OpenVPN DCO vs WireGuard on pfSense is an edition and client-requirements decision before it is a speed comparison. DCO moves OpenVPN data processing into the kernel on pfSense Plus. WireGuard also operates in the kernel and is available through an installable package on CE and Plus. Neither architecture alone establishes a throughput winner for your hardware.
Keep OpenVPN in the shortlist when its authentication model or existing clients matter. Consider WireGuard for a small set of peers where individual device keys meet the access requirement. If you have already chosen it, use the pfSense WireGuard setup guide.
What DCO changes on pfSense Plus
Netgate’s DCO documentation explains that offload reduces context switching and permits multithreaded encryption. It changes how an endpoint processes data, rather than creating a different VPN protocol. A DCO-capable endpoint can therefore benefit even when the other peer has no offload support.
DCO is a per-tunnel option on pfSense Plus and is not available on CE. It is not enabled automatically for existing or newly created tunnels. Review compatibility before enabling it; retaining an existing working tunnel while evaluating a separate one makes rollback easier.
DCO compatibility checks before comparing speed
| Check | pfSense OpenVPN DCO requirement |
|---|---|
| Edition | pfSense Plus |
| Transport | UDP; TCP is not supported |
| Tunnel authentication mode | TLS-based |
| Data ciphers | AES-128-GCM, AES-256-GCM or ChaCha20-Poly1305 |
| Compression | Incompatible |
| Multiple routed sites on one server | Review current internal-routing limitations |
The source for this table is Netgate’s DCO limitations list. A deployment that requires an incompatible feature belongs in a comparison with ordinary OpenVPN, even if the firewall runs Plus. Do not assume turning on the checkbox preserves every older tunnel option.
WireGuard on CE and Plus
Netgate’s WireGuard overview describes a package on both editions. Its minimal peer model uses public keys and allowed addresses. It does not provide OpenVPN-style user certificates, directory authentication or an interactive MFA challenge by itself.
Each device should have a distinct key pair and tunnel address. Removing one device’s peer revokes that device without changing everyone else’s keys. Peer identity and firewall access remain separate: a valid key should permit only the destinations that the rules allow.
For edition features beyond VPNs, see pfSense Plus vs CE differences.
Cipher acceleration is protocol-specific
WireGuard’s protocol documentation specifies ChaCha20-Poly1305. It does not use AES, so AES-NI is not a prerequisite for a WireGuard tunnel. An appliance specification emphasizing AES acceleration does not establish its WireGuard performance.
OpenVPN can use different data ciphers. With DCO, both the selected cipher and the acceleration supported by the firewall influence CPU cost. Compare the actual intended configuration, including both endpoints, rather than extrapolating a WireGuard result from an AES-based VPN benchmark.
The pfSense hardware buying guide helps turn your requirements into a shortlist. Keep enough headroom for routing and any inspection packages operating at the same time.
Authentication and client compatibility
OpenVPN on pfSense supports deployment models built around certificates and user authentication. This can be useful where devices and users have different access lifecycles or where an existing client fleet already uses those controls.
WireGuard is easier to reason about when the access list is a small inventory of trusted devices. It still needs a process for distributing profiles, protecting private keys and removing lost devices. Simpler configuration does not remove those responsibilities.
If an approved deployment requires TCP transport, ordinary OpenVPN provides that choice; DCO does not. Record that requirement before comparing CPU specifications so the intended tunnel mode stays clear throughout the purchase decision.
Routes, DNS and firewall permissions still decide access
A working encrypted tunnel does not establish the complete network path. Check the destination routes on the client, permissions on the receiving interface and the destination host’s return route.
Netgate’s WireGuard rules and NAT guidance distinguishes the shared WireGuard rule group from assigned-interface rules. A broad group pass can take precedence over narrower interface rules. Review both when granting different peers different access.
Full-tunnel internet access also needs the appropriate egress policy and IPv4 NAT where required. DNS must be reachable and accept queries from the VPN subnet. Decide explicitly whether IPv6 is routed through the VPN before describing a profile as covering all traffic.
How to choose
Choose WireGuard when per-device keys and its supported clients fit a new CE or Plus remote-access setup. Choose OpenVPN when certificate or user authentication, existing deployments or transport requirements are decisive. On Plus, evaluate DCO only after checking its limitations.
Use the OpenVPN server setup guide or the WireGuard setup guide once that choice is made. Verify the allowed destinations, DNS and return path, then compare throughput under the intended workload. Record the edition, tunnel mode and cipher with any result so future changes have a useful baseline.
Related across the network
- How to Set Up OPNsense as a VPN Server: WireGuard, OpenVPN — opnsenselab.com
