packages/net/openvpn, branch master

openvpn: add missing CONFLICTS between variants

2026-11-02T14:16:11Z

openvpn-openssl, openvpn-mbedtls and openvpn-wolfssl install the same files, for example /usr/sbin/openvpn and /etc/openvpn.user. All three provide openvpn, so apk never installs two of them. In Kconfig only the implicit conflicts of the default variant openvpn-mbedtls keep the variants apart, so openvpn-openssl and openvpn-wolfssl can both be selected and apk then refuses them in the image build. Let openvpn-mbedtls conflict with the other two and openvpn-openssl with openvpn-wolfssl. Checked with defconfig: of each pair one variant drops to m, and luci-proto-openvpn still selects openvpn-mbedtls. Signed-off-by: Josef Schlehofer

openvpn: enable wolfSSL variant

2026-10-28T17:29:51Z

Build compatibility is fixed on wolfSSL 5.9.4 so remove the BROKEN flag. Signed-off-by: Qingfang Deng

openvpn: update to 2.7.8

2026-10-28T17:29:51Z

Update OpenVPN to the latest version. Signed-off-by: Qingfang Deng

openvpn: make host route depend only on nohostroute

2026-10-23T14:54:17Z

The host dependency for the server endpoint was guarded by route_net_gateway (IPv4) and net_gateway_ipv6 (IPv6). Neither is a reliable signal: - OpenVPN only exports route_net_gateway when it builds a route list, i.e. when route, redirect-gateway/redirect-private or pushed routes are present. A client using route-nopull, or one that filters out the pushed redirect-gateway, gets no host route at all. When another VPN then holds the default route, the server endpoint is routed through that VPN and the tunnel breaks. - OpenVPN looks up net_gateway_ipv6 for the default destination without a source address, which fails when source routing is enabled on wan6 (the default), so the IPv6 host route was rarely added. netifd resolves the gateway for a host dependency itself, so the guards are not needed. Add the host dependency whenever trusted_ip or trusted_ip6 is set, unless nohostroute is set, as WireGuard does. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Erik Conijn

openvpn: update to 2.7.7

2026-09-16T11:36:17Z

Update to the latest version. Signed-off-by: Qingfang Deng

openvpn: update to 2.7.6

2026-08-11T06:18:30Z

Update to the latest version. For changes, see: https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst Signed-off-by: Sander van Deijck

openvpn: update to 2.7.5

2026-07-06T16:32:58Z

Maintainer: Alexandru Ardelean ardeleanalex@gmail.com @commodo Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst Version: Main Compile tested: X86 , the sole patch applies cleanly Run tested: X86 Signed-off-by: Erik Conijn

openvpn: add missing host routes

2026-05-22T04:11:38Z

Maintainer: Alexandru Ardelean ping @feckert First of all big thanks to all involved devs, porting this to proto is not a minor task and besides some small quirks it is working well. (Not all that happy with the use of a default route instead of /1 routes, because you loose internet if the tunnel goes down but that is just me nitpicking) However I had problems with default routing as the host routes to the server endpoint were missing. I tracked it down to code in the `openvpn-hotplug` script and made some changes and in my testing it appears to work now. As a bonus I also added code for a future implementation of the `nohostroute` option. Problem: The host routes were created by just using route setup this however does not work. Solution: using `proto_add_host_dependency` seems the better solution. Furthermore the correct guard for IPv6 seems to be `net_gateway_ipv6` instead of `route_ipv6_gateway` however even the correct guard is only working if ipv6 source routing is disabled on wan6, so perhaps we should consider removing the guard entirely. For now I left it in place with a warning. I have tested it on X86 running master build from 5 days ago, both for IPv4 and IPv6 Please have a look and consider implementing. Thanks Signed-off-by: Erik Conijn

openvpn: use mbedtls by default

2026-05-19T07:04:17Z

When luci-proto-openvpn is selected in `make menuconfig`, openvpn-openssl is picked up automatically. As mbedTLS is the default TLS package, set DEFAULT_VARIANT on openvpn-mbedtls so that it is used by default. Signed-off-by: Qingfang Deng

openvpn: add kmod-ovpn-backports dependency

2026-05-16T08:04:52Z

With openwrt/openwrt@f7d6e73 and openwrt/packages@974c2be, kmod-ovpn-backports can now be built and run correctly. add this dependency enables DCO. Link: openwrt/packages@01fafd69e Test on: Mediatek Filogic GL-MT3000 (with kmod-crypto-hw-safexcel) Signed-off-by: Andy Chiang