Not particularly pleased about the decision when OpenVPN is the most supported protocol.
Meanwhile their competitor IVPN even does IPsec.
Mullvad: Reminder that OpenVPN is being removed January 15th 2026
https://mullvad.net/en/blog/reminder-that-openvpn-is-being-removed
29 Comments
refalo@programming.dev · 31 pts · 355d
I assume this is because, in addition to the missing ciphers as referenced in the linked article, OpenVPN, even though it uses TLS, it initially uses a very identifiable handshake before initiating TLS, which is not hard to block. I have personally had problems specifically with OpenVPN being targeted/blocked in this way.
deadcream@sopuli.xyz · 23 pts · 355d
Wireguard is not difficult to block either, it's not designed to be hidden. China, Russia, etc have learned long ago how to detect and block it. The only semi-reliable way to bypass sophisticated VPN blocking techniques is to use protocols that mask as regular https traffic (and self-host it since well know public VPNs will of course be dealt with by simply blocking packets to their ip addresses).
HiddenLayer555@lemmy.ml · 9 pts · 355d
But why disable it for the people who can use it? Unless there's a security implication to the handshake?
user224@lemmy.sdf.org · 9 pts · 355d
And I specifically had luck with OpenVPN TCP on port 443 on network which DPI-blocked Wireguard.
deadcream@sopuli.xyz · 6 pts · 355d
Yeah OpenVPN is often used for business reasons (e.g. by remote workers), so it's usually not blocked wholesale, only throttled (and known public VPNs providers and blocked via blacklisting their endpoints' ip addresses). Wireguard meanwhile is used much more rarely so there is less fallout from blocking it completely.
refalo@programming.dev · 2 pts · 354d
Yea every network may do things differently... in my case tcp/443 openvpn is blocked at several places that I frequent.
aprehendedmerlin@lemmy.dbzer0.com · 1 pts · 355d
Wireguard is not Sensorship and DPI resilient at all, it relies solely on UDP. They state it on their official website that it's not their priority at all
aprehendedmerlin@lemmy.dbzer0.com · 15 pts · 355d
First port-forward and now this I mean I get it but being versatile is more important in a VPN for me so no more Mullvad for me. I'll be moving to either windscribe or AirVPN
LazerDickMcCheese@sh.itjust.works · 13 pts · 355d
I switched to Air, its the slowest VPN I've ever used and I'm considering switching back once my subscription is up
mnemonicmonkeys@sh.itjust.works · 4 pts · 355d
Can second AirVPN being slow as shit
LazerDickMcCheese@sh.itjust.works · 1 pts · 354d
Good to hear I'm not alone
aprehendedmerlin@lemmy.dbzer0.com · 2 pts · 355d
Is that so. I also think that windscribe is better
Hexadecimalkink@lemmy.ml · 3 pts · 355d
Hide.me is decent. Last i read Azire is solid too.
aprehendedmerlin@lemmy.dbzer0.com · 3 pts · 355d
windscribe goes on sale a few time in the year. You can get it for 29$ a year which is a great price and for 20$ more you have static IP and permanent port-forwarding. It's a great deal for a trustworthy and feature rich VPN in my opinion
clb92@feddit.dk · 11 pts · 356d
Well that's annoying. When using it with Gluetun, I'm not sure I can even use Wireguard there.
LazerDickMcCheese@sh.itjust.works · 12 pts · 355d
I used Mullvad wire gluetun for about a year without issues. I'm pretty sure it's just a simple config difference
clb92@feddit.dk · 5 pts · 355d
Maybe, but I'm using Gluetun's API too (which is very badly documented), and it seems to me some of the endpoints only work for OpenVPN. But I'll have to look into it properly.
LazerDickMcCheese@sh.itjust.works · 2 pts · 355d
Ah, no idea about that then
aislopmukbang@sh.itjust.works · 3 pts · 355d
warm@kbin.earth · 11 pts · 355d
I find when using Mullvad a lot of sites are blocked vs other VPNs. Are all their IPs on a blacklist somewhere?
oneser@lemmy.zip · 11 pts · 355d
I find frequently switching works well. It's a bit of effort, but I have a small list of countries that work best with certain websites.
sartalon@lemmy.world · 6 pts · 355d
Why this change?
AmbitiousProcess@piefed.social · 36 pts · 355d
Mullvad has stated years ago that "WireGuard is the future" because it supports different cryptographic primitives that they prefer to what OpenVPN supports, it uses less lines of code which makes implementations less prone to errors, and it has a different architecture that reduces the risk from certain kinds of cryptographic attacks.
At least, that's what they claimed back in 2017. It seems they still believe that WireGuard is better than OpenVPN now, but I don't know if they have any more reasoning beyond what they wrote about in 2017 as to why.
fuckwit_mcbumcrumble@lemmy.dbzer0.com · 8 pts · 355d
Can you run multiple wire guard connections simultaneously? The reason I stick with OpenVPN is because my work uses wire guard and I can run two connections at the same time.
XenGi@feddit.org · 5 pts · 355d
Yes.
AmbitiousProcess@piefed.social · 5 pts · 355d
It would depend on whatever the client-side software you use to manage it supports.
You could theoretically have an implementation that sends packets across 1 VPN connection, 5 connections, or 1,000,000, just like how you can make a program that just sends a ping request to one web server, or make one that sends ping requests to 1,000. But if the VPN software your work uses doesn't support it, then you'd be out of luck.
It's probably more likely that any legacy software would support multiple connections with OpenVPN, but not necessarily WireGuard, since OpenVPN's just been around longer, but since WireGuard's codebase is much simpler, it could be something they've put a little time into implementing.
Though since I have no clue what your work uses, there's no way for me to know if it'd support multiple or not without you testing it yourself.
fuckwit_mcbumcrumble@lemmy.dbzer0.com · 1 pts · 355d
My work uses tailscale to get to work things. and I just want a VPN to get into my network at home. Maybe every once in a while connect to something like Mulvad. All 3 distinct programs that have virtually no idea about each other.
With OpenVPN just add as many taps as you need. With wire guard it doesnt way to play nicely with any other Wireguard VPNs running.
sartalon@lemmy.world · 6 pts · 355d
Thank you for the reply!
refalo@programming.dev · -3 pts · 355d
did you read the article?
newcool1230@lemmy.ml · 1 pts · 354d
anyone know alternative VPNs that also include http or socks proxies?
pfr@lemmy.sdf.org · 0 pts · 355d