.tar.gz2.123466e+06c070d1d2440b5a6fca6c2c68645c98cd492116ac36ef4f0946177115532c8e36
Master sites 2
  • https://swupdate.openvpn.org/community/releases/
  • https://build.openvpn.net/downloads/releases/

Commit history 5

DateCommitCreditsLog message
4fbd626e70 Matthias Andree security/openvpn: Security update 2.7.7 => 2.7.8
Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.8/Changes.rst PR: 299261 Security: CVE-2026-84790 Security: CVE-2026-88964 Security: CVE-2026-84256 Sponsored by: UNIS Labs (vvd, commit patch) Pull request: https://github.com/freebsd/freebsd-ports/pull/637 MFH: 2026Q4
3d91d57f7f Matthias Andree security/openvpn: Security update 2.7.6 => 2.7.7
Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.7/Changes.rst PR: 298152 Pull request: https://github.com/freebsd/freebsd-ports/pull/610 Reported by: mandree (maintainer) Approved by: osa, vvd (Mentors, implicit) Security: CVE-2026-84732 MFH: 2026Q3
bbddd98141 Matthias Andree security/openvpn: bugfix update to 2.7.6
This is not security-relevant on FreeBSD, one security fix affects Windows, the other one only affects builds against mbedTLS (which is not currently supported by the port), and a third one (second bullet point) turned out to not be exploitable. Note that the --dev option defaults to "tun" (if not specified). Note that --ping and --keepalive settings are now capped at 24 h. TCP-based configurations now always enable TCP_NODELAY. Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6 MFH: 2026Q3 Pull Request: https://github.com/freebsd/freebsd-ports/pull/584
83283c284c Matthias Andree security/openvpn: Needs addition to SHEBANG_FILES and some cleanup
- Remove unnecessary GNU_CONFIGURE_MANPREFIX. - Improve post-install-EXAMPLES-on. PR: 296890 Sponsored by: UNIS Labs Co-authored-by: Vladimir Druzenko <[email protected]> MFH: 2026Q3
7bcce8a1bb Matthias Andree security/openvpn: Update 2.7.4 => 2.7.5 (fix 6 CVEs)
Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst The upstream's signing sub-key expired yesterday, new key provided via https://swupdate.openvpn.net/community/keys/gpgkey-F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7.gpg PR: 296429 Security: ffa897a0-756f-11f1-b291-a74de6bb0320 Security: CVE-2026-11771 Security: CVE-2026-12932 Security: CVE-2026-12996 Security: CVE-2026-13117 Security: CVE-2026-13122 Security: CVE-2026-13698 Sponsored by: UNIS Labs MFH: 2026Q2