Freedom251 › Business VPN Software
ocserv
What ocserv is
ocserv is a free, open-source GNU/Linux server implementing the AnyConnect SSL VPN protocol and working with the OpenConnect VPN client. It provides TCP and UDP tunnels using TLS 1.2 and Datagram TLS, with TCP/TLS fallback when UDP is unavailable. Both IPv4 and IPv6 are supported. Authentication options include passwords, certificates, PAM, RADIUS, and GSSAPI, with documented setups for Kerberos and FreeIPA. Every client receives a separate process, networking device, and IP address, while authentication is separated from unprivileged worker processes. Server keys can be stored in a TPM, hardware security module, or smart card. Administrators can manage connected users with occtl, and RADIUS accounting is supported. Persistent cookie storage allows server restarts without losing sessions. ocserv depends on GnuTLS and is released under the GNU General Public License version 2. Source tarballs and FTP downloads are available, including PGP-signed releases. The server requires routes or firewall rules for forwarding and does not support compression.
Who it suits
ocserv suits Linux administrators building self-hosted VPN access or site-to-site networking with OpenConnect compatibility. It is intended for setups where authentication, routing, and firewall configuration are managed directly.
What it does well
- Free and open-source under GPLv2
- TCP and UDP VPN tunnels supported
- IPv4 and IPv6 networking
- Multiple authentication integrations documented
- Separate client processes and unprivileged workers
What to know first
- No compression support
- Requires GnuTLS dependency
- Routing and firewall forwarding are not provided
- Linux self-hosting is required
Verdict
ocserv provides a configurable Linux VPN server with broad authentication choices and OpenConnect compatibility. Administrators must supply network forwarding rules and accept the absence of compression.
Facts from ocserv's own pages
- Access model
- vpn · infradead.org, 22 Sept 2026
- Accounting and management
- Connected users can be managed with occtl, and the manual describes RADIUS accounting support. · infradead.org, 11 Oct 2026
- Admin control level
- standard · infradead.org, 22 Sept 2026
- Authentication
- It supports password authentication through PAM or a password file, as well as certificate authentication. · infradead.org, 12 Oct 2026
- Client isolation
- Each client is isolated in a separate process with its own networking device and IP address. · infradead.org, 12 Oct 2026
- Compatibility
- The manual says the server has been tested with the OpenConnect client and is also compatible with certain Cisco AnyConnect clients when compatibility options are configured. · infradead.org, 11 Oct 2026
- Compression
- The feature list states that ocserv does not support compression. · infradead.org, 12 Oct 2026
- Distribution
- Released versions are available as source tarballs, and the latest source code is available from the Git repository. · infradead.org, 11 Oct 2026
- Downloads
- Released versions are available as FTP downloads, release tarballs are PGP-signed, and the server depends on GnuTLS. · infradead.org, 12 Oct 2026
- Installation dependency
- The server depends on GnuTLS. · infradead.org, 11 Oct 2026
- Integration options
- The project documents authentication setups for RADIUS, PAM, Kerberos, and FreeIPA. · infradead.org, 12 Oct 2026
- IP support
- It supports both IPv4 and IPv6. · infradead.org, 12 Oct 2026
- Key storage
- The server key can be stored in a TPM, hardware security module, or smart card. · infradead.org, 12 Oct 2026
- License
- The manual states that the program is released under the GNU General Public License, version 2. · infradead.org, 11 Oct 2026
- Networking limit
- ocserv does not perform packet forwarding or filtering between networks; the server needs the required routes or firewall rules configured. · infradead.org, 12 Oct 2026
- Network support
- The server supports both IPv4 and IPv6. · infradead.org, 11 Oct 2026
- Notable limit
- The features page lists no support for compression as a feature. · infradead.org, 11 Oct 2026
- Privilege separation
- The authentication process is separated from worker processes, which run unprivileged. · infradead.org, 12 Oct 2026
- Purpose
- ocserv is a GNU/Linux server that implements the AnyConnect SSL VPN protocol and is compatible with the OpenConnect VPN client. · infradead.org, 12 Oct 2026
- Restart behavior
- Persistent cookie storage allows a seamless server restart. · infradead.org, 12 Oct 2026
- Site-to-site networking
- Yes · infradead.org, 22 Sept 2026
- Support
- Users can ask for help on the project mailing list without subscribing, and posts must be plain text. · infradead.org, 12 Oct 2026
- Supported platforms
- Linux · infradead.org, 22 Sept 2026
- Tunneling
- It supports TCP and UDP VPN tunnels using TLS 1.2 and Datagram TLS, with TCP/TLS available as a backup if UDP is unavailable. · infradead.org, 11 Oct 2026
Where ocserv stands on Freedom251
- Business VPN Software#45 of 94